7 ms·
Rabbit failed to properly reset keys: emails can be sent from rabbit.tech domain
- skilled 2y agoThe 404 Media article linked on the page: https://archive.is/QdTbK https://archive.is/QdTbK
- jsheard 2y agoOnce it came to light that the Rabbit founders last venture was a blatant rug-pull Web3/NFT project it was only a matter of time before this project fell apart as well. https://www.xda-developers.com/rabbit-nft-company-past/ https://www.xda-developers.com/rabbit-nft-company-past/ The claims they made about the R1s capabilities even echoed claims they had previously made about their defunct GAMA "Quantum Engine" Web3 buzzword soup. > Later, in August 2023, the "Quantum Engine" became OS2, a personalized operating system that could do things for you like order groceries.
- bluSCALE4 2y agoI had bought one but after the hackernews articles, I vowed to not open the box and send it back. I was prompted refunded and I'm glad I followed through.
- namanyayg 2y agoWhat an absolute dumpster fire Rabbit has been. I knew they were overhyping things with their pre-launch promises, but the reality of their engineering was much worse than I could have ever imagined.
- isoprophlex 2y agoThey were shilling NFTs and metaverse shit not long ago. That should tell you enough about the scrupulousness, or lack thereof, of these people.
- intunderflow 2y agoArticle title downplays the important part (can read other users emails)
- mpschorr 2y agobut only on the r1 subdomain, which is used for sending spreadsheets to users, so all spreadsheets can be read + from a researcher in discord: “we couldve also read auth.rabbit.tech […] which is basically all rabbithole password resets, aka arbitrary account takeover including admin accounts”
- _pdp_ 2y agoThis level of incompetence is quite amazing to see.
- crims0n 2y agoMy R1 is quite terrible, queries only work about half the time. When it does work it has limited information/functionality. Keeping it to hack on the hardware though, it's pretty spiffy.
- Teknomancer 2y agoDo a teardown video plz.
- notRobot 2y agoMultiple exist on the internet, did you try searching? https://www.ifixit.com/News/95474/rabbit-r1-and-humane-ai-pin-teardown-the-beginning-of-a-new-device-category https://www.ifixit.com/News/95474/rabbit-r1-and-humane-ai-pi...
- linmob 2y agoI am quite happy with mine. I installed LineageOS (GSI image without Google stuff) on my Rabbit R1 - the goal is to have a less addictive mobile device that can do offline maps with GPS and otherwise be a modern iPod (listening to podcasts and music) - and it's quite good for that. Using the wheel to zoom in Organic Maps is fun :-) I hope to find the time to blog about this soon.
- vessenes 2y agoI have one of these in my bag right now, never turned on though. I understand it's some custom Android hardware and synthesizes a bunch of API-based NN service providers, and doesn't do anything on device, but I'm not too mad at that -- for this price point this year, it was always only going to be something like that. I am interested in the ongoing form factor experimentation happening, and want to encourage startups to think differently about form factors, so I'm happy to buy stuff that doesn't quite hit the mark, as long as it's got an interesting idea. Anyway, I'm looking forward to giving it a try, and I'll almost certainly never use it once I've kind of pawed through it and seen what seems good and what seems bad. Similar for that humane pin which I think I paid for but never even received. If you read a lot of sci-fi, authors have put an immense amount of time into thinking about what UI looks like as we have supercompute/AI access more broadly, and I think it's clear that a phone isn't the final state for these interactions. What's less clear to me is what sort of compelling mid-way points there are between what we have now and ubiquitous environment-aware AGI (e.g. Minds from Iain Banks). It's one reason I thought humane's projector was really interesting; we do a lot of visual interaction in daily life, so an audio-only earbud isn't likely to be the be-all/end-all. Anyway, hardware startup guys, please make more of these, and figure out what's going to be compelling when we've scaled up bandwidth, scaled down latency and scaled up local compute. I'm looking forward to buying it.
- causal 2y agoI think watch or earbud are still the only acceptable wearable form factor. Add pinhole cameras so it's aware of its surroundings and you could have a very useful assistant that keeps up with what you're doing in realtime.
