19 ms·

I found a backdoor into my bed

980 points by riverdroid 2y ago

gorfian_robot 2y ago
honey, that is only for special occasions
OptionOfT 2y ago
I got one of those indoor gardening systems. We thought we had an issue with them. Contacted support. Support checked and it was fine. Just needed time to adjust. They mentioned they checked the cameras (!). Later on I got a second used one and while cleaning it, noticed that the internals are just a raspberry pi. Took my micro HDMI and keyboard, and... this thing just runs Raspberry Pi OS. No updates. And ... VNC. People from that company can just remote into my device, look at what the cameras are seeing, and do stuff on my network. These things are a security nightmare.
- mihaaly 2y ago
  I'd love to have a robot vacuum but all I checked last time had wifi connectivity and advanced sensors to build accurate map of our home uploaded to an app of my phone with who knows what capabilities. Some even had camera. All they missed some mic to listen in on us, however since some are connected to Alexa that is a wish fulfilled for many. - Alexa, wipe up that spill in the bedroom. - Sorry, that requires deep clean, but you had some credit left on your second credit card so I ordeered a deep clening service for Tuesday when you are away.
  - imglorp 2y ago
    Some of these vacuums will work without the Wi-Fi. You will have to do without automatic features, for example you have to push the button every time to get it to start, but if you just want it to do the whole area it will run and return to base. It's enough for my area
  - mrgoldenbrown 2y ago
    Your robot vacuum is basically a mobile camera all your neighbors can access https://www.abc.net.au/news/2024-10-11/robot-vacuum-yells-racial-slurs-at-family-after-being-hacked/104445408 https://www.abc.net.au/news/2024-10-11/robot-vacuum-yells-ra...
  - Epa095 2y ago
    FYI there is https://github.com/Hypfer/Valetudo https://github.com/Hypfer/Valetudo which acts as a replacement of the cloud service. I'd you buy one of the supported devices you root it to point to the Valetudo server (which you run yourselves). You can then put the robot on its own WiFi without Internet access if you want to be even more secure.
    - mihaaly 2y ago
      Thanks for the tip. But I am just a user and this is just a vacuum. I rather focus on other than jumping hoops for the products of the indecent manufactureres. While saving a lot of money as bonus. I think I will cope without it.
    - genewitch 2y ago
      no need to root it if you have a decent "router" stack. fortigates can re-route even hard-coded IPs to internal services ;-) i am sure others can too, i just know we had to use the fortigate to fix a hard-coded IP that was breaking something. i think it was a fog device, even.
      - Epa095 2y ago
        Do you know if this works with any vacuums? I would assume they used https and would notice that man-in-the-middle attack.
        genewitch 2y ago
        I am not an expert network engineer so i asked the one that manages the fortigate: > it'll work for whatever ports or application you want since it's a layer 7 firewall
  - rolph 2y ago
    how many of these end up being used for dirty purposes rather than cleaning purposes. not just accidental bathroom pix, but blatant porn.
- Eduard 2y ago
  which brand and model?
  - OptionOfT 2y ago
    I have a Gardyn 3.0 and 4.0. They run Raspberry Pi OS with some custom code. They have live access to the cameras.
    - HWR_14 2y ago
      Were you able to disable their remote access software once you were poking around the raspberry pi?
      - OptionOfT 2y ago
        I could've uninstalled the package, but I moved it all to a separate VLAN until the warranty is over. I'm debating writing a custom firmware, the GPIO pins are documented somewhere. * Run pump. * Turn lights on / off / %. * Measure water in tank. * And then they have a moisture / temperature which they use for their 'AI' / heuristics on whether to water more or less. You don't need that. You just water more often. The point of hydroponics is that the roots sit in water. * Occasional photo (via USB). I'm trying to find a Raspberry Pi Zero 2 W with the GPIO pins soldered on the 'other side', as that is how the Gardyn is setup.
- neop1x 2y ago
  That's why I have a separate VLAN and wifi AP for devices I don't trust. And where possible, I use them over LAN only and block their access to the internet on the firewall. That's also why I like zigbee devices and why I am not very happy about Matter and "IP everywhere".
  - cirelli94 2y ago
    I'd like to do this but I need some more hardware. I'm thinking to buy a Mikrotik hAP Ax3 Router WiFi 6 or a more expensive Turris Omnia or MOX... The standard home routers doesn't have those features!
    - neop1x 2y ago
      For IOT AP I use an old olinuxino with MT7612U 2.4G wifi dongle running Arch Linux ARM as most of my wifi iot devices run on 2.4Ghz wifi anyway. Then I have a normal wifi in a ASUS PRIME N100I-D D4 x86 low power mobo which I also use as a media box. It has a Mediatek mt7916 wifi 6e-capable (but running wifi 6 currently anyway) M.2 card by AsiaRF in a short cable extender. I took a long time to find a well-supported wifi card. Then I have a third box which is also a router and has normal 5GHz AP. It also hosts a radius daemon used by all APs which assigns MAC addresses to VLANs, optionally forces them to their unique passphrases. All boxes are connected by LAN cables. It works perfectly with no issues but it took gradual smaller improvements over many days until I ended up with this setup. It would also be possible to cram everything into a single box if the area to be covered isn't very large.
- malfist 2y ago
  Which indoor garden? Was thinking about some but want to make sure to avoid this company
  - archon810 2y ago
    https://news.ycombinator.com/item?id=43139381 https://news.ycombinator.com/item?id=43139381 Gardyn
robertclaus 2y ago
Cat food dispensers are an interesting product where this trend hasn't quite landed - it's still easy to get a new model without WiFi for roughly the same price. I wonder if the possibility of your pet not getting fed is a line consumers won't cross for convenience features.
cytocync 2y ago
[dead]
sailfast 2y ago
Total aside: it’s illegal for any company to provide goods or services for free to the government, so the Pod CEO would be breaking the law sending DOGE employees bed pods. It’s basically seen as a bribe - which is true! These beds are $2000 each but it’s pretty cheap for favorable regulatory treatment after a small donation. :/
- archon810 2y ago
  He'll say that DOGE is not part of the government but a private endeavor by Elon Musk. Also: citation needed. A quick Google says it's not illegal as long as the government entity confirms it in writing.
