NoLongerEvil refloashes a bricked Nest and picks your hosting mode during setup
Breathe fresh life into your bricked Nest, now with 100% less evil!
At a glance
- What is it?
- NoLongerEvil-Thermostat is an Electron installer that reflashes Nest Learning Thermostat Gen 1 and Gen 2 devices and then asks whether the thermostat should talk to a hosted service, Home Assistant, or your own server. The repo ships prebuilt firmware images, so the build step is optional unless you want to change the server URL.
- Who is it for?
- It does not fit Windows users, since the README states Windows is not supported for building or flashing, and it is not an option for a device you do not own. Before running the installer, decide which of the three hosting modes you want, because choosing cloud-hosted is a different long-term commitment from standing up the self-hosted server first.
- Can I use it commercially?
- Not without permission. GitHub finds no licence file in the repository, and without a licence all rights are reserved by default: you may read the code but not reuse it. Check the README, or ask the authors, before using it.
- Is it still maintained?
- Yes. The repository last received commits 31 days ago.
- What is it written in?
- Mainly JavaScript, according to GitHub's language statistics.
Answers come from the project's GitHub data, last synced on October 23, 2026, and from our analysis. They are not legal advice.
Editorial analysis
The installer is the product, the firmware is a payload
The repository is mostly a firmware directory, and the interesting part is the split between what has to be built and what has not.
Prebuilt firmware images already sit in the repository at firmware/installer/resources/firmware/. The README is explicit that rebuilding is optional and only needed if you want to customise the firmware, with a server URL as the example. That reverses the usual expectation for a device-flashing project, where you would assume you must have a toolchain before you can do anything at all.
On top of the firmware sits an Electron application that does the flashing and then walks you through configuration. The README describes it as providing low-level access to the device's boot process, and the security note is blunt about the consequences: only use it on devices you own, and improper firmware can brick your device.
The provenance is worth understanding because it tells you what technique is in use. The USB flashing step relies on omap_loader by ajb142, which was written to flash OMAP devices, and that in turn builds on the Nest DFU attack research by exploiteers, which demonstrated that custom firmware could be flashed to Nest devices Gen 1 and Gen 2. Hack House and this project are named as the winners of the FULU bounty for the Nest Learning Thermostat Gen 1 and Gen 2. The firmware images and backend API server code are described as open source soon, which is a promise about the future rather than something in the repository today, and the licence is not identified.
Three hosting modes, chosen during setup
Once the device boots the new firmware, it needs somewhere to send its data, and the installer asks at that moment. The README lists three options.
Cloud-hosted connects to the No Longer Evil platform and requires no server setup on your side. Self-hosted with Home Assistant auto-discovers your Home Assistant instance and connects to the No Longer Evil add-on. Self-hosted with an NLE Server connects to a standalone No Longer Evil server at a custom IP and port.
The important operational detail is the warning attached to self-hosting: you need your server infrastructure set up separately before running the installer. That ordering is deliberate in the documentation. If you pick a self-hosted mode and then discover you have no Home Assistant add-on installed or no server reachable at the address you intended, you have flashed a thermostat that cannot report.
The hosted option removes that failure mode and reintroduces a different one, since your device's data goes to someone else's service. For a device that knows your home's temperature and occupancy pattern, that is a decision worth making deliberately rather than by picking the first radio button.
Building the firmware only when you change the server URL
If you do need a customised build, the toolchain is Docker plus a shell script. Prerequisites are Node.js 18 or later with npm, Docker for firmware builds, and macOS or Linux, since the README states Windows is not supported for building or flashing.
Clone and enter the firmware builder:
git clone https://github.com/codykociemba/NoLongerEvil-Thermostat.git
cd NoLongerEvil-ThermostatThe build covers both hardware generations in one pass, inside Docker, with root access enabled and no interactive confirmation:
cd firmware/builder
./docker-build.sh --generation both --enable-root-access --yesThe output then has to be copied into the installer, which is a separate step people miss:
cp firmware/builder/firmware/* firmware/installer/resources/firmware/Worth noting what `--enable-root-access` implies before you run it. The flag is part of the documented build invocation rather than something you discover, which is considerate, but it also means the default path documented here produces a firmware with root access turned on. If you are flashing your own device that is a choice you are making about your own hardware; it is still a decision rather than an inevitability.
