MQTT

Security Traps

• Default Mosquitto allows anonymous connections — bots scan constantly, always configure auth
• TLS mandatory for external access — credentials travel plaintext otherwise
• Duplicate client IDs cause connection fights — both clients repeatedly disconnect each other
• ACLs should restrict topic access — one compromised device shouldn't read all topics

QoS Misunderstandings

• Effective QoS is minimum of publisher and subscriber — broker downgrades if subscriber requests lower
• QoS 1 may duplicate messages — handlers must be idempotent
• QoS 2 has significant overhead — only use for commands where duplicates cause problems
• QoS applies per-message — can mix within same topic

Topic Design Pitfalls

• Starting with / creates empty first level — home/temp not /home/temp
• Wildcards only work in subscriptions — can't publish to home/+/temperature
• # matches everything including nested — home/# gets home/a/b/c/d
• Some brokers limit topic depth — check before designing deep hierarchies