At first I thought ”Well, duh!”, but the manufacturer having a remote kill switch when he network blocked his vacuum from sharing his home map data with them, as well as unprotected root access when connecting to the vacuum… urgh.
The engineer says he stopped the device from broadcasting data, though kept the other network traffic — like firmware updates — running like usual. The vacuum kept cleaning for a few days after, until early one morning when it refused to boot up.
After reverse engineering the vacuum, a painstaking process which included reprinting the devices’ circuit boards and testing its sensors, he found something horrifying: Android Debug Bridge, a program for installing and debugging apps on devices, was “wide open” to the world.
“In seconds, I had full root access. No hacks, no exploits. Just plug and play,” Narayanan said.
All crappy IoT devices ever made. They aren't used in bot nets all the time because hackers like the challenge of hacking them so much. Security simply isn't a priority.
Tend to agree, security is always the goal but if someone is in my house hacking my vacuum, I have bigger issues. The no-notice remote kill is the bigger issue to me.
But on this threat model? Why would it not be good?
It has to physically accessed on the PCB itself from what I gather.
There are 2 "threats" from what I see:
someone at the distribution facility pops it open and has the know how to install malware on it (very very unlikely)
someone breaks into your home unnoticed and has the time to carefully take apart your vacuum and upload pre-prepared malware instead of just sticking an IP camera somewhere. If this actually happens, the owner has much much bigger problems and the vacuum is the least of their worries.
The homeowner is the other person that can access it and it is a big feature in that case.
yes and no.. i agree with the sentiment, but with root you can extract wifi credentials and various other secrets… you shouldn’t be able to get these things even when you have physical access to the device… the root access itself isn’t the problem
you’re on programming.dev so i assume you know that secrets is a generic term to cover things like your cloud account login (whatever form that may take - a password, token, api key, etc) for the robot vacuum service and you’re being intentionally obtuse
it’s a realistic attack scenario for some people - think celebrities etc, who might be being targeted… if someone knows what type of vacuum you have, it’s not “carefully take apart” - it’d take 30s, and then you have local network access which is an escalation that can lead to significantly more surveillance like security cameras, and devices with unsecured local access
just because it doesn’t apply to you doesn’t mean it doesn’t apply to anyone… unsecured or default password root access, even with physical access, is considered a security issue
Listen, if someone gets physical access to a device in your home that's connected to your wifi all bets are off. Having a password to gain access via adb is irrelevant. The attack scenario you describe is absurd: If someone's in a celebrity's home they're not going to go after the robot vacuum when the thermostat, tablets, computers, TV, router, access point, etc are right there.
If they're physically in the home, they've already been compromised. The fact that the owner of a device can open it up and gain root is irrelevant.
Furthermore, since they have root they can add a password themselves! Something they can't do with a lot of other things in their home that they supposedly "own" but don't have that power (but I'm 100% certain have vulnerabilities).
A few years ago I noticed an annoyance with a soundbar I had. After allowing it onto my WiFi network so we could stream music to it, it still broadcast the setup WiFi network.
While dorking around one day, I ran a port scan on my network and the soundbar reported port 22 (ssh) was open. I was able to log in as root and no password.
After a moment of “huh, that’s terrible security.” I connected to the (publicly open) setup network, ssh’d in, and copied the wpa_supplicant.conf file from the device to verify it had my WiFi info available to anyone with at least my mediocre skill level. I then factory reset the device, never to entrust it with any credentials again.
The Chinese company that steals corporate secrets (I kicked a bunch of their devs once when they were trying to take pictures of prototypes and copy source code on USB keys) and send everything to China? Who would have thought.
Just because it wouldn't stick, doesn't mean they can't sue you and make your life more difficult. (Not saying you shouldn't call out bad actors like that)
In addition, Narayanan says he uncovered a suspicious line of code broadcasted from the company to the vacuum, timestamped to the exact moment it stopped working. “Someone — or something — had remotely issued a kill command,” he wrote.
“I reversed the script change and rebooted the device,” he wrote. “It came back to life instantly. They hadn’t merely incorporated a remote control feature. They had used it to permanently disable my device.”
In short, he said, the company that made the device had “the power to remotely disable devices, and used it against me for blocking their data collection… Whether it was intentional punishment or automated enforcement of ‘compliance,’ the result was the same: a consumer device had turned on its owner.”
All IoT devices do this to keep you from blocking their data collection. They won’t work reliably without a regular ping home. They lock up if they can’t phone home frequently enough.
tapo cameras do. mine all went offline and factory reset themselves after not having internet access or even accounts for several months, all at the same time.
Well, yes, that's what those cheap "smart" devices do. Or does anyone think cheap smart would fit into that device? Rule of thumb: if a device needs internet access, it is spying on you.
Then don't buy those devices. If you have any excuse as to why you "can't do that", then there's zero point in complaining. I'm not saying your complaints are invalid, and companies should be held accountable and criticised. But as long as people buy privacy violating products, companies will continue to violate privacy.
Very valid and true point, but that requires companies to openly admit that they've made their devices to not work if it can't phone home, and no company is gonna do that. At best, they'll tell you it needs internet access, but even then they'll probably downplay it.
Either that or some poor sacrifice will have to be the guinea pig and buy the thing to test it and tell others. Ah, I guess Consumer Reports could do that at least.
There's a version of every device that doesn't phone home. I switched to HomeAssistant a couple years ago now, and I think all of my stuff is finally local as of a few months ago, including my robot vacuum.
I received a Tikom vacuum as a gift and was so sad to see I couldn't installed Valetudo.
On the plus side, it works with no connection and so it's only slightly less covenient to just...press the button on the vacuum itself when I take my dog for a walk. Gotta dump the tray from last time anyway
Home Assistant is open source and self-hosted and doesn’t require internet to operate. The z-wave devices connect directly to the device running Home Assistant. If you want Home Assistant to be private it absolutely can be.
“Someone — or something — had remotely issued a kill command,” he wrote.
“I reversed the script change and rebooted the device,” he wrote. “It came back to life instantly. They hadn’t merely incorporated a remote control feature. They had used it to permanently disable my device.”
In short, he said, the company that made the device had “the power to remotely disable devices, and used it against me for blocking their data collection… Whether it was intentional punishment or automated enforcement of ‘compliance,’ the result was the same: a consumer device had turned on its owner.”
This article just screams rage-bait. Not that I am against making people aware of this kind of privacy invasion, but the authors did not bother to do any fact checking.
Firstly, they mention that the vacuum was "transmitting logs and telemetry that [the guy] had never consented to share". If you set up an app with the robot vacuum company, I'm pretty sure you'll get a rather long terms and services document that you just skip past, because who bothers reading that?
Secondly, the ADB part is rather weird. The person probably tried to install Valetudo on it? Otherwise, I have no clue what they tried to say with "reprinting the devices’ circuit boards". I doubt that this guy was able to reverse engineer an entire circuit board, but was surprised when seeing that ADB is enabled? This is what makes some devices rather straight forward to install custom firmware that block all the cloud shenanigans, so I'm not sure why they're painting this as a horrifying thing. Of course, you're broadcasting your map data to the manufacturer so that you can use their shitty app.
The part saying that it had full root access and a kill-switch is a bit worse, but still... It doesn't have to be like this. Shout-out to the people working on the Valetudo project. If you're interested in getting a privacy-friendly robot vacuum, have a look at their website. It requires some know-how, but once it's done, you know for sure you don't need to worry about a 3rd party spying on you.
I am assuming the individual described in the article is based in the US, but nevertheless, many countries do not allow spying, fraud and criminality as long as you have a TOS that says you are allowed to do so.
This is a very provincial manner of thinking and shows how deeply tolerance of corruption and criminality dominates the American mind.
Same with the kill switch, it is essentially a fraudulent scheme, a criminal activity.
Americans are conditioned to do a lot of things without thinking about it, but if they ever really stopped to consider it, they'd be outraged.
For instance, those heart-tugging ads for St Jude's Children's Hospital. It's a great thing they do, taking in cancer kids, and covering all the expenses, even housing and food. They show grateful parents crying, because their kids have a chance because of the charity of St Jude and the viewers, and viewers shed a tear and donate.