  - daveguy 2y ago
    Doge couldn't even secure their "transparency tweets" website when it went up. I get the impression they don't have the organization to confirm anything in writing.
unosama 2y ago
If you suffer from insomnia, there are so many other things you can do. Check your Vitamin D and B levels. Meditate. Don't get a bed that emits more EMF. That definitely won't help you. before anyone tries to mock me for mentioning EMF: https://pmc.ncbi.nlm.nih.gov/articles/PMC5247706/ https://pmc.ncbi.nlm.nih.gov/articles/PMC5247706/
tills13 2y ago
> Beyond the basics, what does access to a device on your home network grant them? Any other device connected to that home network - smart fridges, smart stoves, smart washing machines, laptops - is typically routable via your bed. The (in)security of those devices is now entrusted to random Eight Sleep engineers. And this is why I have any device that needs connectivity to the Internet to function in its own vlan with very specific and oppressive rules about what can talk with what. If you don't have a fancy router, use your guest network for these things. I hate this future.
aranelsurion 2y ago
> Imagine your ex works for Eight Sleep. Or imagine they want to know when you’re not home. I think what is often missed in "company gathers data it doesn't need" scenarios is not that someone inside Eight Sleep abuses the data, or the company itself does it, but them gathering this data for years and then losing it to some 14yo hacker who promptly posts it and suddenly all your data is public. The inside job may sound a little far fetched, but the latter is only a matter of time. Once it happens multiple times with different services, everyone gets access to everything about you.
motbus3 2y ago
I honestly cannot understand why pay 19 USD/month for something you paid 2000. It is not like they are providing you stellar quality software nor that it needs to be done remotely
nadis 2y ago
"When I say backdoor, what am I referring to? Sure, Eight Sleep needs a way to push updates, provide service, and offer support. That’s expected. What goes too far in my opinion, is allowing all of Eight Sleep’s engineers to remotely SSH into every customer’s bed and run arbitrary code that bypasses all forms of formal code review process. And yes, I found evidence that this is exactly what’s happening." ^ wow, this is pretty wild. <insert joke about being careful about who you share a bed with>
- HNdev1995 2y ago
  I agree with you but please explain how this is any different than when an app on your phone gets updated
  - physicles 2y ago
    It’s completely different. Could a rogue engineer inject whatever code they want into an app update? Possibly yes, but 1) that code will get shipped to every phone at the same time, 2) that code has to do its thing without anyone noticing, which is tricky at scale (this is how malware gets discovered), and 3) there’s an audit trail so that engineer will be exposed to legal risk. The difference here is that with Eight Sleep, an engineer can remotely access the customer device in real time and poke around the network the bed is connected to, and there may be no audit logs. They can exfiltrate sensitive data with much less effort and less legal risk than with an app update.
- SeanAnderson 2y ago
  Sounds like a good way to get bed bugs. .. I'll see myself out.
- Linkd 2y ago
  even more so combined with the fact that these are supposedly being sent into the government.
- fra 2y ago
  You’d be surprised at how many hardware companies think this is a good idea! I’m the founder and CEO of a company called Memfault, we make observability SaaS for hardware companies. I constantly get asked if we could just offer a remote access solution. Many of our competitors do! But we think it’s (a) a huge security liability and (b) too ripe for abuse. But fundamentally consumers do not care, and until that changes you can expect any embedded Linux device to have this kind of backdoor (they do more often than not).
EvanAnderson 2y ago
The state of the product's security wasn't unexpected. I was, however, shocked by this part: > I was willing to overlook: > The bed costs $2,000 > It won’t function if the internet goes down > Basic features are behind an additional $19/mo subscription > The bed’s only controls are via mobile app Nothing about this bed should depend on off-site servers. Nothing about the product should necessitate a subscription fee. The market is clearly too stupid to vote against the rent seeking tech industry. It makes me so sad.
- chrisandchris 2y ago
  > Basic features are behind an additional $19/mo subscription One can just question how we want to live our lives in the future. Behind each and every step a subscription? And all of them seem to be priced 10-20/month, no matter how much value they provide.
- readthenotes1 2y ago
  Conspicuous consumption drives a lot of irrational behavior
- jjice 2y ago
  I've heard the sleep people get with this is excellent, but no way in hell am I paying a subscription and requiring an internet connection for my bed. The entire concept is just absurd. If it sells, it sells, I guess.
  - megadata 2y ago
    I've also heard people are having excellent sleep in their traditional modern beds. Me included.
    - amarcheschi 2y ago
      I've also heard about people finding new foam mattresses too hot :( like me. will buy a spring mattress next time Edit thank you for your recommendation but I'm in italy, European and American mattresses are quite different. Before discovering this, I once wrote to the customer support of the flamingo hotel, Las Vegas, because I loved their mattress: Hi, i do think that what i'm gonna write is weird, but anyway haha. On july of the summer 2019 i visited the fabulous las vegas. nor the nightlife neither the opulence of sin city could, however, reach the pinnacle of the human civilization, the mattress on which i slept at flamingo. I now have to change my own mattress at home, and i'm looking for the model on which i slept. the website only says "Simmons beautyrest", although Beautyrest is just a brand name used by simmons and doesn't mean a specific model. could you help me in this modern day divine comedy, be my Virgil and help me find the mattress name? Regards Name I got an answer: Thank you for contacting Caesars Entertainment. I was delighted to hear that you enjoyed our mattress on your visit! Currently, we are using the Simmons Hospitality Beautyrest Felicity Pillow Top. They can be purchased at https://caesarsguestpurchase.com/shop https://caesarsguestpurchase.com/shop or 1-866-926-8233. Please feel free to write back if you have any further questions. Thank you for choosing Caesars for your gaming entertainment! Have an amazing day! Shirley
deleted 2y ago
[deleted]
dsalzman 2y ago
Using the aquarium chillers is really smart! Just need someone to mfg the mattress membrane covers.
- deleted 2y ago
  [deleted]
- hangonhn 2y ago
  I didn't realize they've come down so much in price. Another really useful application would be to hook it up to pads used to ice joints post joint surgery. I was sold a $100+ dollar medical device which was basically a water pump in a cooler chest (like one of those Polar ones) that circulated water through some pads. I had to refill it every hour or so with ice. This is right after a knee surgery so caring the cooler around was literally painful. Having it connected to the aquarium chiller would have been great.
