They definitely need to figure out something to mitigate the public information bit.  Aside from (presumably) a cost associated with it, there isn&#x27;t anything stopping someone from going to the DMV and getting the info they need about a target.<p>Further, they also really need to change the HTTP method for the endpoints that change state.<p>Nothing&#x27;s stopping someone from putting up an image tag on a well-trafficked website (or buying display ads on a network) with the src set as the endpoint that turns on the AC.  Turns into a real-world DoS when the battery is dead.