Don't shoot the messenger....

Viss is trying to claim there is a security risk here when there isn't one. It's totally fair game to mention that.

As implemented it leaks information to HIBP. Whether or not that is a risk depends on your threat model. Leaking information about your local environment is a fact regardless of your threat model.

It should have remained a privacy matter, the security claims are just confusing .

As he said: "This mechanism could be abused by a malicious threat actor with access to the home assistant github repos in a variety of ways." -> If you get access to write to the Github repo, yes in fact you can for sure do much more damage without ever touching this feature.

Also "I can give you a list as long as my arm about how I could abuse this to loot credentials from every HA install on the planet." -> Waiting for it.

Better, but apparently not good enough: I would have expected a bit more from a company that goes all in on "your home your data and privacy".....

It does seem that this is an unforgivable offense for many HN commenters, which makes me wonder what kind of Home automation those folks are running. Google Home? Amazon Alexa? Samsung SmartThings? Apple Homekit?

The answer is obvious: we would rather have no home automation than have home automation that can't be trusted.

What is unforgivable?

Is there anything wrong with (not) going with a solution based on your personal belief?

You are free to make your own decision.

Working on a fork already: Lets spend some tokens! :)

The feature is not the problem.