Comment by lopis

5 days ago

> Many old Pebble apps/faces use weather APIs that no longer work (Yahoo, OpenWeather). The Pebble mobile app now catches these network requests and returns data from Open-Meteo - keeping old watchfaces working!

That's some sweet quality of life fixes!

And we are very determined to keep the Open-Meteo weather API open-access indefinitely and don’t share the same fate as many closed-source APIs like Yahoo or OpenWeatherMap.

How does that work? I assume these APIs use SSL, which should prevent such MitM attacks.

Are those Apps using the system SSL library which bypasses certificate validation for those domains? Or does the OS add a Root CA to the certificate store which signs fake certificates for those domains?

  • I suppose it's because pebble apps use the Pebble SDK, so the SDK can MITM any comms. The Pebble is not connecting directly to the Internet right?

    • I forget the shape of the API but the pebble requests resources over Bluetooth and the mobile app actually makes the requests so it should be able to rewrite anything before/after a request easily.