31 ms·

I don't have any interest in this product or sympathy for its manufacturer, but: >On July 12th, I asked Rabbit Inc. if they had any comments to make on the con

I don't have any interest in this product or sympathy for its manufacturer, but: >On July 12th, I asked Rabbit Inc. if they had any comments to make on the content of this article [...] As of the end of July 15th, they have not responded. That *was* between zero and two working days, depending on how early on Friday the author asked them for comments and how late on Monday they waited for a response. It might've been better to wait a few more days. I doubt they would've responded even then, but it would've made the case of their incompetence stronger, and given them less ammo for a rebuttal should they choose to make one.

lagniappe 2y ago
Nobody's defending Rabbit here, but that's chickenshit journalism, and it happens too often.
- mynameisvlad 2y ago
  Since when is an individual's personal blog "journalism", and therefore expected to live up to that standard?
  - Retr0id 2y ago
    I take it as a compliment!
  - gruez 2y ago
    It might not be "journalism", but I think it's pretty reasonable to wait a week for responses before dropping serious accusations It's not exactly a onerous requirement to meet.
    - mynameisvlad 2y ago
      Reasonable? Sure. Expected and therefore commented that it's chickenshit when it doesn't happen? Yeah, no. If this were a reputable news outlet, that expectation would be reasonable.
    - JoshTriplett 2y ago
      I think it's entirely reasonable to report what you find when you find it, and update later with responses received.
    - KibbeWater 2y ago
      Most of what's mentioned in the article is not any new allegations. Rabbit has been berated for their GPL violations for over a month now and the excessive logging was rectified before he even sent in a request for comment. Requesting comments were only a formality to address already voiced concerns
    - callalex 2y ago
      It’s also pretty reasonable to respect the GPL when you financially benefit from it, yet here we are.
      - copywrong2 2y ago
        No no no, Rabbits mistakes are honest small mistakes from a great company! But this author, man of pure evil, hasn't waited long enough for my favourite bunny company to cover up their lies :(
  - Suppafly 2y ago
    >Since when is an individual's personal blog "journalism", and therefore expected to live up to that standard? If the author is going to pretend to be a journalist of a security researcher, I see no problem holding their work to the ethical standards expected from those sorts of people.
- Ylpertnodi 2y ago
  >I could write a whole other article about how hostile and dismissive they've been to researchers Please do.
Retr0id 2y ago
It was 1.5 working days, and there are other factors not mentioned in this article which meant they were lucky to get that (I could write a whole other article about how hostile and dismissive they've been to researchers). If they had requested an extension, I may have considered, but they didn't respond at all. To elaborate, there are no new security disclosures made in this article. The logging issue has already received mainstream media coverage, after they resolved it and published an advisory, and people have been playing with flashing custom roms via mtkclient for months (as referenced in the article). The only new "accusation" is that they are violating GPL. I informally asked them for GPL sources months ago via their community discord server, and I'm aware of others who have asked more formally. Asking for their input on the article was a) giving them a courteous heads-up b) a formality c) an opportunity for them to correct me if they thought I said something untrue.
- Arnavion 2y ago
  Sure, up to you. In any case I take it they still haven't responded?
  - Retr0id 2y ago
    Still no response.
- Aurornis 2y ago
  > It was 1.5 working days, and there are other factors not mentioned in this article which meant they were lucky to get that In your article you also wrote that you didn’t bother reporting it at all when you first discovered it. Why did you wait until the article was ready to be published to inform them? Standard practice is to inform the vendor early and work with them as you write the article. Keeping the issue quiet and then demanding a rushed response when the article as done isn’t helpful to people who actually want the issue fixed before it goes public. > If they had requested an extension, I may have considered, but they didn't respond at all. Why would they request an extension when they fixed the issue a day before you tried to contact them? They should have written back and pointed you to the already-released security update, but I can also understand why they aren’t thrilled to engage with someone who is trying to make a mountain out of an issue they had already fixed.
Aurornis 2y ago
It appears Rabbit had already released an update to address the issue on July 11th, the day before the author asked them for comment. They posted it here https://www.rabbit.tech/security-advisory-071124 https://www.rabbit.tech/security-advisory-071124 > As of 11 July, we’ve made the following changes: > Pairing data can no longer be used to read from rabbithole. It can only trigger actions. > Pairing data is no longer logged to the device. > We have reduced the amount of log data that gets stored on the device. > The Factory Reset option is now available via the settings menu. Customers should use this option to erase ALL data from their r1 prior to transferring ownership.
- Lockal 2y ago
  How did you find this page? I tried to navigate all visible links from the main page and don't see any security advisory pages.
  - Retr0id 2y ago
    I believe it was buried in their "community forums", which only recently became publicly viewable.
    - Ylpertnodi 2y ago
      "Only recently" will have a date.
      - Retr0id 2y ago
        Would you like to share that date with us?
clwg 2y ago
Yeah, that’s an incredibly short timeframe, done on a Friday with what looks like an 8-hour time difference. Back before bug bounties, the industry mostly coalesced around RFPolicy[0] in terms of security notification and response timelines. Upon establishing initial contact, five business days were given for a response before public disclosure if no response was received. To me five business days seems appropriate if you’re acting in good faith and truly interested in hearing a response. It doesn’t feel like that was the intent; it feels more like a weak attempt to use the lack of response to pile on further. https://packetstormsecurity.com/files/23364/rfpolicy-2.0.txt.html https://packetstormsecurity.com/files/23364/rfpolicy-2.0.txt...
- Retr0id 2y ago
  Timezone differences were accounted for (see my other reply), and this wasn't the first time they were hearing any of it. It was just the first time I put it into an article.
- fullspectrumdev 2y ago
  RFPolicy was well intentioned but in no way was ever a standard the community at large adhered to in my experience.
unleaded 2y ago
They should have used an LLM to write responses when nobody's at the office
deleted 2y ago
[deleted]

lagniappe 2y ago

Nobody's defending Rabbit here, but that's chickenshit journalism, and it happens too often.