  - LoganDark 2y ago
    you know those "VR backpacks"? imagine... knee chiller backpack
- beala 2y ago
  I'd love to be wrong about this, but I'm very skeptical that the aquarium chiller pictured in the post can move enough heat to cool a human. As mentioned in the article, it uses thermoelectric coolers which are extremely inefficient. I see at least one aquarium chiller on amazon that uses a compressor, but then you have to wonder if it's quiet enough to sleep next to.
  - zemvpferreira 2y ago
    Same, though I've seen thermoelectric chillers of that size moving ~200 Watt and a human produces less than 100 Watt at rest. The ones I saw on Amazon for $150 claimed to move around 70 Watt which is ballpark useful. You wouldn't want to cool down to a very low temperature anyway, just remove the heat you produce yourself.
ipython 2y ago
[flagged]
AtlasBarfed 2y ago
Um, is that Bezos or the AWS account of the company? Alas, our hope to recover whatever social benefit was in SpaceX and Tesla is with Bezos's companies, although at least the EV space is more diverse. SpaceX cannot be wrested from Musk and TSLA and its board is preferred-stock controlled by Musk.
- lotsofpulp 2y ago
  > TSLA and its board is preferred-stock controlled by Musk. Any source for this? I can’t find anything that says the Musk has enough voting power in Tesla to not need others’ votes: https://www.techopedia.com/largest-tesla-shareholders https://www.techopedia.com/largest-tesla-shareholders This is a pretty in depth analysis that shows that Musk needed retail votes for last year’s compensation and re-domiciling votes: https://clsbluesky.law.columbia.edu/2024/07/01/how-tesla-pumped-the-vote/ https://clsbluesky.law.columbia.edu/2024/07/01/how-tesla-pum...
  - rtkwe 2y ago
    Tesla actually has a 1 share 1 vote right now but it also has super majority voting rules which means Musk's ~22% stake is nearly a veto unless the entire rest of the stockholders vote for a measure he's against. https://www.thestreet.com/investing/stocks/how-elon-musk-controls-tesla-with-only-a-minority-stake-14564491 https://www.thestreet.com/investing/stocks/how-elon-musk-con...
    - lotsofpulp 2y ago
      That is an Apr 2018 article. Elon has a substantially smaller share now. From first link in above post: > Elon Musk is the largest individual Tesla shareholder, with 410.79 million shares, representing 12.8% of Tesla ownership as of December 2024. https://www.secform4.com/insider-trading/1494730.htm https://www.secform4.com/insider-trading/1494730.htm
kaonwarb 2y ago
Interesting article; clickbait title. There's very little about Amazon in here, never mind its chairman.
- martinsnow 2y ago
  It drives clicks! I don't understand why someone would buy a bed chiller. But perhaps the US is a unique market.
  - skizm 2y ago
    I’m in the market for one. I want a cool sleep in the summer with fresh air (not recycled AC air). I haven’t found one with good reviews and also no required spyware unfortunately. So AC plus humidifier is needed, but I still sweat on the parts of my body in contact with the mattress no matter how much I crank the AC in the middle of Aug.
    - martinsnow 2y ago
      What's the difference between recycled air thats been cooled and then blown into your bed and the air from your air conditioner?
      - BobaFloutist 2y ago
        I can't speak to the person you're replying to, but it's like the difference between an electric blanket and a space heater. It's energetically cheaper to cool just the bed than the whole room, and it won't dry out the air as much.
      - skizm 2y ago
        The air from my air conditioner sits on top of me like a blanket, not touching the parts of me in contact with the mattress. If the mattress itself is actually cool, it will stop me from sweating. The recycled air thing is just personal preference, breathing fresh air feels subjectively better than recycled air so I keep my window open as much as possible. If the weather is hot, but my mattress is cold, then I can keep the window open and still be cool on hot days.
j2kun 2y ago
> While the Eight Sleep CEO Matteo seems focused on providing DOGE with great sleep More sycophants coming out of the woodwork.
- LordShredda 2y ago
  It's him and that mattress guy, and the whole stereotype of mattress stores being money laundering fronts. What's up with the bed industry in general?
  - bloopernova 2y ago
    Could you please let me know who the "mattress guy" is?
    - duskwuff 2y ago
      Possibly thinking of Mike Lindell? He sold pillows, not mattresses, but I'll count that as close enough. https://en.wikipedia.org/wiki/Mike_Lindell https://en.wikipedia.org/wiki/Mike_Lindell
- ta1243 2y ago
  "We may not have that many outright Nazis in America, but we have plenty of cowards and bootlickers, and once those fleshy dominoes start tumbling into the Trump camp, the game is up" That's the health secretary's words.
dangoodmanUT 2y ago
Title is bad, but the piece is good
- dang 2y ago
  Ok, we've replaced the article title with a more representative sentence from the article.
sxp 2y ago
I have an EightSleep from before their enshittification into a subscription model. It is a good piece of hardware, but I can no longer recommend it because the software is so crappy. I checked the logs on my router and found that it was streaming tons of data to servers even when I wasn't using it. I have no idea why it would stream that much data since the trivial sensors it has shouldn't be producing that much data even if it had multi Hz sampling. I can't tell if this is incompetence or some sort of malfeasance where they are secretly recording audio data via motion sensors and streaming that.
- wedn3sday 2y ago
  Maybe this guy isnt the first person to discover the backdoor and your mattress has been mining crypto. This whole thing is straight out of a Cory Doctorow novel.
- micromacrofoot 2y ago
  > I have no idea why it would stream that much data I think the blog post uncovered that here... the CEO is a total creep
- throwway120385 2y ago
  Because they want to know what you're doing in bed and when.
j2kun 2y ago
> but the eight sleep sure does harvest people’s bed data, and occasionally tweet about how they’re watching you sleep [Followed by a screenshot of the EightSleep CEO publicly tweeting about SF sleep data in Nov 2023.] This is reason enough to not patronize this business. What a creep.
- hackernewds 2y ago
  The company itself is also run by a race car driver and has typical Miami hype. Not sure why they are often tagged as tech companies, besides making a black version of Casper. Could be the heavy Elon association.
