For the past two years, the smart tracker market has been dominated by three “closed networks”: Apple Find My, Google Find Hub, and Samsung SmartThings. Buy an AirTag and your tracking experience is tied to Apple’s software and policies; buy a SmartTag and it only works inside Samsung’s ecosystem. The price of joining these planet-wide, crowdsourced location meshes — powered by hundreds of millions of phones — is accepting a “black-box” device and an opaque data path.

In late October 2026, an open-source project called FindMyWeb hit the Hacker News front page and sparked a wave of discussion in the tech community. It reverse-engineers Apple Find My, Google Find My Device, and Samsung SmartThings, letting users build location trackers they truly own — flashing their own open firmware and self-hosting the backend — without buying any vendor-locked hardware. At the same time, accessories giant Belkin launched its SureFind lineup in Australia, which supports both Find My and Find Hub, echoing the cross-ecosystem trend from the commercial side. This FAQ explains the technical principles, feasibility, and limits of this “de-locking” wave.

FindMyWeb is an open-source technology stack hosted on Codeberg (an open-source-friendly code-hosting platform seen as an alternative to GitHub), with a single goal: let users build location trackers they actually own. Instead of deploying its own network, it “rides” the existing crowdsourced meshes of the three major vendors — Apple Find My, Google Find My Device, and Samsung SmartThings. The fundamental difference from a normal tracker (AirTag, Pixel Tag, etc.) is control: a normal tracker has vendor-designed hardware, closed-source firmware, and location data flowing through the vendor’s cloud — users can only “use” it without seeing the internal logic; a FindMyWeb tracker runs open, auditable, modifiable firmware, with a backend you deploy yourself (self-hosted), giving you ownership of the full data path. The project has two parts: the backend talks to Apple’s network through FindMy.py, an open-source library by developer malmeloo; the tracker hardware runs a custom firmware called FruityTag, built on Zephyr (an open-source real-time operating system, RTOS, widely used in embedded hardware). Users assemble the hardware, flash the firmware, and manage everything through a unified web interface.

To understand FindMyWeb, you first need to understand how these “finding networks” themselves work. Take Apple Find My as an example: an AirTag has no GPS and no cellular radio. It continuously broadcasts an encrypted, rotating identity over Bluetooth (BLE). When any nearby iPhone, iPad, or Mac with Find My enabled picks up this broadcast, it encrypts and uploads “the tag’s identity + that device’s own location” to Apple’s servers. Only the tag’s owner — holding the pairing keys — can decrypt and see the location. This is the so-called “crowdsourced relay”: the network is quietly supported by hundreds of millions of Apple devices, covering nearly the whole planet.

FindMyWeb’s entry point is this: although the protocol is encrypted and closed-source, it is not entirely impossible to reverse-engineer. The project builds on two earlier efforts: the seemo-lab research group’s early reverse-engineering of the Find My network, and malmeloo’s FindMy.py library, built on that research, which can talk to Apple’s network protocol. In other words, if you can correctly generate and broadcast encrypted identities that conform to the protocol, you can make surrounding Apple/Android devices “report” the location on behalf of your open-source tracker — no need to deploy your own mesh, and no vendor-licensed hardware required. By the same logic, the project claims support for Google Find My Device and Samsung SmartThings as well (the latter two are currently at a “targeted support” stage, less mature than the Apple side).

Technically, yes — and this is FindMyWeb’s most appealing claim: you don’t need to buy an AirTag to connect an open-source tracker to Apple’s Find My network, and you don’t need a SmartTag to reach Samsung’s network. The project README’s own words are “build trackers which you actually own.”

But let’s temper expectations: this is far from “works out of the box.” According to consistent reporting from multiple sources, the project is still in an early stage: the repository has roughly 156 commits, 2 stars, 5 forks, and a ~275 KiB code footprint (Python 38.9% / Vue 35.5% / C 13.1%, etc.) — the scale of an individual or small-team project; two convenience features — Docker deployment and pre-built firmware images — are explicitly marked “TBD” and not yet done; for now it mainly targets “tinkerer” users with embedded-development skills, not ordinary consumers. So the more accurate statement is: the path works and has been validated as feasible, but the barrier is still high and it remains far from mainstream. If you just want to keep track of your keys, buying an AirTag, a Pixel Tag, or a dual-network third-party tag is still the easier choice.

