Blink integration is marking my new recorded videos as already seen

[ml0renz0]

The problem

I created an automation based on this example and then some movement detection recorded videos where marked as seen although I didn't open them yet.

When I disable this automation that updates the image shown of my blink camera it stops marking my videos as seen.

When automation is enabled recorded videos are sometimes marked as seen 3 minutes after, sometimes 10. I checked and blink integration has not been updated lately, so I'm thinking maybe blink's API changed its behaviour somehow?

What version of Home Assistant Core has the issue?

2023.8.2

What was the last working version of Home Assistant Core?

No response

What type of installation are you running?

Home Assistant Container

Integration causing the issue

Blink

Link to integration documentation on our website

https://www.home-assistant.io/integrations/blink/

Diagnostics information

No response

Example YAML snippet

automation triggering this behaviour

alias: actualizar captura portero
description: ""
trigger:
  - platform: time_pattern
    hours: "*"
    minutes: /5
    seconds: "0"
condition: []
action:
  - service: blink.trigger_camera
    data: {}
    target:
      device_id: bd4a5bf0740aad568d894cfb7e1d0c80
  - delay:
      hours: 0
      minutes: 0
      seconds: 5
      milliseconds: 0
  - service: blink.blink_update
    data: {}
  - service: camera.snapshot
    data:
      filename: /tmp/portero.jpg
    target:
      device_id: bd4a5bf0740aad568d894cfb7e1d0c80
mode: single

Anything in the logs that might be useful for us?

No response

Additional information

No response

[home-assistant]

Hey there @fronzbot, mind taking a look at this issue as it has been labeled with an integration (blink) you are listed as a code owner for? Thanks!

Code owner commands

Code owners of blink can trigger bot actions by commenting:

• @home-assistant close Closes the issue.
• @home-assistant rename Awesome new title Renames the issue.
• @home-assistant reopen Reopen the issue.
• @home-assistant unassign blink Removes the current integration label and assignees on the issue, add the integration domain after the command.

_{^{(message by CodeOwnersMention)}}

---

blink documentation
blink source
_{^{(message by IssueLinks)}}

[fronzbot]

Sorry I'm not entirely sure I understand the problem, could you elaborate some more (maybe with screenshots or relevant logs)? I'll respond to everything you with my understanding so hopefully it is easier for us to converge on the underlying issue.

When I remove the integration it stops marking my videos as seen.

When the integration is removed, it should no longer interact with Blink so this sounds like expected behavior.

They are sometimes marked as seen 3 minutes after, sometimes 10, quite strange for a bug in code...

I'm assuming you mean this is what happens before removing the integration? And what constitutes "Marked as seen"? Note that the integration operates based on polling so a 10min change in status is not at all unreasonable.

Do we have to be worried about this integration?
Is its code compromised?
Should we remove it until further notice?
It shouldn't be doing that whatsoever...

The underlying library is completely open source if you'd like to vet it yourself: https://github.com/fronzbot/blinkpy
The only thing the library does is mimic API calls that the Blink App itself does. Before jumping to wild conclusions/accusations, it might be better to have a level head and discuss the potential issue at hand. That doesn't preclude the possibility of a vulnerability, but jumping to an assumption that the code is compromised (especially when the code is completely open source and you can view every commit going back to 2017 when I first released it) doesn't help and just muddies the waters without a clear description (or examples) of the issue you're seeing.

[ml0renz0]

Sorry I'm not entirely sure I understand the problem, could you elaborate some more (maybe with screenshots or relevant logs)? I'll respond to everything you with my understanding so hopefully it is easier for us to converge on the underlying issue.

What a horrendous issue description did I write! It was late, I was away and afraid someone had broken in in my network, my sincerest apologies.

When I remove the integration it stops marking my videos as seen.

When the integration is removed, it should no longer interact with Blink so this sounds like expected behavior.

Sorry, I didn't mean to write integration but automation (apologies again). I disabled the automation and it stopped happening. I didn't enable it since then.

