Inspiration
A smart home works — until a company nobody spoke to turns off a server.
In January 2026, Belkin retired the Wemo cloud. Baby monitors lost remote access. Scheduled lighting stopped. Smart plugs running space heaters went dead — on hardware that still powers on. In July, a server-side change at Ecovacs broke the vacuum for every owner at once, all at the same moment. In 2025, Logitech gave owners two weeks' notice before their buttons stopped working.
The hardware was fine every single time. The features were gone.
We noticed something odd: Home Assistant, the most widely used open-source smart-home
platform, already declares for every integration it supports whether that integration needs
a company's server or works on its own — a field called iot_class. And it separately
publishes how many homes run each integration. Two public files, sitting side by side, and
nobody had ever joined them. Nobody could tell you, before it happened, how much of your
home would survive a shutdown.
That question became our hack.
What it does
Blast Radius opens on a living house — sixteen things across four rooms, one cloud overhead. Press play and eight companies turn off their servers one after another: the heater plug goes first, then the robot vacuum, the doorbell, and five more. Nine of the sixteen things go dark on hardware that still works.
Then it hands you the mouse. "Your turn — kill a company." Every button is a real company with a real number of real homes: kill Tuya and 155,567 homes go dark; kill Met.no and it's 438,785. The counter ticks, the hardware stays fine, and one thing always survives — the smart plug, because it talks to your home directly.
Behind the demo are the receipts: 42% of Home Assistant's 1,184 integrations depend on a vendor cloud, touching 2.7 million installations; the dated Belkin, Ecovacs and Logitech events; your own setup analyzed in ten seconds; and a plain-English AI recommendation of what to buy instead. There's also a 60-second, no-jargon pitch deck for anyone who isn't technical.
How we built it
The data join that is the whole product. Every integration in home-assistant/core
declares an iot_class — cloud_push, cloud_polling, local_push, local_polling,
calculated, assumed_state. That is Home Assistant's own statement of whether a device
needs a vendor server. Separately, analytics.home-assistant.io publishes how many
installations run each integration. We scrape both, join them on the integration domain, and
compute the exposure model. Nothing is classified by us and nothing is scored by us — the
entire risk model is upstream data.
The exposure of a setup is simply the share of its integrations that need a cloud:
$$ \text{exposure}(\text{setup}) = \frac{\text{cloud-dependent integrations}}{\text{all integrations}} $$
For the whole ecosystem, measured on 2026-08-06:
$$ \frac{496}{1{,}184} \approx 42\% \quad\Rightarrow\quad 2{,}742{,}280 \text{ installs behind a cloud} $$
The dataset generator (npm run data) is re-runnable, writes provenance and a generation
timestamp into the JSON, and can produce current numbers on any later date.
The stack. React + Vite + Tailwind for the front end, a zero-dependency Node
node:http API in front of one Groq call (qwen/qwen3.6-27b) for the plain-English advice,
and a Vercel serverless handler so the deployed site runs identical logic to local dev. The
Groq key lives in the API process and never reaches the browser. The house is a strict CSS
grid of rooms — no free positioning — so the layout physically cannot drift.
Verification. Every screen was driven with Puppeteer against the real app, at desktop and 390px mobile, checking for dead devices, correct counts, survivor behaviour, and zero horizontal scroll before anything was shipped.
Challenges we ran into
The first version was unreadable. Our first attempt opened like a research paper — stat tiles, a dated event list, a setup picker, dense paragraphs. When we showed it to a real person, the honest reaction was: "I just scrolled, I didn't understand anything." So we deleted the landing page and rebuilt around one question: can you make the problem unmissable in five seconds? The house going dark is the answer. Everything else moved behind it.
Alignment. We started with a free-positioned SVG floor plan; chips drifted, nothing aligned, it looked like a bad simulation. The fix was architectural: a strict CSS grid where every room is a fixed 2×2 cell grid. Zero overlaps, identical chip widths, unbreakable.
Trust. The whole argument is "we invented nothing." That posture dies the moment you add
an invented number or let an LLM guess a classification. So the AI is handed the already
computed cloud/local split and told to explain it — it cannot invent a result, and if its
call fails, the UI shows the failure instead of fabricated advice. Every limitation is on the
page, including that iot_class is coarse and that our own analytics snapshot is opt-in.
Accomplishments that we're proud of
- The moment in the demo where the Wemo plug survives. We didn't write that conclusion — it fell out of the data. Belkin killed the Wemo cloud, but Home Assistant's Wemo integration is local, so it survived the real shutdown. The cloud ones died. The local ones didn't. That is the entire thesis, and we found it in two files, not in a brainstorm.
- The "kill a company" toy. It turns a watch-and-clap demo into something judges play with.
- Live data, live AI. The site computes its numbers from the dataset on every visit and calls a real model — it is not a recording.
What we learned
- Placement beats invention. The hardest part wasn't building something — it was noticing that two public datasets answered a question nobody had asked.
- The emotional demo wins. A screen that shows the problem beats a screen that explains it. The house going dark carries the argument with zero prior knowledge required.
- Trust is a feature. Showing your own limitations — honestly, on screen — is what makes the strong claims believable.
What's next for Blast Radius
- Read a real Home Assistant config so the report describes an actual house instead of a chosen list.
- Watch for changes. Alert the moment an integration you depend on is reclassified, deprecated or archived upstream — the earliest warning that a shutdown is coming.
- Nuance beyond
iot_class. Distinguish "cloud only during setup" from "cloud forever" — the exact ambiguity the Home Assistant community has asked about. - A manufacturer view. The same analysis pointed at a bill of materials answers what breaks at scale if a product line is built on one cloud vendor.
Log in or sign up for Devpost to join the conversation.