It never occurs to anyone that in almost every other country in the world, such a place wouldn't be necessary. Their cancer kids would simply be taken care of. No pomp about it, no commercials begging for donations, curing cancer kids is just business as usual.
But in America, your kid will just DIE unless you've got good health insurance (which is about to get a LOT more expensive), a lot of money, or hit the charity lottery.
But that never occurs to Americans watching that ad. They will dig into their pockets to send money to St Jude, before they will give money to a progressive candidate to change our health care system so it doesn't require tear-jerking marketing to operate.
Every heartwarming human interest story in America is like "he raised $20,000 to keep 200 orphans from being crushed in the orphan-crushing machine" and then never asks why an orphan-crushing machine exists or why you'd need to pay to prevent it from being used.
For instance, those heart-tugging ads for St Jude’s Children’s Hospital. It’s a great thing they do, taking in cancer kids, and covering all the expenses, even housing and food. They show grateful parents crying, because their kids have a chance because of the charity of St Jude and the viewers, and viewers shed a tear and donate.
What really gripes my ass more than anything else is how all these horror stories are twisted and presented as "feel good" stories that should make us all go "Awww, isnt that wonderful?!"
Like the stories about 6 year olds putting in hundreds of hour of labor to earn the money required to pay off their classmates student lunch debt (and don't even get me fucking started on the abysmal fucking evil idea that that created the idea of student lunch debt to begin with)
Or those "feel good" stories about someone with a wheelchair thats in complete shambles and a hardware store or something cobbles it back together and fixes it, for free, so the owner isnt stuck sitting somewhere with no mobility.
Or someone coming down with cancer, and their coworkers donating vacation days to them so they don't lose their fucking job and the insurance they need to pay for the actual fucking treatment.
Like..
How are these feel good stories?
These are fucking the most egregious failure of civilization horror stories.
and Americans, ever indoctrinated, see these stories and smile and feel emotionally uplifted because of the "good" that was done.
I would say this is true of most (all?) countries/cultures.
My issue with this thread's OP was the portrayal of some US TOS scheme as having legitimatcy. It does not, it's just a local criminal/corruption scheme (every country has them to one degree or another).
I have a friend who set up a Dreame L10s Ultra. I helped them solder the breakout board, and was there when they flashed the new firmware. Relatively straight forward! Just follow the guide on the website and you should be good.
The robot is now accessible only on the local network, and they got it working in Home Assistant. The only feature that is missing now is direct camera view, which the original robot had. Basically, you could get a live feed of the robot's camers at any time. Looked fun, but it was not necessary.
I commented elsewhere, but I once had a soundbar that just had a no password ssh login. It was one of those ‘connect to your WiFi’ to stream music through models and for whatever reason, after connecting it to my WiFi, it continued to broadcast the publicly joinable setup network.
SSH was open to both the unsecured and secured networks, so anyone within WiFi distance of the device could have gained root control of it. Or if I had a sufficiently weak network setup, anyone online could have taken control of it.
On paper all of this stuff is a great idea that would make our appliances more functional.
In reality, the best case scenario is that it’s sold to our corporate overlords so they can slap an ad on your refrigerator and sell you more plastic waste.
Worst case, it’s sold to ICE or some other fascist regime.
Worst case, it’s sold to ICE or some other fascist regime.
Every single government that has a contract with Palantir for Gotham or even whatever the fuck they're doing with the UK NHS data, is reason enough to know this kind of shit is a bad idea. The entire existence of Palantir makes this kind of shit a bad idea by default.
Even if they're not using lavender or where's daddy (yet), I do not want them to have a detailed layout of my home, in addition to all the other information already being collected.
If the day comes when any government needs to crush civil unrest, Palantir gives them an easy button to weaponize your data against you.
That is why I have denied internet access for my robot vacuum cleaner. Xiaomi doesn't need to know the blueprint of my house, and if it can't connect to the internet, there's no need for firmware updates.
I'll start the thing by pressing the button at the top.
I’m unfamiliar with Xiaomi “smart” products, I assume there is an app to control the vacuum, if it does have an app does it still work for you strictly behind your LAN network?
Did a little digging, not sure if you’re someone who self hosts (or owns Homekit enabled devices) but Homebridge appears to offer plugins for Xiaomi smart vacuums this will give you more “smart” functionality without the cost of exposing it to the internet.
It would be nice if it had Bluetooth or something to control from the app. There's no reason I'd want to run the vacuum outside a defined schedule when not at home, so the only useful feature of an app is local config.
I used to be on a mailing list where American companies offered money to people in the third world for menial manual tasks. Like sending pictures of random crap from different angles and such. One time I got an email offering 4 of these things and $100 and all I had to do was put one of them in my home and use it for a week and give the other 3 away. Goes without saying they're clearly a privacy nightmare.
Am I too dumb to understand why sending cartographer data is wrong?
His model is iLife A11 that has Lidar. He probably has an app that is used to control robot and shows cleaning progression. Vac 100% Lidar'd his entire home and sent data to create map in the app.
How in the fuck he thinks it is getting that map? If his ass so smart to find a killswitch and reverse it, how come he doesn't grasp that map data is sent to a server though which he ca use vac app? Like in what world is it not obvious?
Not even gonna discuss about TOS he signed, or that it is general cheap brand cheap but super smart model for it's price.
Unless some FOSS firmware and software is installed, that thing most certainly will ping back home every chance it gets.
Sidenote: My TV now is offline cause when it kept calling home (ove 60% of my pi-holes querries of all time was TV), it would freeze due to pi-hole block. Once set offline - issue is gone. I also know my robo vac is pinging, but at the same time if I block it, I'll lose app controls which I wont do. Sadly, my vac doesn't support Valetudo.
I think yes, to your first question. Couldn't it just crunch the lidardata locally to feed into cartographer, I don't understand why you don't understand that this is the issue.
These arricles are meant to be rage bait for the techno-illiterate. As you said, cell phones mapped your house long ago as well as your smart TV, or any appliance that requires an internet connection.
Both can be true. Probably shouldn't make a regular practice of numbing out to this sort of info with the platitude "Big deal, my phone and facebook already have my data anyway. Might as well give you my mother's maiden name."
I wasn't aware about this with regards to mobile phone tbf. I know you are spied upon on your phone camera, but mapping the house with the phone? Do you mean like Dark Knight stuff?
I live in a prefabricated home that is a different color than my neighbor's. Can I gift them one of these robots to get a blueprint of their house? It is already easily googled but I feel that making a robot do it keeps them lower on the food chain.
This is great, but outside the security aspects of things. What else can this firmware do that I can't with say, the roborock? Am I giving up functions?
I literally just installed this last weekend, so the docs are still pretty fresh in my mind. I still recommend you go read through that site to get the full picture and make your own informed decision, but here's my tl:dr.
Valetudo, first and foremost, is intended to enable select models of vacuum robots to operate cloud-free. It's not intended (nor is it feasible) to offer feature-parity with the manufacturers' firmware/apps/cloud services. But in my limited experience, the only feature my robot is missing after installing valetudo is the ability to live-stream video from the onboard camera, which isn't a big deal at all for me (and is something that the dev specifically won't support). Everything else works flawlessly so far. It also allows you to configure just about anything the robot supports configurability for, like pathing algorithm adjustments, obstacle avoidance sensitivity adjustments, and a whole host of other things. I'm not sure if the manufacturer's app even allows that level of configurability (because I never installed it), but I definitely feel like I have full control over my robot, and it functions flawlessly at performing its job of keeping my floors clean.
I think the biggest thing to be aware of is the rooting/installation process may require some soldering (not of the robot, just some through-hole soldering on a separate breakout board to make connecting to the robot's debug port more foolproof), and requires comfortability in a Linux terminal. If those things aren't in your wheelhouse, I'd say this project probably isn't for you.
Thanks. That answers my question. I already blocked my vacuum from phoning home through my pfsense. So I am mostly there. Flashing seems like extra steps for the same results.
Yeah if your vacuum does enough for you with its Internet access restricted, then there's probably no good reason to install valetudo. I chose to install it on mine because 1. paranoia, 2. I don't have a good firewall solution set up yet, and 3. a lot of features on my vacuum are disabled if it can't phone home, but valetudo re-enables those features.