- vessenes 2y agoBanks and others imagine terminals as earrings, with (presumably) beam forming audio in a ‘mid tech’ scenario. How visuals get shown varies, from “holograms created by magic” to “smart walls”. We seem to be pretty close, like a year or two out, from high quality spatially aware “show the human information right here in this room” — I’d bet that a small model could do a great job at picking a place to show info right now, but we don’t really have ‘smart’ environments yet in general.
- WanderPanda 2y agoTbh I got exactly what I expected when buying the R1, build quality is actually even better than expected.
- deleted 2y ago[deleted]
- lagniappe 2y agoI was wanting to reply to another comment to this, but I keep getting an error from HN: >jsheard 14 minutes ago | parent | next [–] >They contracted Teenage Engineering to do the industrial design so that part at least was done competently. TEs involvement brought them a lot of attention, which has now backfired on TE since there will probably be a lot more skepticism of their partnerships after this. My reply is that I am curious if TE has anything put in place so that this doesn't happen again, and what projects they're currently launching that took place before any procedures to prevent it. Generally, I enjoy TE's gear, but this has given me pause.
- azinman2 2y agoBut it wasn't a product sold by TE, it was a consultancy. And they delivered - the actual hardware is pretty great. What's the problem?
- lagniappe 2y agoThe problem is obvious, I'm a customer of theirs and now I'll sit out the next few releases and be more cautious in buying their hardware on the chances that there are more projects like this working their way out of the pipeline as they learn from it. This has damaged their brand. I am only one person, but I would be surprised if I'm the only one who feels this way.
- officeplant 2y agoTE lives to damage their brand in the strangest ways.[0] They survive off of niches and influencer hype cycles. There is no stopping the average TE customer because they are there for the aesthetics alone even if the value proposition gets worse all the time on many of their products. The OP-1 went from $699-1400 over time before they even put out a significant hardware revision for even more money. That being said I still want a ep-133, because I'm weak. [0]https://teenage.engineering/store/field-desk https://teenage.engineering/store/field-desk
- dang 2y agoRecent and related: Rabbit data breach: all r1 responses ever given can be downloaded - https://news.ycombinator.com/item?id=40792684 https://news.ycombinator.com/item?id=40792684 - June 2024 (32 comments)
- deleted 2y ago[deleted]
- kstrauser 2y agoIs this verified? 404 Media wrote that they got an email from the researcher impersonating Rabbit[0], but the unpaywalled part of that doesn't explicitly say that they verified the headers. I could spoof an email from president@whitehouse.gov to an email server that doesn't strictly enforce SPF etc., but that's a lot different than sending an email out via the actual whitehouse.gov mailserver. Given the other claims, I don't doubt that researchers can do this. I just haven't yet seen a strong verification of this claim. [0]https://www.404media.co/researchers-prove-rabbit-ai-breach-by-sending-email-to-us-as-admin/ https://www.404media.co/researchers-prove-rabbit-ai-breach-b...
- Shank 2y ago> but the unpaywalled part It's worth noting that as far as I'm aware, 404Media doesn't have a paywall, it has a sign-in wall. In theory, I think you can register and bypass it for free.
- flutas 2y ago> It's worth noting that as far as I'm aware, 404Media doesn't have a paywall, it has a sign-in wall. That's still a paywall. > In theory, I think you can register and bypass it for free. The price is your data and them spamming your email/selling it to whoever to spam.
- Retr0id 2y agoI was among those who received a demonstration email, and I can confirm that DKIM+DMARC+SPF all checked out. Someone else shared an .eml, which I haven't looked at personally, but presumably checks out: https://x.com/RhinozzCode/status/1805987021304820181 https://x.com/RhinozzCode/status/1805987021304820181
- xlinux 2y agoSad thing is people support and enrich shitty conmen like this but hate to pay an opensource dev/tool/lib.
- localfirst 2y agoDo you ever pay for FOSS software? No.
- officeplant 2y agoSome of us do donate instead when the option is available.
- thih9 2y agoNote that Android is a mostly open source and overwhelmingly more profitable indirect competitor. Rabbit itself is a wrapped android app [1]. [1]: https://arstechnica.com/gadgets/2024/05/rabbit-r1-ai-box-is-just-an-android-app-and-the-software-can-run-on-a-phone/ https://arstechnica.com/gadgets/2024/05/rabbit-r1-ai-box-is-...
