snowpatch

tl;dr Until this past week, an attacker could have easily and surreptitiously discovered, monitored, and controlled all of the Mysa smart thermostats in the world.

Right before leaving my previous job, we released a lengthy post that I had written about a survey of around 20 million public keys, which I had gathered from all different corners of the Internet during summer 2024.