If you have a robot vacuum, and the robot vacuum makes a persistent map (as opposed to the older "dumber" models that just bounce around randomly), they all send that map back to some remote server. In fact, most of those robots won't even enable the mapping feature unless they're connected to the Internet (which is absolute bullshit considering most of those robots generate, process, and store that map locally, so there's literally no reason to send it off somewhere).
So your options are to just use the robot without ever connecting it to the Internet and be happy with the reduced featureset, root the robot and install Valetudo on it, or just vacuum manually. But until manufacturers are forced to let us actually own the smart devices they sell is, under no circumstances should you ever let one touch the Internet.
Exactly. Local connection. Why the fuck does it need access to some server somewhere? I am sorry... but if they have updates for their shit available they need different ways of making it available.
Also why the fuck does the company need audio recordings from your home? That is literally spy shit. And why does it need the layout? Even if they were doing it purely to improve their products and make them be able to work around confusing layouts and obstacles then that shit needs your full knowledge and consent... and you can withdraw consent at any time for any reason.
That sounds more reasonable. I mean driver updates for many items I used weren't mandatory or searched for by my computer. Not even my windows machine. I had to go on their website to download them.
Seriously, MQTT on your home server or router or whatever and let things talk to eachother THERE. Keep the conversation INSIDE the LAN. This cloud shit is all about building expensive, unnesscarry dependencies.
Never used a robot vacuum, but the idea is that you set it up once and never think about it, right?
So you'd set it up once with bluetooth, then disconnect and let it do its job.
Software updates could cause issues, though if they release a finished product it wouldn't need any or much of those if it works for you already. And updates can be managed over bluetooth.
I worked in tech support for several years last decade... and the amount of people who tell me 'my Facebook isn't working' to mean their internet connection is bust is insane. And they aren't getting any smarter. Last time I worked tech support was in 2021 and I got fired when I nearly lost my shit with an American client who demanded to know why he couldn't enter a company store without a mask.
I've been looking into robotic lawnmowers, and they're basically the same. The more primitive ones have a hall effect sensor under their snout feeling for a wire you bury around the edge of your yard, and do the "go until you hit something, turn a random amount, repeat until low battery, follow perimeter to dock" or they require phoning home in some way, shape or form.
Meanwhile, some guy's got an open source system that runs on a Raspberry Pi on the mower itself.
I guess I'm willing to believe that some of the LIDAR or camera-only guided mowers need some serious processing power to create the maps they use for guidance around the yard, and that's more practical to do on the company's servers than on the device itself...except not really; we've got decently powerful ARM SoCs that don't cost much, don't take a lot of power to run, and can do that job. The reality is, you can't get a pedometer app for a smart phone that doesn't broadcast sensor telemetry to two continents these days.
It reminds me of when Google added everyone's phone numbers to search. Everyone freaked out. "What do you mean anyone can find my number?!" And this is back when phone books were ubiquitous.
It's pointless now as anyone actually making a call (scammers) buys numbers from providers or other thieves. But it's really interesting how publicly available data being more publicity available can be scary.
I feel the same way, I dont care really care about them knowing my house layout, but they shouldn't. We cant let companies get away with infringing on our freedoms and privacy.
I bought a $300 fake Roomba thing. It was on clearance.
And i fought against it for years. But ended it up coming in clutch for a lot of reasons.
It did not have an app, just a IR controller. Its pretty dumb. It bumps into everything. It gets stuck under things. I sometimes have to create a maze so it cleans a specific spot.
Its been a habit of mines to avoid anything with an app that requires internet access. But the product lines are shrinking, and I know at some point, if I want a Roomba, I'll need to invite always-on AI or whatever.
You can have the best of both worlds. There's a lot of smart home stuff that isn't owned by a corporation. For vacuums, Valetudo is amazing and fun to set up, if not a little nerve wracking risking bricking your expensive appliance.
It's funny how these "smart" appliances are all addressing things radically important for households, but in a poisoned way from the beginning. As if those making them were just trying to get there first and win the bank.
There's a problem of scale in industrial innovations, where bigger scale makes cost of production of something and cost for the consumer and network effect power better, meaning that there's no market feedback to help those who came first get old and die to make space for those who come next.
I think this tendency is actually the solution - there is a feedback, it's that lacking feedbacks on one level prohibits those undying monsters from being competitive on the next one. The niche of non-poisoned smart appliances won't be filled by anything big, for example.
That's also another funny moment - instead of dedicated appliances it makes it useful to have one universal one (basically a butler robot) that can be programmed. It's an incentive in the direction of universal machines programmed by customers.
BTW, imagine a frame with various manipulators and sensors attached to an RPi via GPIO, where every manipulator/sensor can be whatever thing at all, just needs to have a manipulator/sensor description template. The OS of the RPi itself runs tasks of the "move those items of fragility categories such and such to such and such locations, remove dust and dirt from that surface, wash that window", for which the existing set of manipulators/sensors and task sequence are optimized without user's involvement (other than attaching them and providing the right description templates, though I suppose manipulator controllers can provide them too, and confirming the resulting jobs). That's also where those LLMs etc are good enough, to interpret instructions and display the sequence of actions they are going to perform to get user's confirmation. This way you won't have to fear that you tell it something harmless and it starts a fire in the room.
Such a system needs a set of standard protocols for the sensors\manipulators, their description templates, and the representation of commands deciphered from human speech to a set of tasks, and the spaces and traits of objects. The programs visualizing the resulting offered set of tasks, deciphering the order, optimizing one set of tasks into a better one, and so on, should be pluggable. Suppose everything's already made, just nobody really needs a thing that they can't just buy and turn on.
OK, I like imagining, should work better instead and start my toy the weekends after the next ones (I suspect I won't start it even by then, at least not in the initial ideologically good form ; nothing about robotics or home appliances). Spent these weekends on making a POV-Ray scene instead.
ahh actions which would be considered "hackers stealing your personal info" twenty years ago is now something people (including me) pay money to be subjected to.
these "smart" appliances are all addressing things radically important for households
Are they, though?
Most of these "smart" functions are at best a slight convenience. And a lot of the "smart" functions in most of them don't really add anything useful to the user experience.
Yes, they are, it's very convenient to have the same thing boil the water and make tea for you, or do the laundry and dry it, or do the floor and the windows when you can be busy with something else, same with cooking. Especially remote-controlled when you are an hour away. And it's not a slight convenience, it's life-changing like remote work.
So what are you cooking an hour away. Only thing I can think of is you have something in a device and you turn it on. Don't think we are at the remote cooking phase yet.
Vacuuming your place while you go get groceries is pretty nice, according to my late mother. And her favorite feature was: the thing easily fit under the bed, so she didn't have to remind herself she was not as spry as she used to be.
188 Comments
Regna@lemmy.world · 302 pts · 309d
At first I thought ”Well, duh!”, but the manufacturer having a remote kill switch when he network blocked his vacuum from sharing his home map data with them, as well as unprotected root access when connecting to the vacuum… urgh.
justsomeguy@lemmy.world · 157 pts · 309d
All crappy IoT devices ever made. They aren't used in bot nets all the time because hackers like the challenge of hacking them so much. Security simply isn't a priority.
Xerxos@lemmy.ml · 200 pts · 309d
The 'S' on IoT stands for security!
SatansMaggotyCumFart@piefed.world · -24 pts · 309d
There isn’t an s in IoT silly.
Alfaspyke@lemmy.zip · 60 pts · 309d
Woosh? Either Yours or mine :)
Arcane2077@sh.itjust.works · 3 pts · 309d
I keep seeing you everywhere and the only reason I won’t block you is because of your username brightening my day every time I see it. Curse you!
GreyEyedGhost@lemmy.ca · 11 pts · 309d
When that is the light in your day....
pipe01@programming.dev · 64 pts · 309d
Is it just me, or is having ADB exposed physically not that big a deal?
KazuyaDarklight@lemmy.world · 112 pts · 309d
Tend to agree, security is always the goal but if someone is in my house hacking my vacuum, I have bigger issues. The no-notice remote kill is the bigger issue to me.
subignition@fedia.io · 18 pts · 309d
The much bigger concern is that the pathway used to send the remote kill command could very easily be utilized by nefarious actors.
krashmo@lemmy.world · 15 pts · 309d
To do what, wear out one section of carpet faster than the rest of your house?
subignition@fedia.io · 14 pts · 308d
If a hacker can get into the device remotely it can be an entry point to your home network.
teft@piefed.social · 10 pts · 309d
Remote “kill”
Where does it end? First it wears down your carpets and then we’re in Maximum Overdrive.
anomnom@sh.itjust.works · 7 pts · 309d
It finds a sharp corner to rub against and hones itself into a stabby bot.