This is a grey area, and the biggest risk of FindMyWeb. To be clear: these finding networks were not originally designed for “unauthorized third-party devices.” Apple, Google, and Samsung each run their own certification and authorization systems for who can join and how (e.g. Apple’s “Work with Apple Find My” certification, Google’s Find Hub specification). FindMyWeb “rides” the network by reverse-engineering the protocol and bypassing vendor authorization, which several reports have described as a legal grey area.

Specific risks include: protocols can change at any time — if a vendor updates its protocol, this reverse-engineered access can break, and the project must keep up in a constant “cat-and-mouse” game; some updates could even permanently sever already-flashed trackers; account and terms-of-service risk — reverse-engineered use may violate each platform’s user agreement / terms of service; no official support — if location fails or firmware errors occur, there is no vendor customer service to turn to. So FindMyWeb is best viewed as an “experiment for research, learning, and asserting data sovereignty” rather than a stable, dependable commercial solution for the long term.

If you buy into the idea of “not being locked to a single ecosystem” but don’t want to flash firmware or run your own server, dual-network third-party tags are the ready-made middle ground. The latest 2026 example is the SureFind lineup from accessories giant Belkin (launched first in Australia in late October). The SureFind range’s core selling point is “one piece of hardware, two ecosystems”:

• SureFind Spot: an AirTag-style round tracker, replaceable CR2032 battery, ~12 months battery life, built-in loop plus a lanyard, 85% recycled plastic, A$29.95 single (roughly ¥130–140, exchange rate uncertain);
• SureFind Card: a credit-card-shaped thin tracker for wallets/passports, up to ~3 years battery but non-replaceable, IP68 dust/water resistance, A$44.95;
• SureFind Loop Cable Tag: a tracker combined with a USB-C charging cable, the braided cable doubling as a carry loop, rechargeable (~4 months per charge), A$44.95.

All three have built-in speakers (85dB on the Spot) and left-behind reminders. Important caveat: although these tags “support” both Find My and Find Hub, they cannot run on both networks at the same time — you must choose one at first pairing, and switching ecosystems requires a factory reset. Some reports also note Belkin has not fully documented the switching flow, so confirm before buying. This makes an interesting contrast with FindMyWeb: commercial dual-network tags solve the convenience of “cross-platform use,” while the open-source project challenges the deeper question of “who controls your data.”

The significance of FindMyWeb is not that it can replace AirTag today, but that it reveals a deeper issue — “location tracking” is shifting from “selling hardware” to “selling network access,” and the network itself is almost a form of “public infrastructure.” A few takeaways worth remembering:

• Find My and its rivals are among the largest crowdsourced sensor networks ever deployed, quietly supported by hundreds of millions of devices with near-global coverage. FindMyWeb’s argument: if a device can “speak” the network’s protocol, then anyone can “ride” it for planet-wide locating without accepting a closed-source stack as the price of admission.
• “Data sovereignty” is becoming a new value proposition: open firmware plus a self-hosted backend means users can audit, modify, and even repair their own trackers — something no commercial tag currently offers.
• The commercial side is softening in parallel: Belkin’s SureFind dual-network lineup, like earlier brands Chipolo, Pebblebee, and Ugreen, is moving toward “one hardware, many ecosystems.” This shows “breaking the lock” has evolved from a geek ideal into a real market direction.

To sum up the trend in one line: tracker competition is shifting from “whose hardware is stronger” to “who gives users more freedom.”

Based on this article and the current market, choose by your real needs across three tiers:

• Just want to find keys/luggage, minimal fuss: go mainstream. iPhone users buy an AirTag (or AirTag 2); Android users buy a Google Pixel Tag (on sale 2026-11-11, $29 single / $99 four-pack) or any certified Find Hub tag. Most stable, works out of the box.
• Mixed Apple + Android household, want one device to cover both: prioritize dual-network third-party tags like Belkin SureFind, Chipolo, or Pebblebee. Remember dual-network tags are “pick one” — switching ecosystems requires a reset.
• Tech enthusiasts / care about data sovereignty: keep an eye on and try open-source projects like FindMyWeb. It suits learning reverse-engineering and embedded development, or as a “data autonomy” experiment — but recognize its grey-area status and instability, and don’t rely on it for critical assets.

Whichever tier, keep two bottom lines in mind: anti-stalking safety (make sure your tag supports Apple/Google’s unknown-tracker alerts so it can’t be misused to track others) and battery safety (tags with coin-cell batteries should be kept away from children, in line with Reese’s Law / UL 4200A requirements).