Running the installer without building it
The installer has its own package under firmware/installer, and it can be run straight from source:
cd firmware/installer
npm install
npm run electron:devOr packaged for a desktop, in which case output lands in firmware/installer/dist/:
npm run package:mac # macOS
npm run package:linux # LinuxThose two targets match the platform restriction stated earlier, so there is no Windows artefact even if you wanted one.
If you are not building at all, the recommended route is the GUI installer from the installation guide at docs.nolongerevil.com, or the latest release from the repository's releases page, which is currently v1.0.1 dated 2026-03-31, following v1.0.0 from 2025-11-19. Two documentation sites exist for this project: the installer guide under hosted installation, and a separate self-hosted overview that covers the server side you are expected to have ready in advance.
There is also a hardware alternative worth noting if flashing is not something you want to do at all: the README points at sett.homes for a drop-in PCB replacement option.
Where this project is weakest
Two gaps are visible from the repository itself rather than from opinion.
The first is licensing. The licence field is not identified, which is not unusual for a hardware-flashing effort funded by a bounty, but it does mean you cannot tell what you are permitted to do with the firmware images. For a project whose argument is transparency and right to repair, an unstated licence is an awkward position, and it is a concrete thing to raise before building on it.
The second is the openness promise. The README commits to open sourcing the firmware images and the backend API server code soon, so that the community can audit, improve and self-host its own infrastructure. That is the right commitment and it is not yet delivered. Until it is, self-hosting means trusting a server implementation you cannot read, which undercuts the main argument for the NLE Server mode.
The narrower risk is the one the authors name themselves. Improper firmware can brick the device, and recovery means another DFU flashing attempt using omap_loader. If your Nest is already partly unresponsive, that is the situation in which you most want a tested recovery path and least want a tool with an unstated licence.
Editorial conclusion
It does not fit Windows users, since the README states Windows is not supported for building or flashing, and it is not an option for a device you do not own. Before running the installer, decide which of the three hosting modes you want, because choosing cloud-hosted is a different long-term commitment from standing up the self-hosted server first.
Frequently asked questions
Do I need to build the firmware before running the NoLongerEvil installer?
No. Prebuilt firmware images are already included at firmware/installer/resources/firmware/. Building is only needed if you want to customise the firmware, for example with a different server URL.
Can I install NoLongerEvil-Thermostat on Windows?
No. The README states macOS or Linux is required and that Windows is not supported for building or flashing, and the packaging targets are only package:mac and package:linux.
What hosting options does the NoLongerEvil setup offer?
Three: cloud-hosted through the No Longer Evil platform with no server setup, self-hosted through Home Assistant which auto-discovers your instance and connects to the No Longer Evil add-on, and self-hosted NLE Server at a custom IP and port.
What does the --enable-root-access flag in docker-build.sh do?
It is part of the documented firmware build command that produces images for both Nest Gen 1 and Gen 2 inside Docker. The README gives it in the example invocation without further description, so it is an explicit choice in that build rather than a default you inherit silently.
Is the NoLongerEvil firmware and backend source code open?
Not yet. The README commits to open sourcing the firmware images and the backend API server code soon so the community can audit and self-host its own infrastructure, and the repository licence is not identified.
Which Nest devices does NoLongerEvil-Thermostat support?
Nest Learning Thermostat Gen 1 and Gen 2, which is also the scope of the FULU bounty the project won with Hack House. The firmware build script takes a generation argument and the documented command builds both.
Official sources
Add this badge to your README
If you maintain this project, the badge below links readers to this analysis and shows its maintenance status from the daily GitHub snapshot. Paste the markdown into your README; add ?metric=license or ?metric=stars to the image URL for a different field.
[](https://hysenlabs.com/projects/codykociemba-nolongerevil-thermostat)Was this useful?