- xyst 2y ago
  This brand was heavily advertised on social media (TT, YT ads) as well. I remember because I signed up for e-mail updates. Glad I never signed up though. IIRC, I was turned off by the same issues the author “overlooked”. A subscription for a bed? Fuck off
- kristofferR 2y ago
  They don't have any competitors, for people who need their product it's the only real option. The only competitors have a much worse core product unfortunately, so we have to put up with EightSleep's shit.
WalterBright 2y ago
I've bought several internet radio streaming devices over the years, and they all eventually brick when the server goes out of business.
- neogodless 2y ago
  I was so pleasantly surprised when my Microsoft / Harman Kardon "smart" speaker (Invoke) issued a firmware update upgrading it to act as a simple Bluetooth speaker. It's wildly more useful now! A rare exception to the usual.
  - modeless 2y ago
    Google has done this with the Stadia controller, and also recently open sourced the firmware for the Pebble smartwatch. They may discontinue a lot of stuff but their track record for discontinued hardware is pretty decent IMO.
- NotYourLawyer 2y ago
  ROI!
- optymizer 2y ago
  Offtopic: I grew up in a tiny post-soviet third world country. Aside from the usual daily struggles, one lesser known aspect of that life is that we did not have access to primary sources of information or the people who invented the things we were using. We only had a book in my native language on Pascal. I had heard of C from a magazine that had a CD with a C compiler on it, and I walked into a library wanting to learn C but all they had was a dusty book on COBOL in Russian. Later I bought a book on x86 assembly, also in Russian, because that's all I could find, and it just felt like I'm living inside a leaky bucket whereas I was hungry for the firehose of knowledge. When we got dial-up Internet, I did not sleep for days. The floodgates were open. I had access to tons of information online, in original English, from primary sources. People I've only had heard about, like Torvalds, would just share information directly on the Internet, like it's another Tuesday. To me it felt like I went to Disneyland and I was meeting all my heroes. You can just... learn about any topic and see the people who invented those topics. You could even send them messages. 25 years later, I still feel like that kid sometimes. I'm thankful for HN. Alan Kay replied to me once, and it made my year! Alan M-Fing Kay. I met rms once in the flesh and could not believe my eyes. I regularly see messages from Walter Bright on HN like he's a real human being and I have to remind myself that yes, he's alive, real and I exist in the same world as him and can actually interact. I and kids around the world these days are lucky to not be stuck in a world where you cannot learn more than they let you.
blackeyeblitzar 2y ago
Clickbait title.
- dang 2y ago
  Ok, we've replaced the article title with a more representative sentence from the article.
nrki 2y ago
Love the part about the CEO being a Musk sycophant. Right down to the similar language in tweets: "Some of SF got poor sleep. We must fix this."
- duxup 2y ago
  I remember when mimicking Steve Jobs dress and etc was a thing and how it was kinda cringey. Man I could go for some of that these days.
  - steve_adams_86 2y ago
    We were spoiled back then. Creeps and weirdos were relatively endearing.
  - EdwardDiego 2y ago
    Yeah, in hindsight, the black turtlenecks everywhere were the good ol days.
    - deleted 2y ago
      [deleted]
- deepsquirrelnet 2y ago
  > While the Eight Sleep CEO Matteo seems focused on providing DOGE with great sleep, the real doge (pictured above), whose name is Latte, is sleeping great tonight. It’s better than that. He’s putting in backdoors where they sleep. I’m sure there’s a market for that data.
amarcheschi 2y ago
here a related discussion about a guy who did a similar thing with an aquarium cooler to cool his bed https://news.ycombinator.com/item?id=41824138 https://news.ycombinator.com/item?id=41824138
modeless 2y ago
> the Eight Sleep cover, which is available on eBay for a few hundred Uh, I don't think I want to buy a used mattress cover on eBay, thanks.
pimlottc 2y ago
While we're all here, what are some good alternatives to Eight Sleep? The idea seems to have merit but the required IoT subscription is a dealbraker.
- 0x2a 2y ago
  I use one of their competitors (Sleepme Ooler) but they're not great either. Did not know about aquarium chillers, that seems like a better option. Could probably pair it with Home Assistant too if you wanted to more easily set the temperature.
WalterBright 2y ago
I always knew that internet-connected thermostat was a bad idea.
whatshisface 2y ago
You would have to be insane to buy a computer that remains someone else's computer...
- doublerabbit 2y ago
  [flagged]
  - paldepind2 2y ago
    I think the key feature is _cooling_ the bed, with warming secondary to that. That arguably sounds like a great nicety to have, notwithstanding all the downsides mentions in the post.
    - doublerabbit 2y ago
      So now your getting hacked and breathing in toxins while you sleep. Hacked up the arse and in the mouth too. Nice. Yeah, no thanks. I try to make my bedroom as technology free as possible. Apart from a digital alarm clock; at night I put my phone on aeroplane mode and place it outside my closed bedroom door. It's the best I can do with today's bullshit tech. I've never had a problem with not having a cold bed, so maybe it's the next best thing after the bidet.
      - perching_aix 2y ago
        Toxins? What?
        doublerabbit 2y ago
        Why else is there plastic in your brain? How do you think you make "cold"? when cold leaks, it can be toxic.
        perching_aix 2y ago
        Cold cannot be "made", as it's an absence of something (energy), nor can it "leak" as a result. I take what you mean is that there will be a refrigeration loop involved, and in that, a refrigerant. Just like all substances, refrigerants can be toxic, sure, but that alone is not what makes a toxin [0]. It's also not a binary thing, and between air conditioning and refrigerators, an appliance like this I don't see why would stand out. I further haven't got a clue what microplastics having been found to pass the blood brain barrier have to do with this, or how you're able to determine whether that applies to me or not, specifically. [0] https://en.m.wikipedia.org/wiki/Toxin https://en.m.wikipedia.org/wiki/Toxin
wedn3sday 2y ago
A $20/month bed subscription is objectively hilarious. I cant imagine how this company attracts a non-zero number of clients.
- lijok 2y ago
  *subjectively. Once you realize just how important quality sleep is, and how much this can help, $20/month bed subscription becomes a laughably small price to pay.
  - JTyQZSnP3cQGa8B 2y ago
    Do you have the same reasoning with cigarettes? $10 every day is a small price to pay to avoid having to stop smoking.