Tehdastehdas@piefed.social · 4 pts · 308d
It could overcharge and overheat the battery, leading to explosion or at least fire.
kylian0087@lemmy.dbzer0.com · 13 pts · 309d
It is not good. But in most cases just adb doesnt grand root access. That's just bad.
riskable@programming.dev · 51 pts · 309d
NO! It'syour device, you should have root! The fact that the manufacturer gives their product owners root is a good thing, not bad!
I will die on this fucking hill.
kylian0087@lemmy.dbzer0.com · 8 pts · 309d
I agree with you. But granting root straight from adb with 0 auth is not good.
JustEnoughDucks@feddit.nl · 3 pts · 308d
But on this threat model? Why would it not be good?
It has to physically accessed on the PCB itself from what I gather.
There are 2 "threats" from what I see:
someone at the distribution facility pops it open and has the know how to install malware on it (very very unlikely)
someone breaks into your home unnoticed and has the time to carefully take apart your vacuum and upload pre-prepared malware instead of just sticking an IP camera somewhere. If this actually happens, the owner has much much bigger problems and the vacuum is the least of their worries.
The homeowner is the other person that can access it and it is a big feature in that case.
pupbiru@aussie.zone · -3 pts · 309d
yes and no.. i agree with the sentiment, but with root you can extract wifi credentials and various other secrets… you shouldn’t be able to get these things even when you have physical access to the device… the root access itself isn’t the problem
riskable@programming.dev · 3 pts · 308d
If I broke into your home, why TF would I carefully take apart your robot vacuum in order to copy your wifi credentials‽
Also, WTF other "secrets" are you storing on your robot vacuum‽
This is not a realistic attack scenario.
pupbiru@aussie.zone · 2 pts · 307d
you’re on programming.dev so i assume you know that secrets is a generic term to cover things like your cloud account login (whatever form that may take - a password, token, api key, etc) for the robot vacuum service and you’re being intentionally obtuse
it’s a realistic attack scenario for some people - think celebrities etc, who might be being targeted… if someone knows what type of vacuum you have, it’s not “carefully take apart” - it’d take 30s, and then you have local network access which is an escalation that can lead to significantly more surveillance like security cameras, and devices with unsecured local access
just because it doesn’t apply to you doesn’t mean it doesn’t apply to anyone… unsecured or default password root access, even with physical access, is considered a security issue
riskable@programming.dev · 1 pts · 307d
Listen, if someone gets physical access to a device in your home that's connected to your wifi all bets are off. Having a password to gain access via adb is irrelevant. The attack scenario you describe is absurd: If someone's in a celebrity's home they're not going to go after the robot vacuum when the thermostat, tablets, computers, TV, router, access point, etc are right there.
If they're physically in the home, they've already been compromised. The fact that the owner of a device can open it up and gain root is irrelevant.
Furthermore, since they have root they can add a password themselves! Something they can't do with a lot of other things in their home that they supposedly "own" but don't have that power (but I'm 100% certain have vulnerabilities).
Monument@lemmy.sdf.org · 53 pts · 309d
A few years ago I noticed an annoyance with a soundbar I had. After allowing it onto my WiFi network so we could stream music to it, it still broadcast the setup WiFi network.
While dorking around one day, I ran a port scan on my network and the soundbar reported port 22 (ssh) was open. I was able to log in as root and no password.
After a moment of “huh, that’s terrible security.” I connected to the (publicly open) setup network, ssh’d in, and copied the wpa_supplicant.conf file from the device to verify it had my WiFi info available to anyone with at least my mediocre skill level. I then factory reset the device, never to entrust it with any credentials again.
billygoat@catata.fish · 18 pts · 308d
Name and shame, what make and model was it?
Monument@lemmy.sdf.org · 14 pts · 308d
It was a TCL Alto 9+.
A quick internet search reveals that this issue was known about at least three years ago.
Another model, the 8i was reported to have a root password of “12345678” - which is partially how I got the idea to start seeing if I could gain root.
6nk06@sh.itjust.works · 2 pts · 308d
The Chinese company that steals corporate secrets (I kicked a bunch of their devs once when they were trying to take pictures of prototypes and copy source code on USB keys) and send everything to China? Who would have thought.
givesomefucks@lemmy.world · 2 pts · 309d
There was an ARS article years ago about it...
87Six@lemmy.world · 173 pts · 308d
Since I dont see it mentioned, the company is
iLife
iLife makes vacuums that map your house and can be remote controlled
Just so we are clear. You should all up your name and shame game.
eronth@lemmy.dbzer0.com · 45 pts · 308d
For real. It's wild how often people don't just straight up call out bad corps.
INHALE_VEGETABLES@aussie.zone · -5 pts · 308d
Could ya be sued, perhaps?
Lemminary@lemmy.world · 11 pts · 308d
No
Someone8765210932@lemmy.world · 5 pts · 308d
Just because it wouldn't stick, doesn't mean they can't sue you and make your life more difficult. (Not saying you shouldn't call out bad actors like that)
87Six@lemmy.world · 1 pts · 308d
And when they sue its the time to come together and support the targets of their lawsuit to bring in the best of the best lawyers to take them down.
You always risk a punch in the face when standing up for yourself but that doesn't mean you should just accept abuse.
INHALE_VEGETABLES@aussie.zone · 1 pts · 307d
Not even perhaps? Well, alrighty!
AdolfSchmitler@lemmy.world · 18 pts · 308d
o7 thank you for your service
muusemuuse@sh.itjust.works · 13 pts · 308d
All modern robot vacuums do this. Amazon and Zillow actually buy that data too.
FosterMolasses@leminal.space · 6 pts · 308d
Implying the vast majority of roombas aren't doing this
There's no safe "opt-out" for people who cannae be arsed to vacuum lol
sommerset@thelemmy.club · 4 pts · 308d
Oh crap. I had one. It committed suicide off the stairs
Wiz@midwest.social · 8 pts · 308d
Maybe for the best.
fistac0rpse@fedia.io · 82 pts · 309d
iLife A11 smart vacuum
bytesonbike@discuss.online · 80 pts · 308d
They kill switched it remotely. Yikes.
muusemuuse@sh.itjust.works · 11 pts · 308d
All IoT devices do this to keep you from blocking their data collection. They won’t work reliably without a regular ping home. They lock up if they can’t phone home frequently enough.
Taleya@aussie.zone · 7 pts · 308d
Tapo's sockets don't - in fact they explicitly have a 'local only' function. All you lose is control outside your home network.
Tuya on the other hand will start leeching off the fucking Bluetooth of your pairing device if you hobble them.
muusemuuse@sh.itjust.works · 2 pts · 308d
tapo cameras do. mine all went offline and factory reset themselves after not having internet access or even accounts for several months, all at the same time.
Taleya@aussie.zone · 1 pts · 308d
Haven't experienced that one - but your statement was "all iot devices do that" (emphasis mine)
And i haven't even touched on Zigbee....
Auli@lemmy.ca · 1 pts · 308d
Haven't had one yet. Block all IOT devices from internet all work fine.
Evotech@lemmy.world · 8 pts · 308d
More likely it killed itself after not being in contact with home base. Since it worked fine elsewhere
Treczoks@lemmy.world · 60 pts · 309d
Well, yes, that's what those cheap "smart" devices do. Or does anyone think cheap smart would fit into that device? Rule of thumb: if a device needs internet access, it is spying on you.
Landless2029@lemmy.world · 23 pts · 309d
!homeassistant@lemmy.world on a isolated vLAN is my goal for "Smart" devices.
Treczoks@lemmy.world · 7 pts · 309d
Yes, but some devices simply don't work without calling home, or have 99% of their brain in a cloud. For those cases, the vLAN does not help.