They are sometimes marked as seen 3 minutes after, sometimes 10, quite strange for a bug in code...

I'm assuming you mean this is what happens before removing the integration? And what constitutes "Marked as seen"? Note that the integration operates based on polling so a 10min change in status is not at all unreasonable.

I mean that when automation is enabled and blink system is armed I receive notifications on my phone when movement is detected by the blink camera. But when I open the blink app I see the new recorded videos (that I didn't yet open) already marked as seen.

Do we have to be worried about this integration?
Is its code compromised?
Should we remove it until further notice?
It shouldn't be doing that whatsoever...

The underlying library is completely open source if you'd like to vet it yourself: https://github.com/fronzbot/blinkpy The only thing the library does is mimic API calls that the Blink App itself does. Before jumping to wild conclusions/accusations, it might be better to have a level head and discuss the potential issue at hand. That doesn't preclude the possibility of a vulnerability, but jumping to an assumption that the code is compromised (especially when the code is completely open source and you can view every commit going back to 2017 when I first released it) doesn't help and just muddies the waters without a clear description (or examples) of the issue you're seeing.

You're completely right, apologies again. I was away on vacation and panicked a bit when I saw new videos recorded by movement detection in my house that where already seen. I had limited access to my system and couldn't gather & attach the information needed to properly trace this issue.

I will enable the automation again to try and reproduce this issue again and come back to you as I should have in first place: with logs, more info and meaningful comments 😅

[ml0renz0]

I checked and this happens since my last pull of HA stable docker image.

I re-enabled the automation and right now it is marking the last video recorded from movement detection as seen whenever I execute said automation:

2023-08-29 11:18:18.222 DEBUG (SyncWorker_44) [blinkpy.camera] Found 3 recent clips for entrada
2023-08-29 11:18:18.223 DEBUG (SyncWorker_44) [blinkpy.camera] Most recent clip for entrada was created at 2023-08-29T09:11:44+00:00: https://rest-e002.immedia-semi.com/api/v3/media/accounts/XXXXXX/networks/369464/lotus/86269/pir/3654965765.mp4
2023-08-29 11:18:18.224 DEBUG (SyncWorker_44) [blinkpy.api] Making GET request to https://rest-e002.immedia-semi.com/api/v3/media/accounts/XXXXXX/networks/369464/lotus/86269/thumbnail/thumbnail.jpg?ts=1693300686&ext=
2023-08-29 11:18:18.369 DEBUG (SyncWorker_44) [blinkpy.api] Making GET request to https://rest-e002.immedia-semi.com/api/v3/media/accounts/XXXXXX/networks/369464/lotus/86269/pir/3654965765.mp4

It seems this GET is what is marking my video as seen:
2023-08-29 11:18:18.369 DEBUG (SyncWorker_44) [blinkpy.api] Making GET request to https://rest-e002.immedia-semi.com/api/v3/media/accounts/XXXXXX/networks/369464/lotus/86269/pir/3654965765.mp4

Let's check the code, it seems HA version 2023.8.2 includes blinkpy version 0.21.0 that includes this PR: Add get_videos_metadata function (@rhhayward #685)

Hmmm, could it be that this PR (introduced in blinkpy-0.21.0 that comes with HA 2023.8.2) raises this issue as a side effect?

Tracing back from said log line we get to:

• function http_get in file api.py that is called from
  • function do_http_get in file blinkpy.py that is called from
    • function _parse_downloaded_items also in file blinkpy.py that was modified in the PR referenced above and is marked with a warning: Added line #L415 was not covered by tests

Hope this helps

[ml0renz0]

@fronzbot ping

[ml0renz0]

fronzbot/blinkpy#799

[issue-triage-workflows]

There hasn't been any activity on this issue recently. Due to the high number of incoming GitHub notifications, we have to clean some of the old issues, as many of them have already been resolved with the latest updates.
Please make sure to update to the latest Home Assistant version and check if that solves the issue. Let us know if that works for you by adding a comment 👍
This issue has now been marked as stale and will be closed if no further activity occurs. Thank you for your contributions.