    - lijok 2y ago
      I don't follow, sorry
    - trzeci 2y ago
      Cigarettes is a consumable resources, as for any resources like that it has fifferen justification as you cant produce it. The subscription for bed is not, it locks artificially features to pay monthly. Even more, it collecs data to improve the product (which sounds good) - but you need to pay for this. They have an ability to run model locally - they choose to not. I like Topaz approach: you have an ability over some time (subscription period) to have up to date model that will help you recognise snoring etc, then if you choose not to pay - you stick with this model, but it still works. Subscription in addition is something that limits an ability to sell it in the future.
  - low_tech_love 2y ago
    How much can this help?
    - lijok 2y ago
avalys 2y ago
This is a bunch of nonsense, assumption and leaping to conclusions without evidence. "In the second screenshot, we have the public key that’s authorized to access the device. The email address attached to the public key, eng@eightsleep.com, to me suggests the private key is likely accessible to the entire engineering team." He has no evidence for this whatsoever and not really any good reason to assume it either. "In the first image, we see evidence SSH is being exposed remotely, to a far away host, remote-connectivity-api.8slp.net. Typically SSH would only be accessible to the local area network, but the variables in production.json would seem to imply this access was opened up to a remote host." This isn't how SSH works and he doesn't seem to have enough information, or enough knowledge of SSH, to understand what's being done with the "far away" hostname. This article is just clickbait nonsense, which should have been obvious from the title. It is clearly intended to draw traffic to their company website, which is some kind of venture-backed security startup. Based on the fact that the founders seem to have a superficial understanding of technology but a well-developed understanding of hype and bullshit, I am not interested in exploring their business further.
- ta1243 2y ago
  Are you denying the existence of an authorised ssh key on each of these beds allowing the holder of the key? Are you denying there is a config file pointing to a target called remote-connectivity-api.8slp.net? No there's not enough evidence to prove in a court of law who has access to the private key, or that the config file is enabling a return ssh connection, but it's pretty damning. The only thing that's not newsworthy about this is that large amounts of IOT shit does this.
  - duskwuff 2y ago
    > Are you denying there is a config file pointing to a target called remote-connectivity-api.8slp.net? Under the path ".ssh.endpoint", too. It's not like it's just a mystery hostname; it clearly has something to do with SSH. > The only thing that's not newsworthy about this is that large amounts of IOT shit does this. And - just to be clear - that doesn't mean it shouldn't be reported on! Talking about this stuff, and having concrete, specific examples, is good.
bloopernova 2y ago
My wife uses a Bedjet which has both a remote and app. Thankfully it works without an active Internet connection. It uses a bag-like sheet that it blows air into, to adjust temperature. For women suffering* through menopause, being able to adjust around hot/cold flushes is sanity-preserving! * Some women don't suffer much during perimenopause or menopause, but it's a process that seriously fucks with one's hormones. A word of advice to any partner of a woman going through perimenopause: believe them when they tell you what they're going through! So many partners don't realize just how much this can mess up someone, they deserve every sympathy possible.
- hn_acc1 2y ago
  I may suggest this to my wife.. She's going through the hot flash stage..
- zemvpferreira 2y ago
  My friend Sara had a rare form of breast cancer at 34. Thankfully she survived, but to improve her odds of staying alive she's been essentially put into permanent menopause for the next decade. Constant hot flashes. Is the Bedjet really that good? Would your wife recommend it without reservations? Are there any other product that have made a difference for her? Apologies if that's intrusive but improving Sara's sleep would be life-changing for her.
  - bloopernova 2y ago
    Yes, my wife would recommend it without reservations. There's also a cold water circulator, useful for icing a painful limb etc. https://www.amazon.com/gp/aw/d/B09VRJ153X https://www.amazon.com/gp/aw/d/B09VRJ153X Not intrusive at all, I hope your friend can find some relief. I hope she can find strength and joy in life.
    - zemvpferreira 2y ago
      Thank you both very much for your kind words and advice, ordering one now. No doubt it will make a dramatic difference.
chinathrow 2y ago
That CEO tweet to Elon is peak cringe.
mitjam 2y ago
Can recommend hot water bottles and a hairdryer for occasional on demand bed warming.
electroly 2y ago
I'm a two-time Eight Sleep customer and the CEO could post my sleep history specifically with my full name and I'd still use it. It's really comfortable. I think most of the detractors were never remotely in the market for such a product. Everything negative said about the product and the company is true, and they should do better, but it's not enough to scare me away thanks to how good the base product is.
- yuvalr1 2y ago
  If there was a similar product that does not upload any of your extremely personal data, like whether you're now in your bed, to some server on the internet, would you prefer it?
  - electroly 2y ago
    Sure, there are lots of ways it can be improved. I'd like it to be cheaper too. I'd be happy to switch to an alternative that is just as good but without the Internet nonsense, but SleepMe isn't it. I've got my eyes open for viable competitors for the next time I need to outfit a mattress or when this one dies. For now, Eight Sleep is the best one I've found.
- mimischi 2y ago
  But is it more comfortable, then say, an old school analog expensive mattress? I can’t shake the feeling these companies are selling snake oil (that is not to say that old school analog mattresses aren’t overpriced either)
  - electroly 2y ago
    You may be misunderstanding the product--it's a topper that goes on top of your existing mattress. It doesn't replace the mattress. I do indeed have it on top of an old school analog expensive mattress. It cools/warms to the desired temperature without impacting the comfort from the mattress. I don't think there's much room for snake oil here: it pumps cooled or heated water through the mattress topper. There's no mystery.
yuvalr1 2y ago
Are there any consumer products offered that provide similar functions (heating, controlling with an app etc.), but which never try to connect to a remote server, other than looking for the control app in the local LAN?
TheGRS 2y ago
> In the end, I got enough of the cyber ick, I decided to seek a simpler, less internet-connected solution to my temperature-controlled bed needs. Great line. And my eyes bugged out a little at this part as I also realized what the implications were: > - They can know when you sleep > - They can detect when there are 2 people sleeping in the bed instead of 1 > - They can know when it’s night, and no people are in the bed I have a more pragmatic question. Do any consumer publications do security reviews for products? I'm thinking like consumer reports and how they should probably publish if a product is a security nightmare or not. At the end of the day you still need people publish this stuff out and for social media to spread to consumers to beware, but maybe a magazine type of publication could take on part of that responsibility.