CeeBee_Eh@lemmy.world · 14 pts · 309d
Then don't buy those devices. If you have any excuse as to why you "can't do that", then there's zero point in complaining. I'm not saying your complaints are invalid, and companies should be held accountable and criticised. But as long as people buy privacy violating products, companies will continue to violate privacy.
Dreaming_Novaling@lemmy.zip · 3 pts · 308d
Very valid and true point, but that requires companies to openly admit that they've made their devices to not work if it can't phone home, and no company is gonna do that. At best, they'll tell you it needs internet access, but even then they'll probably downplay it.
Either that or some poor sacrifice will have to be the guinea pig and buy the thing to test it and tell others. Ah, I guess Consumer Reports could do that at least.
besmtt@lemmy.world · 5 pts · 309d
valetudo.cloud/
Landless2029@lemmy.world · 4 pts · 309d
Thankfully there are groups to replace boards or flash some devices. I need to keep better bookmarks to plug them.
Joelk111@lemmy.world · 3 pts · 308d
There's a version of every device that doesn't phone home. I switched to HomeAssistant a couple years ago now, and I think all of my stuff is finally local as of a few months ago, including my robot vacuum.
ExLisper@lemmy.curiana.net · 57 pts · 309d
Yeah, I read about iRobot gathering and selling info about apartments like 10 years ago. People still alarmed by this are simply ignorant.
Clanket@lemmy.world · 0 pts · 309d
Ignorant of what?
ExLisper@lemmy.curiana.net · 15 pts · 309d
Ignorant of how smart vacuums work and how all connected devices are used to gather personal information that can be sold for profit.
Zwuzelmaus@feddit.org · 56 pts · 309d
I know very well why I installed valetudo before I even started my new vac for the first time 😁
https://valetudo.cloud/
glimse@lemmy.world · 8 pts · 309d
I received a Tikom vacuum as a gift and was so sad to see I couldn't installed Valetudo.
On the plus side, it works with no connection and so it's only slightly less covenient to just...press the button on the vacuum itself when I take my dog for a walk. Gotta dump the tray from last time anyway
Ruthalas@infosec.pub · 1 pts · 308d
This is the way. It works great, I've been running it for years.
ArchmageAzor@lemmy.world · 40 pts · 308d
At this point, if you buy a smart thing you have to know it's spyware.
pir8t0x@ani.social · 4 pts · 308d
True asf
Auli@lemmy.ca · 3 pts · 308d
My home assistant isn't spying on me. My Zwave devices are not spying.
ArchmageAzor@lemmy.world · 1 pts · 308d
I wish I was so naïve
ijustliketrains@lemmy.world · 6 pts · 307d
Home Assistant is open source and self-hosted and doesn’t require internet to operate. The z-wave devices connect directly to the device running Home Assistant. If you want Home Assistant to be private it absolutely can be.
FosterMolasses@leminal.space · 2 pts · 308d
Obligatory
AcidiclyBasicGlitch@sh.itjust.works · 39 pts · 308d
“Someone — or something — had remotely issued a kill command,” he wrote.
“I reversed the script change and rebooted the device,” he wrote. “It came back to life instantly. They hadn’t merely incorporated a remote control feature. They had used it to permanently disable my device.”
In short, he said, the company that made the device had “the power to remotely disable devices, and used it against me for blocking their data collection… Whether it was intentional punishment or automated enforcement of ‘compliance,’ the result was the same: a consumer device had turned on its owner.”
buttnugget@lemmy.world · 9 pts · 308d
Treasonous malware.
Auli@lemmy.ca · 1 pts · 308d
If he blocked the data collection how did it get the kill command?
REDACTED@infosec.pub · 2 pts · 308d
Outgoing vs Incoming
andrew0@lemmy.dbzer0.com · 35 pts · 309d
This article just screams rage-bait. Not that I am against making people aware of this kind of privacy invasion, but the authors did not bother to do any fact checking.
Firstly, they mention that the vacuum was "transmitting logs and telemetry that [the guy] had never consented to share". If you set up an app with the robot vacuum company, I'm pretty sure you'll get a rather long terms and services document that you just skip past, because who bothers reading that?
Secondly, the ADB part is rather weird. The person probably tried to install Valetudo on it? Otherwise, I have no clue what they tried to say with "reprinting the devices’ circuit boards". I doubt that this guy was able to reverse engineer an entire circuit board, but was surprised when seeing that ADB is enabled? This is what makes some devices rather straight forward to install custom firmware that block all the cloud shenanigans, so I'm not sure why they're painting this as a horrifying thing. Of course, you're broadcasting your map data to the manufacturer so that you can use their shitty app.
The part saying that it had full root access and a kill-switch is a bit worse, but still... It doesn't have to be like this. Shout-out to the people working on the Valetudo project. If you're interested in getting a privacy-friendly robot vacuum, have a look at their website. It requires some know-how, but once it's done, you know for sure you don't need to worry about a 3rd party spying on you.
Alphane_Moon@lemmy.world · 34 pts · 309d
I am assuming the individual described in the article is based in the US, but nevertheless, many countries do not allow spying, fraud and criminality as long as you have a TOS that says you are allowed to do so.
This is a very provincial manner of thinking and shows how deeply tolerance of corruption and criminality dominates the American mind.
Same with the kill switch, it is essentially a fraudulent scheme, a criminal activity.
BarneyPiccolo@lemmy.today · 25 pts · 309d
Americans are conditioned to do a lot of things without thinking about it, but if they ever really stopped to consider it, they'd be outraged.
For instance, those heart-tugging ads for St Jude's Children's Hospital. It's a great thing they do, taking in cancer kids, and covering all the expenses, even housing and food. They show grateful parents crying, because their kids have a chance because of the charity of St Jude and the viewers, and viewers shed a tear and donate.
It never occurs to anyone that in almost every other country in the world, such a place wouldn't be necessary. Their cancer kids would simply be taken care of. No pomp about it, no commercials begging for donations, curing cancer kids is just business as usual.
But in America, your kid will just DIE unless you've got good health insurance (which is about to get a LOT more expensive), a lot of money, or hit the charity lottery.
But that never occurs to Americans watching that ad. They will dig into their pockets to send money to St Jude, before they will give money to a progressive candidate to change our health care system so it doesn't require tear-jerking marketing to operate.
Manjushri@piefed.social · 23 pts · 309d
Yep. It reminds me of this .
A_Random_Idiot@lemmy.world · 3 pts · 308d
What really gripes my ass more than anything else is how all these horror stories are twisted and presented as "feel good" stories that should make us all go "Awww, isnt that wonderful?!"
Like the stories about 6 year olds putting in hundreds of hour of labor to earn the money required to pay off their classmates student lunch debt (and don't even get me fucking started on the abysmal fucking evil idea that that created the idea of student lunch debt to begin with)
Or those "feel good" stories about someone with a wheelchair thats in complete shambles and a hardware store or something cobbles it back together and fixes it, for free, so the owner isnt stuck sitting somewhere with no mobility.
Or someone coming down with cancer, and their coworkers donating vacation days to them so they don't lose their fucking job and the insurance they need to pay for the actual fucking treatment.
Like..
How are these feel good stories?
These are fucking the most egregious failure of civilization horror stories.
and Americans, ever indoctrinated, see these stories and smile and feel emotionally uplifted because of the "good" that was done.
Alphane_Moon@lemmy.world · -1 pts · 309d
I would say this is true of most (all?) countries/cultures.
My issue with this thread's OP was the portrayal of some US TOS scheme as having legitimatcy. It does not, it's just a local criminal/corruption scheme (every country has them to one degree or another).
A_Random_Idiot@lemmy.world · 1 pts · 308d
hell most TOS shit isnt even legal in America.
But most people are stupid, and those that arent don't have the money to engage a lawyer to fight it.
MountingSuspicion@reddthat.com · 10 pts · 309d
Just checked out Valetudo. Gotta love the FOSS community. Can I ask if you've used it? If so, which vacuum did you set it up on?
andrew0@lemmy.dbzer0.com · 2 pts · 309d
I have a friend who set up a Dreame L10s Ultra. I helped them solder the breakout board, and was there when they flashed the new firmware. Relatively straight forward! Just follow the guide on the website and you should be good.
The robot is now accessible only on the local network, and they got it working in Home Assistant. The only feature that is missing now is direct camera view, which the original robot had. Basically, you could get a live feed of the robot's camers at any time. Looked fun, but it was not necessary.