- azinman2 2y agoThe hardware is good and the vision is compelling. It’s also only $200. I think it’s far too early to call it a con.
- kajecounterhack 2y agoThe hardware is far from good. I have one and got real intimate with it. The battery life is ass and holding everything back (e.g. maybe why they disable touchscreen for a lot of things?). The mediatek chip inside is really cheap and bad. There's no edge compute, so it's clear that they want it to be an interface to cloud services, but really begs the question "then why not just use your phone." The vision is just what everyone is working on -- connecting LLMs to tools. Wake me up when it can do half of what Google Assistant can already do for me. I'll add that Google Assistant is free, and fast.
- tomphoolery 2y agome to rabbit: "why don't you just give up?"
- MangoCoffee 2y agoJesse Lyu's story just smells off. He was into crypto, then moved to AI. He seems like a grifter hopping on the hottest trend. I'm looking at you, C3.ai's Tom Siebel.
- threeseed 2y agoIf you look on Twitter it's a very common story. Whilst many of the low-level scammers stayed in crypto promoting the next coin the smarter players moved into AI. It's why you see the cult-like, fervent, influencer centric attitude towards e-acc, AGI, LLMs etc.
- clwg 2y agoI feel bad for teenage engineering. I'm a fan of their gear and its design, including the R1's physical design. It's a shame that it didn't have utility and turned into such a hot mess. Maybe they can add some MIDI ports and make some sort of funky pocket instrument.
- bahorn 2y agoBit confused on how this group got access to the rabbit codebase, as this sounds closer to backend code and not jadx'ing the APK. Are there any details on that?
- jsemrau 2y agoHere is Coffeezilla's take on the product https://www.youtube.com/watch?v=zLvFc_24vSM https://www.youtube.com/watch?v=zLvFc_24vSM
- khalilravanna 2y agoNever heard of this. So I went to the website to find out what it is. "Your pocket companion" the top of the website reads. Ok, don't know what that means. Scroll down "push to talk button", "conversational interface", and some other hardware features. Still no idea what it's for. They have a keynote video. I press play. It starts with them showing a bunch of press coverage and social media. Still no description of what it is. Not even a demo of what it does. I got several minutes into the video and it's all acting like I already know what it is. I've completely lost interest. Mystifyingly bad marketing.
- robertlagrant 2y agoCoffeezilla's covered[0] some of their... aspects. [0] https://www.youtube.com/watch?v=zLvFc_24vSM https://www.youtube.com/watch?v=zLvFc_24vSM (video)
- Twirrim 2y agoIt's an awful piece of trash. A phone-ish sized device that's sole purpose is to act as an interface to AI. https://www.youtube.com/watch?v=ddTV12hErTc https://www.youtube.com/watch?v=ddTV12hErTc is a review by Marques Brownlee, covering how bad it is. https://www.youtube.com/watch?v=zLvFc_24vSM https://www.youtube.com/watch?v=zLvFc_24vSM Coffezilla goes in to the ways that it's arguably a scam, as well as diving in to some of how it is badly implemented. On the technical side, it gets worse. For example, it turns out things like their Spotify "integration" is actually interacting with the Spotify web site. It doesn't even use Spotify's APIs. So it breaks any time Spotify modifies their website.
- thih9 2y agoYes; at the same time, it’s a scam only because people didn’t like it. If it got popular, it would have been a successful hustle and a new business model.
- mattashii 2y agoAdvertising a product with features that it doesn't have remains a scam in my book, no matter the popularity. See also: Theranos
- lagrange77 2y agoThis article [0] says they should have used secrets management, since they are using Kubernetes anyway, so this seems to be about their server, not the embedded or Android code. Doesn't accessing the hard coded api keys imply to intrude the server in the first place? [0] https://www.404media.co/researchers-prove-rabbit-ai-breach-by-sending-email-to-us-as-admin/ https://www.404media.co/researchers-prove-rabbit-ai-breach-b...
- mattkenefick 2y agoI really can't believe anyone bought one of these devices. It looked terrible right out of the gate.