- Tijdreiziger 2y ago
  Just wait until you hear about Wi-Fi sensing. https://www.technologyreview.com/2024/02/27/1088154/wifi-sensing-tracking-movements/ https://www.technologyreview.com/2024/02/27/1088154/wifi-sen...
- bovinegambler 2y ago
  Mozilla does something like that, privacy reviews of consumer products: https://foundation.mozilla.org/en/privacynotincluded/ https://foundation.mozilla.org/en/privacynotincluded/
  - deleted 2y ago
    [deleted]
- knallfrosch 2y ago
  The people who care about security don't buy cloud-connected bed heaters – or run their own software on their IoT devices. You'll have exactly zero ad revenue because there is no overlap between prospective buyers and people who care about security.
  - haswell 2y ago
    Most people I know that own these beds (myself included…was an early adopter before they started enshittefying their product): 1. Work in tech 2. Do care about security I think this product in particular really attracts the tech nerd life optimizer types.
keysersoze33 2y ago
I bought an Eight Sleep Pod 3, as I'm light sleeper who wakes up often at 3 or 4am, and struggles to get the final hours of sleep. I have to say it made my sleep significantly worse - I was shocked at how bad the temperature setting was - shifting 1 degree warmer or colder was often too much. I also noticed quite a bit of manipulation of reviews & comments on Reddit / subtle sponsorship on YouTube. (=> fake comments, upvoting/downvoting, and unofficial sponsorship). Maybe it really does improve some people's sleep, but just the noise itself from the Pod meant I needed earplugs to not be disturbed by it. My suggestion is to avoid buying at all costs...
6stringmerc 2y ago
As a creative writer I love detailed explanations like this because it helps me recall prior fictional scenarios - in particular, Mom’s Friendly Robot Co. from Futurama. Exploits are innocuous until a use case arises, and the IoT devices in the wild make for a thrilling garden for “what if” contemplation.
the_plus_one 2y ago
- They can know when you sleep - They can detect when there are 2 people sleeping in the bed instead of 1 - They can know when it’s night, and no people are in the bed I'm probably naive, but I'm failing to see how any of this is exclusive to having remote SSH access to the bed. Who's to say this isn't already happening with other binaries in the firmware? Maybe they're already phoning home? [...]that bypasses all forms of formal code review process. How does the author know if anything else in the firmware goes under any kind of code review process? It's not a bad article, but it does seem to make a lot of assumptions, and you already agreed to let arbitrary code run on your network when you added an IoT device to it.
- lilyball 2y ago
  It is in fact already sending this data to their servers, because it doubles as a sleep tracker and everything goes through their servers. I really wish there was an option to do local-only connectivity, but very few internet-enabled products these days actually care about supporting a local-only mode, and I suspect the number of products that do would be even smaller if HomeKit didn't mandate it (sadly, temperature-controlled beds are not a HomeKit product category).
- zemvpferreira 2y ago
  I think what he's trying to emphasise is the idea that anyone who's part of the engineering team could spy on you, without anyone else knowing. It's bad enough that the company has this data, sure, but there's at least an assumption that it will be secured and penalties can be enforced if not. Some random engineering being able to look into your life intimately by themselves is a completely different level of violation.
zamalek 2y ago
I'm not sure about the latest models, but my early-revision BedJet has no smart features at all: it was all bluetooth. It solves much the same problem as the product here: warm/cool the bed, not the house.
leftcenterright 2y ago
> exceeding $300 million dollars in annual revenue I would be interested in knowing who the buyers for this stuff are ..
kylecazar 2y ago
Bed as a service? Hell no. What an awful idea.
DarmokJalad1701 2y ago
I have one of these bed covers. I bought it before the subscription crap started and I am very satisfied with the product. The dual-zone cooling/heating is super good and has been a big improvement to my quality of life/sleep. Especially considering that my wife has different ideas than me about temperature and what constitutes hot/cold. Yes, it would be nice if I had local control but I am willing to ignore that as long as I don't have to pay more. But I wouldn't recommend anyone buy it now because of the subscription. It is good to know that there is an option to continue using it if the company decided to no longer grandfather in people who bought before the subscription crap started.
jmuguy 2y ago
In case anyone is wondering why someone would pay so much to control their bed temp - I have a similar product the "Chillipad". Essentially I'm a furnace when I sleep and wake up covered in sweet. This thing keeping my bed cool was the biggest single thing I've done to improve sleep quality. Its not quite as stupid as Eight Sleep in terms of initial cost and there's no ongoing subscription but it was still expensive. I've also had to open it up and replace a faulty check valve, and it occasionally floods so I have it sitting in a tray. But damn... it works. However now I want to try this aquarium chiller...
userbinator 2y ago
If I'm reading this correctly, the product is just a temperature-controlled mattress? Well, each bed contains a full Linux-based computer. If my estimations above are correct, all of Eight Sleep engineering can take full control of that computer any time they want. I think that was already a given once you agree to silent automatic updates.
- pbhjpbhj 2y ago
  Wow, a full Linux-based computer... what did they spend the other $1990 on?
lilyball 2y ago
Nothing here is particularly surprising. The worries about engineers ssh'ing into the machine to see if anyone is sleeping seems rather overblown though. The product itself doubles as a sleep tracker and all data goes through their servers (as is sadly the norm for smart home appliances these days) so they have that data anyway. I have to take it on faith that they anonymize and aggregate the data before doing any analysis on it, but the very nature of the product means they have the data.
r1b 2y ago
re: the kinesis key - curious, what is the right way to configure log delivery for remotely deployed appliances?
- r1b 2y ago
  in this situation, is it just like, you should front kinesis with a service that can apply appropriate quotas / limits?
pshirshov 2y ago
> (the bed...) won’t function if the internet goes down Who in the sane mind buys that.
13_9_7_7_5_18 2y ago
[dead]
rmason 2y ago
I looked really hard at buying an 8 Sleep. I have techie friends who swear by them. But one of the big reasons I didn't go forward I don't see mentioned here and that is noise. I need a dark and quiet room to sleep. Someone told me they returned their 8 sleep because of the constant fan noise of the computer running the thing. He told me it was like having a server in your bedroom. I am also not keen at all needing to have my phone in my bedroom either. At the end of his life my father had some health challenges and it wasn't uncommon for a nurse to call me in the middle of the night. It was all the other calls, people tweeting or slacking at me that made it really challenging to get any sleep. Still looking for something where I can collect sleep data if any entrepreneurs can solve these problems.