MountingSuspicion@reddthat.com · 2 pts · 308d
Thank you for the information!
Monument@lemmy.sdf.org · 4 pts · 309d
I commented elsewhere, but I once had a soundbar that just had a no password ssh login. It was one of those ‘connect to your WiFi’ to stream music through models and for whatever reason, after connecting it to my WiFi, it continued to broadcast the publicly joinable setup network.
SSH was open to both the unsecured and secured networks, so anyone within WiFi distance of the device could have gained root control of it. Or if I had a sufficiently weak network setup, anyone online could have taken control of it.
W3dd1e@lemmy.zip · 33 pts · 308d
On paper all of this stuff is a great idea that would make our appliances more functional.
In reality, the best case scenario is that it’s sold to our corporate overlords so they can slap an ad on your refrigerator and sell you more plastic waste.
Worst case, it’s sold to ICE or some other fascist regime.
https://arstechnica.com/gadgets/2025/10/ring-cameras-are-about-to-get-increasingly-chummy-with-law-enforcement/
AcidiclyBasicGlitch@sh.itjust.works · 8 pts · 308d
Every single government that has a contract with Palantir for Gotham or even whatever the fuck they're doing with the UK NHS data, is reason enough to know this kind of shit is a bad idea. The entire existence of Palantir makes this kind of shit a bad idea by default.
Even if they're not using lavender or where's daddy (yet), I do not want them to have a detailed layout of my home, in addition to all the other information already being collected.
If the day comes when any government needs to crush civil unrest, Palantir gives them an easy button to weaponize your data against you.
Alenalda@lemmy.world · 26 pts · 308d
Wait till you find out what your wifi can do.
ILikeBoobies@lemmy.ca · 16 pts · 308d
Port Scanning blocker was eye opening to how many websites just wanted to check in on me.
burntbacon@discuss.tchncs.de · 8 pts · 308d
Oh, damn! Thanks for reminding me to add that extension since I reinstalled my browser.
Auli@lemmy.ca · 1 pts · 308d
So how are they port scanning yiubif your behind a firewall.
amniote@lemmy.world · 3 pts · 308d
Your browser is the trojan here. Install the plugin 'Port Authority'. Then browse to ebay or IMDB for a demo.
UnderpantsWeevil@lemmy.world · 2 pts · 308d
Sundiata@lemmy.world · 1 pts · 308d
aw he got in my head
Auli@lemmy.ca · 1 pts · 308d
Sure "can" do but isn't.
Alenalda@lemmy.world · 1 pts · 306d
Was referring to this sort of bullshit. https://www.xfinity.com/hub/smart-home/wifi-motion
madjo@feddit.nl · 24 pts · 309d
That is why I have denied internet access for my robot vacuum cleaner. Xiaomi doesn't need to know the blueprint of my house, and if it can't connect to the internet, there's no need for firmware updates.
I'll start the thing by pressing the button at the top.
ohshit604@sh.itjust.works · 2 pts · 309d
I’m unfamiliar with Xiaomi “smart” products, I assume there is an app to control the vacuum, if it does have an app does it still work for you strictly behind your LAN network?
madjo@feddit.nl · 10 pts · 309d
It does have an app, but I'm not using it. It also doesn't work, because it can't find the vacuum on the network.
The device has 2 buttons: "turn on/off" and "find home", those are the only two I need.
A vacuum doesn't need internet access.
ohshit604@sh.itjust.works · 5 pts · 308d
Did a little digging, not sure if you’re someone who self hosts (or owns Homekit enabled devices) but Homebridge appears to offer plugins for Xiaomi smart vacuums this will give you more “smart” functionality without the cost of exposing it to the internet.
Shame they don’t offer that flexibility natively.
sugar_in_your_tea@sh.itjust.works · 3 pts · 309d
It would be nice if it had Bluetooth or something to control from the app. There's no reason I'd want to run the vacuum outside a defined schedule when not at home, so the only useful feature of an app is local config.
smeenz@lemmy.nz · 2 pts · 308d
The app talks to the servers, the servers talk to the robot
ICastFist@programming.dev · 2 pts · 309d
It's Xiaomi, of course the app will not work without internet access
Boozilla@lemmy.world · 21 pts · 309d
the_riviera_kid@lemmy.world · 11 pts · 309d
readies my fourteen-pound lump hammer
nymnympseudonym@piefed.social · 2 pts · 302d
"Never sit down to program without a crowbar close at hand." -Stanislaw Lem
db2@lemmy.world · 10 pts · 309d
Does anyone want any toast?
bytesonbike@discuss.online · 2 pts · 308d
Download the toaster app so you can make toast from anywhere!
stevedice@sh.itjust.works · 20 pts · 308d
I used to be on a mailing list where American companies offered money to people in the third world for menial manual tasks. Like sending pictures of random crap from different angles and such. One time I got an email offering 4 of these things and $100 and all I had to do was put one of them in my home and use it for a week and give the other 3 away. Goes without saying they're clearly a privacy nightmare.
imetators@lemmy.dbzer0.com · 18 pts · 309d
Am I too dumb to understand why sending cartographer data is wrong?
His model is iLife A11 that has Lidar. He probably has an app that is used to control robot and shows cleaning progression. Vac 100% Lidar'd his entire home and sent data to create map in the app.
How in the fuck he thinks it is getting that map? If his ass so smart to find a killswitch and reverse it, how come he doesn't grasp that map data is sent to a server though which he ca use vac app? Like in what world is it not obvious?
Not even gonna discuss about TOS he signed, or that it is general cheap brand cheap but super smart model for it's price.
Unless some FOSS firmware and software is installed, that thing most certainly will ping back home every chance it gets.
Sidenote: My TV now is offline cause when it kept calling home (ove 60% of my pi-holes querries of all time was TV), it would freeze due to pi-hole block. Once set offline - issue is gone. I also know my robo vac is pinging, but at the same time if I block it, I'll lose app controls which I wont do. Sadly, my vac doesn't support Valetudo.
Reginald_T_Biter@lemmy.world · 12 pts · 309d
I think yes, to your first question. Couldn't it just crunch the lidardata locally to feed into cartographer, I don't understand why you don't understand that this is the issue.
Wispy2891@lemmy.world · 9 pts · 309d
afaik the lidar data is crunched locally, then sent to the remote server for easy consumption
when those vacuums are flashed with valetudo, they can still make the map with lidar without internet connection
Reginald_T_Biter@lemmy.world · 0 pts · 308d
Exactly. So it's pure surreptitious data exfiltration. They only reason they send the data back is because they can, and there is value for them.
Gammelfisch@lemmy.world · 15 pts · 308d
Sheeesh, his fucking mobile phone mapped and photographed his house long ago.
DNS@discuss.online · 13 pts · 308d
These arricles are meant to be rage bait for the techno-illiterate. As you said, cell phones mapped your house long ago as well as your smart TV, or any appliance that requires an internet connection.
People traded in their privacy for convenience.
FosterMolasses@leminal.space · 4 pts · 308d
Both can be true. Probably shouldn't make a regular practice of numbing out to this sort of info with the platitude "Big deal, my phone and facebook already have my data anyway. Might as well give you my mother's maiden name."
Netrunner@programming.dev · 3 pts · 308d
Privacy is not worthless just being one bad actor took it. It still is worth pursuing in all layers where possible.
Auli@lemmy.ca · 1 pts · 308d
Phones have never mapped your house and how would they do that? Tvs don't think it would map but yes they watch you.
elephantium@lemmy.world · 1 pts · 308d
Privacy may be dead as you suggest, but that doesn't compel me to dance on its grave.
Gammelfisch@lemmy.world · 0 pts · 308d
+1 Indeed!
TankovayaDiviziya@lemmy.world · 4 pts · 308d
I wasn't aware about this with regards to mobile phone tbf. I know you are spied upon on your phone camera, but mapping the house with the phone? Do you mean like Dark Knight stuff?
ragas@lemmy.ml · 1 pts · 308d
Mapping like that is probably mostly done through bluetooth and wifi triangulation.