mynameisvlad 2y ago
Since when is an individual's personal blog "journalism", and therefore expected to live up to that standard?
- Retr0id 2y ago
  I take it as a compliment!
- gruez 2y ago
  It might not be "journalism", but I think it's pretty reasonable to wait a week for responses before dropping serious accusations It's not exactly a onerous requirement to meet.
  - mynameisvlad 2y ago
    Reasonable? Sure. Expected and therefore commented that it's chickenshit when it doesn't happen? Yeah, no. If this were a reputable news outlet, that expectation would be reasonable.
  - JoshTriplett 2y ago
    I think it's entirely reasonable to report what you find when you find it, and update later with responses received.
  - KibbeWater 2y ago
    Most of what's mentioned in the article is not any new allegations. Rabbit has been berated for their GPL violations for over a month now and the excessive logging was rectified before he even sent in a request for comment. Requesting comments were only a formality to address already voiced concerns
  - callalex 2y ago
    It’s also pretty reasonable to respect the GPL when you financially benefit from it, yet here we are.
    - copywrong2 2y ago
      No no no, Rabbits mistakes are honest small mistakes from a great company! But this author, man of pure evil, hasn't waited long enough for my favourite bunny company to cover up their lies :(
- Suppafly 2y ago
  >Since when is an individual's personal blog "journalism", and therefore expected to live up to that standard? If the author is going to pretend to be a journalist of a security researcher, I see no problem holding their work to the ethical standards expected from those sorts of people.
Ylpertnodi 2y ago
>I could write a whole other article about how hostile and dismissive they've been to researchers Please do.

Retr0id 2y ago

It was 1.5 working days, and there are other factors not mentioned in this article which meant they were lucky to get that (I could write a whole other article about how hostile and dismissive they've been to researchers). If they had requested an extension, I may have considered, but they didn't respond at all. To elaborate, there are no new security disclosures made in this article. The logging issue has already received mainstream media coverage, after they resolved it and published an advisory, and people have been playing with flashing custom roms via mtkclient for months (as referenced in the article). The only new "accusation" is that they are violating GPL. I informally asked them for GPL sources months ago via their community discord server, and I'm aware of others who have asked more formally. Asking for their input on the article was a) giving them a courteous heads-up b) a formality c) an opportunity for them to correct me if they thought I said something untrue.

Arnavion 2y ago
Sure, up to you. In any case I take it they still haven't responded?
- Retr0id 2y ago
  Still no response.
Aurornis 2y ago
> It was 1.5 working days, and there are other factors not mentioned in this article which meant they were lucky to get that In your article you also wrote that you didn’t bother reporting it at all when you first discovered it. Why did you wait until the article was ready to be published to inform them? Standard practice is to inform the vendor early and work with them as you write the article. Keeping the issue quiet and then demanding a rushed response when the article as done isn’t helpful to people who actually want the issue fixed before it goes public. > If they had requested an extension, I may have considered, but they didn't respond at all. Why would they request an extension when they fixed the issue a day before you tried to contact them? They should have written back and pointed you to the already-released security update, but I can also understand why they aren’t thrilled to engage with someone who is trying to make a mountain out of an issue they had already fixed.

Aurornis 2y ago

It appears Rabbit had already released an update to address the issue on July 11th, the day before the author asked them for comment. They posted it here https://www.rabbit.tech/security-advisory-071124 https://www.rabbit.tech/security-advisory-071124 > As of 11 July, we’ve made the following changes: > Pairing data can no longer be used to read from rabbithole. It can only trigger actions. > Pairing data is no longer logged to the device. > We have reduced the amount of log data that gets stored on the device. > The Factory Reset option is now available via the settings menu. Customers should use this option to erase ALL data from their r1 prior to transferring ownership.

Lockal 2y ago
How did you find this page? I tried to navigate all visible links from the main page and don't see any security advisory pages.
- Retr0id 2y ago
  I believe it was buried in their "community forums", which only recently became publicly viewable.
  - Ylpertnodi 2y ago
    "Only recently" will have a date.
    - Retr0id 2y ago
      Would you like to share that date with us?

clwg 2y ago

Yeah, that’s an incredibly short timeframe, done on a Friday with what looks like an 8-hour time difference. Back before bug bounties, the industry mostly coalesced around RFPolicy[0] in terms of security notification and response timelines. Upon establishing initial contact, five business days were given for a response before public disclosure if no response was received. To me five business days seems appropriate if you’re acting in good faith and truly interested in hearing a response. It doesn’t feel like that was the intent; it feels more like a weak attempt to use the lack of response to pile on further. https://packetstormsecurity.com/files/23364/rfpolicy-2.0.txt.html https://packetstormsecurity.com/files/23364/rfpolicy-2.0.txt...

Retr0id 2y ago
Timezone differences were accounted for (see my other reply), and this wasn't the first time they were hearing any of it. It was just the first time I put it into an article.
fullspectrumdev 2y ago
RFPolicy was well intentioned but in no way was ever a standard the community at large adhered to in my experience.

unleaded 2y ago

They should have used an LLM to write responses when nobody's at the office

deleted 2y ago

[deleted]