- I_Write_It 2y ago
  If your goal is just collect sleep data, I personally use my Withings Scanwatch with a leather bracelet, But if you're not willing to keep a watch while you're sleeping they have "Sleep analyzer" that you put under your bed to collect Sleeping data, but I never tried it ! The link : https://www.withings.com/eu/en/sleep-analyzer https://www.withings.com/eu/en/sleep-analyzer
- pedalpete 2y ago
  I have a friend who felt the cover was really uncomfortable as well. He had a really expensive mattress, but said he could feel the cooling tubes in the cover. I'll do you one better on "collecting sleep data". I've been in the neurotech/sleeptech space for the last 5 years developing https://affectablesleep.com https://affectablesleep.com After getting an Oura ring years ago, and it telling me "you didn't get enough sleep[deep, REM]" I was left thinking "so what?? don't tell me I didn't do it, help me to do it!" From what I've seen in the market, possibly with the exception of 8Sleep or CPAP (for those who need it), is that everyone is focused on counting minutes, and adding a few minutes to sleep. Particularly "fall asleep faster" where they promote "fall asleep x% faster" where x% in minutes is like 7 or 8 minutes. What is really valuable in sleep, and particularly deep sleep, is not really the time, it's the restorative brain functions, and at the moment, we are focused on one metric slow-wave delta power. It's not how many minutes you sleep, it's how much sleep is in each minute. Of course, there is sleep data along with that, but if your sleep is optimized in the time you get, do you really care about the daily data?
xyst 2y ago
We give these companies hard earned fucking cash and they want _more_. Rapacious neoliberal capitalists will be the end of capitalism itself.
sigmonsays 2y ago
This is so cringe, i am getting motivated to only use dumb devices. I no longer can trust that someone is looking at my TV data, Oven data, thermostat data, etc and tweeting about it.
max_ 2y ago
A night mare I have is that alot of these products like 8 Sleep are actually scams. Not scams in the sense of swindling money, but that they are appendages of a private or government intelligence network. If you genuinely care about your customers, can't you simply feel guilty of doxing such sensitive data about them? Some evil entities what to know when you sleep, wake up or if there is someone else in the bed. I am not against technology, this can be done responsibly via offline support, self hosting options, E2E Encryption, Homomorphic computing, differential privacy etc. But I guess implementing those would interfere with the scam i.e the main objective, which is spying on you.
kapka6700 2y ago
How did the author find the backdoor URL in the first place?
jimt1234 2y ago
> For someone who suffers from insomnia this seemed worth a shot. I can relate, having suffered the same for most of my life. One thing that really helped me was a simple white noise machine, typically used to help babies sleep. Good: I sleep great with it. Also, it's not connected to the internet and doesn't require an app. Bad: I basically can't sleep without it. I have to travel with it (camping!). I even purchased a backup in case the primary fails, which has happened. The other major sleep improvement was putting effort into accepting that life is pretty great; all of my worries that kept me awake at night were overblown. This took actual work, but it paid off. Anyway, just thought I'd pass that along, hoping it might help someone else that struggles with sleep. https://www.amazon.com/Yogasleep-Portable-Soothing-Rechargeable-Baby-Safe/dp/B01D50RYSC https://www.amazon.com/Yogasleep-Portable-Soothing-Rechargea...
- mihaaly 2y ago
  White noise machine: FM radio tuned to an empty frequency. Very low tech, very cheap, very secure, very effective.
- specialist 2y ago
  Me too. Tried all the things. No improvement. Turns out most of my anxiety, insomnia, etc sensations were caused by pinched spinal nerves. I say sensation because I believe, but cannot prove, that my physical sensation led to my mental state. Most diagnosis assume the reverse; that mental state leads to physical symptoms (restlessness, clinching, pit-in-stomach, whatever). I have not yet read anything or met anyone (care providers) supporting my hunch. So... Anyone experiencing treatment resistent pinched nerves, eg sciatica pain, may want to consider possible physical causes. In my case, it was collapsing vertebrae due to osteoporosis resolved with a S1-L5-L4 lumbar fusion. Yes, that surgery and recovery was very difficult. The upside is I now often sleep like a corpse. It's glorious. YMMV.
  - genewitch 2y ago
    is osteo something that isn't detectable with an xray? I ask because if i go to the doctor for back pain et al and they can't find anything wrong, i'd expect the next referral to be to imaging so they can see if it's skeletal. I have a slight curve in my spine, but not enough to be a clinical diagnosis of scoliosis. So i will just have "back pain" of all sorts my entire life and that's great, super. But if i get a different sort of back pain i'd expect an xray at some point, right?
throwaway81523 2y ago
Yuggh. There is also a bed chilling thing from sleep.me that is around $600. I haven't looked into it enough to tell whether it is internet connected. But I've been aware of it because my mom is very fussy about her sleeping temperature and it might be something I should look into when it gets warmer.
owenversteeg 2y ago
Anyone here tried those aquarium chillers? Sounds like a great alternative, I would love to read more about using them in practice.
qwertox 2y ago
I have an esp32 next to my bed. I log the rssi strength and with that i know when i was in the bed and when i changed position. It also has a pir which detects movement, but tracking the rssi is good enough. A phone would be just as good, and I wouldn't be surprised if some sdk tracks the rssi of the phone to check if something changes around the phone. It's very telling.
- polishdude20 2y ago
  Oh that's clever! Can you explain more how the rssi changes when you change positions? Is it fairly obvious in a graph?
  - qwertox 2y ago
    It's like this https://imgur.com/a/SLrGHas https://imgur.com/a/SLrGHas I was in bed from close to midnight to somewhat before 8:00.
akerl_ 2y ago
I’m missing a step here. I see a var called ssh, and an authorized key, but I don’t see where they’re seeing any method for the device to expose itself outside the NAT that’s in place on basically every consumer LAN. This looks a lot more like the device fetches updates via SSH to a remote update server, and the authorized_keys entry is vestigial.