Auli@lemmy.ca · 1 pts · 308d
So my Bluetooth is triangulation with what. The signal bouncing around.
ragas@lemmy.ml · 1 pts · 308d
Other bluetooth devices in your area
Auli@lemmy.ca · 1 pts · 308d
Your phone camera is not spying on you.I mean this stuff is not hard to prove why doesn't one of these people who think this prove it.
dev_null@lemmy.ml · 4 pts · 308d
Do you have any source on this? I have never seen a similar article about phones sending a 3D map of your home to the manufacturer.
Eezyville@sh.itjust.works · 2 pts · 308d
I picture the phone doing it the way it was done in The Dark Knight. That scene when Lucius Fox was in China and had to volunteer a phone to security.
Sam_Bass@lemmy.world · 14 pts · 308d
Yeah that issue has been around for at least a couple years now. Luckily my robovac doesn't have WiFi or bluetooth
Scolding7300@lemmy.world · 4 pts · 308d
Chais@sh.itjust.works · 10 pts · 308d
Why would anyone need a moving clock?
Scolding7300@lemmy.world · 2 pts · 307d
Chais@sh.itjust.works · 1 pts · 307d
That makes more sense.
wabafee@lemmy.world · 1 pts · 308d
To display time?
Sam_Bass@lemmy.world · 2 pts · 308d
Nope. Just blacknwhite bezel face cover with a start button
Taleya@aussie.zone · 3 pts · 308d
Same. I will service and repair my goddamn 880 until it is DUST, dammit.
MourningDove@lemmy.zip · 12 pts · 308d
Scolding7300@lemmy.world · 7 pts · 308d
ragas@lemmy.ml · 2 pts · 308d
Sure. Including pictures of people shitting.
kamen@lemmy.world · 5 pts · 308d
Yeah, but without the correlation that this particular fella is living there. That vacuum might've been the missing link in someone's data collection.
Auli@lemmy.ca · 1 pts · 308d
Houses renovate doesn't mean it's accurate.
rumba@lemmy.zip · 12 pts · 308d
I don't care if they map my house, just give me raw access to the data. Them having access to the speaker and mic, i'm more concerned about.
Widdershins@lemmy.world · 11 pts · 309d
I live in a prefabricated home that is a different color than my neighbor's. Can I gift them one of these robots to get a blueprint of their house? It is already easily googled but I feel that making a robot do it keeps them lower on the food chain.
dan69@lemmy.world · 10 pts · 309d
Shit I’m scared of my home speakers echo locating my furniture and the size of my domicile
lechekaflan@lemmy.world · 10 pts · 308d
I remember about news of some Israeli intelligence operatives who jogged around their HQ only to be outed by their tracks on Strava.
burntbacon@discuss.tchncs.de · 8 pts · 308d
I remember army officers and cia folks, specifically. It wouldn't surprise me that israel got caught as well.
FosterMolasses@leminal.space · 9 pts · 308d
misteloct@lemmy.dbzer0.com · 8 pts · 308d
Auli@lemmy.ca · 1 pts · 308d
Yes and who's doing that with your wifi. They had to set it up.
papertowels@mander.xyz · 8 pts · 307d
In case anyone's interested, there's actually open-source self-hosted robot vacuum firmware for select models
jaschen306@sh.itjust.works · 2 pts · 307d
This is great, but outside the security aspects of things. What else can this firmware do that I can't with say, the roborock? Am I giving up functions?
zalgotext@sh.itjust.works · 2 pts · 307d
I literally just installed this last weekend, so the docs are still pretty fresh in my mind. I still recommend you go read through that site to get the full picture and make your own informed decision, but here's my tl:dr.
Valetudo, first and foremost, is intended to enable select models of vacuum robots to operate cloud-free. It's not intended (nor is it feasible) to offer feature-parity with the manufacturers' firmware/apps/cloud services. But in my limited experience, the only feature my robot is missing after installing valetudo is the ability to live-stream video from the onboard camera, which isn't a big deal at all for me (and is something that the dev specifically won't support). Everything else works flawlessly so far. It also allows you to configure just about anything the robot supports configurability for, like pathing algorithm adjustments, obstacle avoidance sensitivity adjustments, and a whole host of other things. I'm not sure if the manufacturer's app even allows that level of configurability (because I never installed it), but I definitely feel like I have full control over my robot, and it functions flawlessly at performing its job of keeping my floors clean.
I think the biggest thing to be aware of is the rooting/installation process may require some soldering (not of the robot, just some through-hole soldering on a separate breakout board to make connecting to the robot's debug port more foolproof), and requires comfortability in a Linux terminal. If those things aren't in your wheelhouse, I'd say this project probably isn't for you.
jaschen306@sh.itjust.works · 1 pts · 306d
Thanks. That answers my question. I already blocked my vacuum from phoning home through my pfsense. So I am mostly there. Flashing seems like extra steps for the same results.
zalgotext@sh.itjust.works · 1 pts · 306d
Yeah if your vacuum does enough for you with its Internet access restricted, then there's probably no good reason to install valetudo. I chose to install it on mine because 1. paranoia, 2. I don't have a good firewall solution set up yet, and 3. a lot of features on my vacuum are disabled if it can't phone home, but valetudo re-enables those features.
papertowels@mander.xyz · 1 pts · 307d
Unfortunately you'll have to do your own research, I only know this exists and have never used it because my vacuum is incompatible.
sem@lemmy.blahaj.zone · 7 pts · 308d
Such a boring dystopia :/
zalgotext@sh.itjust.works · 7 pts · 308d
If you have a robot vacuum, and the robot vacuum makes a persistent map (as opposed to the older "dumber" models that just bounce around randomly), they all send that map back to some remote server. In fact, most of those robots won't even enable the mapping feature unless they're connected to the Internet (which is absolute bullshit considering most of those robots generate, process, and store that map locally, so there's literally no reason to send it off somewhere).
So your options are to just use the robot without ever connecting it to the Internet and be happy with the reduced featureset, root the robot and install Valetudo on it, or just vacuum manually. But until manufacturers are forced to let us actually own the smart devices they sell is, under no circumstances should you ever let one touch the Internet.
ArmchairAce1944@discuss.online · 6 pts · 308d
I don't understand why these devices need an internet connection?
Evotech@lemmy.world · 6 pts · 308d
To upload a map of your home duh
betanumerus@lemmy.ca · 5 pts · 308d
dogs0n@sh.itjust.works · 6 pts · 308d
We need bluetooth devices back, there's no reason for 99.999999% of devices to have your network password.
ArmchairAce1944@discuss.online · 7 pts · 308d
Exactly. Local connection. Why the fuck does it need access to some server somewhere? I am sorry... but if they have updates for their shit available they need different ways of making it available.
Also why the fuck does the company need audio recordings from your home? That is literally spy shit. And why does it need the layout? Even if they were doing it purely to improve their products and make them be able to work around confusing layouts and obstacles then that shit needs your full knowledge and consent... and you can withdraw consent at any time for any reason.
I am too tired to rant further.
dogs0n@sh.itjust.works · 3 pts · 308d
100% agree.
Unless they artifically bloat their patch/update file sizes, I'd imagine sending it through your phone to the device over bluetooth would work fine.
I'd even, personally, prefer they use a wifi link directly between my phone and the device while it updates before I give it free access to my lan.
ArmchairAce1944@discuss.online · 1 pts · 308d
That sounds more reasonable. I mean driver updates for many items I used weren't mandatory or searched for by my computer. Not even my windows machine. I had to go on their website to download them.
muusemuuse@sh.itjust.works · 2 pts · 308d
Seriously, MQTT on your home server or router or whatever and let things talk to eachother THERE. Keep the conversation INSIDE the LAN. This cloud shit is all about building expensive, unnesscarry dependencies.
betanumerus@lemmy.ca · 1 pts · 308d
dogs0n@sh.itjust.works · 2 pts · 308d
Never used a robot vacuum, but the idea is that you set it up once and never think about it, right?
So you'd set it up once with bluetooth, then disconnect and let it do its job.
Software updates could cause issues, though if they release a finished product it wouldn't need any or much of those if it works for you already. And updates can be managed over bluetooth.
betanumerus@lemmy.ca · 1 pts · 308d
webghost0101@sopuli.xyz · 4 pts · 308d
Because people are not taught the basics of Lan network vs Wan network and corporations love to exploit this.
