Related: https://news.ycombinator.com/item?id=40792684 https://news.ycombinator.com/item?id=40792684 It's clear that they had absolutely no plan to deal with a

Related: https://news.ycombinator.com/item?id=40792684 https://news.ycombinator.com/item?id=40792684 It's clear that they had absolutely no plan to deal with a compromised key. When approached, they probably have been trying to figure out the issue, are simply stuck in an unfixable state because they keys can't be rotated reliably. Now that the issue is publicly known, they can't run their devices safely anymore. I am willing to bet that you don't need their "codebase" as the Rabbitude hackers used, I bet these keys are hardcoded into the devices themselves, and that the key could probably be known within an hour or so and used to wreak havok. So they opted to brick every R1, likely requiring a recovery on a PC using USB, and they need to work out their API key issue before they can ship anything, because there's a chance that any update would get compromised immediately too. I hope every aspect of this grift is studied thoroughly so that investors understand not to throw money at people this unserious anymore.