During the aws outage i heard multiple people be upset with their isp because “the wifi is broken”
ArmchairAce1944@discuss.online · 1 pts · 308d
I worked in tech support for several years last decade... and the amount of people who tell me 'my Facebook isn't working' to mean their internet connection is bust is insane. And they aren't getting any smarter. Last time I worked tech support was in 2021 and I got fired when I nearly lost my shit with an American client who demanded to know why he couldn't enter a company store without a mask.
captain_aggravated@sh.itjust.works · 4 pts · 307d
I've been looking into robotic lawnmowers, and they're basically the same. The more primitive ones have a hall effect sensor under their snout feeling for a wire you bury around the edge of your yard, and do the "go until you hit something, turn a random amount, repeat until low battery, follow perimeter to dock" or they require phoning home in some way, shape or form.
Meanwhile, some guy's got an open source system that runs on a Raspberry Pi on the mower itself.
I guess I'm willing to believe that some of the LIDAR or camera-only guided mowers need some serious processing power to create the maps they use for guidance around the yard, and that's more practical to do on the company's servers than on the device itself...except not really; we've got decently powerful ARM SoCs that don't cost much, don't take a lot of power to run, and can do that job. The reality is, you can't get a pedometer app for a smart phone that doesn't broadcast sensor telemetry to two continents these days.
HugeNerd@lemmy.ca · 4 pts · 308d
"secret". Sweet summer child, you've been mapped down to your quarks for decades, and building plans have been at Town Hall since... Louis XIV?
Jeffool@lemmy.world · 1 pts · 308d
It reminds me of when Google added everyone's phone numbers to search. Everyone freaked out. "What do you mean anyone can find my number?!" And this is back when phone books were ubiquitous.
It's pointless now as anyone actually making a call (scammers) buys numbers from providers or other thieves. But it's really interesting how publicly available data being more publicity available can be scary.
Nightsoul@lemmy.world · 4 pts · 307d
I mean, this has been known about for pretty much all smart vacuums.
But who the fuck is going to use the layout of your house for anything?
n0respect@lemmy.world · 4 pts · 307d
The secret police
Soktopraegaeawayok@lemmy.world · 2 pts · 307d
I feel the same way, I dont care really care about them knowing my house layout, but they shouldn't. We cant let companies get away with infringing on our freedoms and privacy.
bytesonbike@discuss.online · 3 pts · 308d
I bought a $300 fake Roomba thing. It was on clearance.
And i fought against it for years. But ended it up coming in clutch for a lot of reasons.
It did not have an app, just a IR controller. Its pretty dumb. It bumps into everything. It gets stuck under things. I sometimes have to create a maze so it cleans a specific spot.
Its been a habit of mines to avoid anything with an app that requires internet access. But the product lines are shrinking, and I know at some point, if I want a Roomba, I'll need to invite always-on AI or whatever.
Lumisal@lemmy.world · 3 pts · 308d
There's some models that work with Matter and a local home server. There's also a couple you can flash with open source software to keep it all local.
ChapulinColorado@lemmy.world · 9 pts · 308d
For those interested, there are some vacuum models listed on this project: https://valetudo.cloud/
It can get technical (since they want people to learn), but the documentation is pretty detailed.
Joelk111@lemmy.world · 3 pts · 308d
You can have the best of both worlds. There's a lot of smart home stuff that isn't owned by a corporation. For vacuums, Valetudo is amazing and fun to set up, if not a little nerve wracking risking bricking your expensive appliance.
vacuumflower@lemmy.sdf.org · 2 pts · 308d
It's funny how these "smart" appliances are all addressing things radically important for households, but in a poisoned way from the beginning. As if those making them were just trying to get there first and win the bank.
There's a problem of scale in industrial innovations, where bigger scale makes cost of production of something and cost for the consumer and network effect power better, meaning that there's no market feedback to help those who came first get old and die to make space for those who come next.
I think this tendency is actually the solution - there is a feedback, it's that lacking feedbacks on one level prohibits those undying monsters from being competitive on the next one. The niche of non-poisoned smart appliances won't be filled by anything big, for example.
That's also another funny moment - instead of dedicated appliances it makes it useful to have one universal one (basically a butler robot) that can be programmed. It's an incentive in the direction of universal machines programmed by customers.
BTW, imagine a frame with various manipulators and sensors attached to an RPi via GPIO, where every manipulator/sensor can be whatever thing at all, just needs to have a manipulator/sensor description template. The OS of the RPi itself runs tasks of the "move those items of fragility categories such and such to such and such locations, remove dust and dirt from that surface, wash that window", for which the existing set of manipulators/sensors and task sequence are optimized without user's involvement (other than attaching them and providing the right description templates, though I suppose manipulator controllers can provide them too, and confirming the resulting jobs). That's also where those LLMs etc are good enough, to interpret instructions and display the sequence of actions they are going to perform to get user's confirmation. This way you won't have to fear that you tell it something harmless and it starts a fire in the room.
Such a system needs a set of standard protocols for the sensors\manipulators, their description templates, and the representation of commands deciphered from human speech to a set of tasks, and the spaces and traits of objects. The programs visualizing the resulting offered set of tasks, deciphering the order, optimizing one set of tasks into a better one, and so on, should be pluggable. Suppose everything's already made, just nobody really needs a thing that they can't just buy and turn on.
OK, I like imagining, should work better instead and start my toy the weekends after the next ones (I suspect I won't start it even by then, at least not in the initial ideologically good form ; nothing about robotics or home appliances). Spent these weekends on making a POV-Ray scene instead.
Why did I even write this.
iAvicenna@lemmy.world · 6 pts · 308d
ahh actions which would be considered "hackers stealing your personal info" twenty years ago is now something people (including me) pay money to be subjected to.
vacuumflower@lemmy.sdf.org · 2 pts · 308d
BDSM is a thing
kent_eh@lemmy.ca · 3 pts · 308d
Are they, though?
Most of these "smart" functions are at best a slight convenience. And a lot of the "smart" functions in most of them don't really add anything useful to the user experience.
vacuumflower@lemmy.sdf.org · 1 pts · 308d
Yes, they are, it's very convenient to have the same thing boil the water and make tea for you, or do the laundry and dry it, or do the floor and the windows when you can be busy with something else, same with cooking. Especially remote-controlled when you are an hour away. And it's not a slight convenience, it's life-changing like remote work.
Auli@lemmy.ca · 2 pts · 308d
So what are you cooking an hour away. Only thing I can think of is you have something in a device and you turn it on. Don't think we are at the remote cooking phase yet.
vacuumflower@lemmy.sdf.org · 1 pts · 307d
Well, suppose it's some stew on low fire, with some meat, lots of cabbage and potatoes, some beans ... Takes time to do right.
Yes, except I meant leaving and turning it off.
DoPeopleLookHere@sh.itjust.works · 1 pts · 308d
Sure, if your physically able to do it all that is.
Things like these are important to disabled folks.
Datahunter@lemmy.world · 1 pts · 307d
DeathByBigSad@sh.itjust.works · 1 pts · 308d
Couldn't someone just google the photos of the house that the realtor took and then compile a map? 🤔
1985MustangCobra@lemmy.ca · -3 pts · 308d
or......just buy a vacuum cleaner and vacuum your house? you don't need smart devices for everything.
Frenchgeek@lemmy.ml · 6 pts · 308d
Vacuuming your place while you go get groceries is pretty nice, according to my late mother. And her favorite feature was: the thing easily fit under the bed, so she didn't have to remind herself she was not as spry as she used to be.
1985MustangCobra@lemmy.ca · -6 pts · 308d
Sorry life is busy If you have responsibilities, that's why you live like me and just retire early on social assistance.
Knoxvomica@lemmy.ca · 1 pts · 308d
Cool
Evotech@lemmy.world · 5 pts · 308d
Robot vacuum is like the best thing we have invented in the last 10 years
1985MustangCobra@lemmy.ca · -1 pts · 308d
I just use a vacuum or a broom. Cheaper, cheaper to replace, and free exercise
Evotech@lemmy.world · 2 pts · 308d
I bet you wash your clothes by hand too
1985MustangCobra@lemmy.ca · 2 pts · 308d
No I use a washing machine, just not that smart crap.