- circular_logic 2y ago
  You're right it would be nice to see some more detail. Perhaps it requires sending a custom update when it reaches out via ssh or it does something wild like opening a reverse shell
  - akerl_ 2y ago
    Evidence of it opening a reverse shell would be wild, and should be possible to spot, if it’s happening, by monitoring what network traffic to that domain looks like. Beyond that, companies being able to push changes via custom firmware is sort of the normal state of consumer IoT devices. And it doesn’t really imply the kind of broad “the whole engineering team can access my LAN” that the OP is speculating about. Now, from a design standpoint, using SSH to pull firmware updates would be a bit of a wonky choice. But the world is full of wonky choices.
gfkclzhzo 2y ago
I have a chilipad - https://sleep.me/ https://sleep.me/ It's good for temperature control, you can set a profile that changes over night. The cooling is a complete fix for night sweats. It heats too, but I don't use it. I don't use the sleep tracking features. My only semi-major complaint is that the pump is kind of loud. Only annoyance is that you need to have it connected to wifi w/ internet to set the temperature profile w/ the app, but it keeps working afterwards w/o internet.
polishdude20 2y ago
I knew there was some shady shit going on with eight sleep! Back last year I posted a comment on Veritasium's YouTube channel because he had eight sleep as a sponsor. I commented that eight sleep is a privacy nightmare. Anyways, feels good to be vindicated.
cafard 2y ago
Can't but think of He knows when you are sleeping, He knows when you're awake, He knows when you've been bad or good...
abetancort 2y ago
Happens when you buy expensive garbage with a subscription attached.
noisy_boy 2y ago
> There’s some zip ties securing the tubes you have to cut, but other than that, it’s a totally reversible, non-destructive process that takes 30 seconds. Wait until Eight Sleep "upgrades" the connectors to be "incompatible" with Aquarium chillers.
kpollls 2y ago
isn't it safe if your home network is not exposing port 22?
1vuio0pswjnm7 2y ago
Actual title: "Removing Jeff Bezos from my bed"
- gnabgib 2y ago
  https://news.ycombinator.com/item?id=43133674 https://news.ycombinator.com/item?id=43133674
- bambax 2y ago
  Editing of titles on HN is annoying; I maintain this Tampermonkey script to mark moderated titles and show the original one: https://raw.githubusercontent.com/bambax/hntitles/refs/heads/master/hntitles.user.js https://raw.githubusercontent.com/bambax/hntitles/refs/heads...
  - 13_9_7_7_5_18 2y ago
    [dead]
bambax 2y ago
After skimming most comments here I still wonder what people want from a temperature-controlled mattress? Is it to have a warmer bed or a cooler one? Or does it depend on each person, some like it hot and some don't? And for those who prefer a warm bed, isn't it simpler and cheaper to warm the room?
peteforde 2y ago
If the OP sees this, I'd be very curious if they used the 70 watt or the 100 watt aquarium chiller.
trumpvoter 2y ago
Interesting article but have to raise the issue of calling just any dog a doge. While I can understand the difficulty of resisting a joke, doges deserve better. (Not talking about DOGE btw).
croemer 2y ago
Great article, two typos: 1. Kenises should be Kinesis 2. The URL template contains {anynumber}, the text refers to anynumbers (plural)

980 points by riverdroid 2y ago

honey, that is only for special occasions

I got one of those indoor gardening systems. We thought we had an issue with them. Contacted support. Support checked and it was fine. Just needed time to adjust. They mentioned they checked the cameras (!). Later on I got a second used one and while cleaning it, noticed that the internals are just a raspberry pi. Took my micro HDMI and keyboard, and... this thing just runs Raspberry Pi OS. No updates. And ... VNC. People from that company can just remote into my device, look at what the cameras are seeing, and do stuff on my network. These things are a security nightmare.

mihaaly 2y ago
I'd love to have a robot vacuum but all I checked last time had wifi connectivity and advanced sensors to build accurate map of our home uploaded to an app of my phone with who knows what capabilities. Some even had camera. All they missed some mic to listen in on us, however since some are connected to Alexa that is a wish fulfilled for many. - Alexa, wipe up that spill in the bedroom. - Sorry, that requires deep clean, but you had some credit left on your second credit card so I ordeered a deep clening service for Tuesday when you are away.
- imglorp 2y ago
  Some of these vacuums will work without the Wi-Fi. You will have to do without automatic features, for example you have to push the button every time to get it to start, but if you just want it to do the whole area it will run and return to base. It's enough for my area
- mrgoldenbrown 2y ago
  Your robot vacuum is basically a mobile camera all your neighbors can access https://www.abc.net.au/news/2024-10-11/robot-vacuum-yells-racial-slurs-at-family-after-being-hacked/104445408 https://www.abc.net.au/news/2024-10-11/robot-vacuum-yells-ra...
- Epa095 2y ago
  FYI there is https://github.com/Hypfer/Valetudo https://github.com/Hypfer/Valetudo which acts as a replacement of the cloud service. I'd you buy one of the supported devices you root it to point to the Valetudo server (which you run yourselves). You can then put the robot on its own WiFi without Internet access if you want to be even more secure.
  - mihaaly 2y ago
    Thanks for the tip. But I am just a user and this is just a vacuum. I rather focus on other than jumping hoops for the products of the indecent manufactureres. While saving a lot of money as bonus. I think I will cope without it.
  - genewitch 2y ago
    no need to root it if you have a decent "router" stack. fortigates can re-route even hard-coded IPs to internal services ;-) i am sure others can too, i just know we had to use the fortigate to fix a hard-coded IP that was breaking something. i think it was a fog device, even.
    - Epa095 2y ago
      Do you know if this works with any vacuums? I would assume they used https and would notice that man-in-the-middle attack.
      - genewitch 2y ago
        I am not an expert network engineer so i asked the one that manages the fortigate: > it'll work for whatever ports or application you want since it's a layer 7 firewall
- rolph 2y ago
  how many of these end up being used for dirty purposes rather than cleaning purposes. not just accidental bathroom pix, but blatant porn.
Eduard 2y ago
which brand and model?
- OptionOfT 2y ago
  I have a Gardyn 3.0 and 4.0. They run Raspberry Pi OS with some custom code. They have live access to the cameras.
  - HWR_14 2y ago
    Were you able to disable their remote access software once you were poking around the raspberry pi?
    - OptionOfT 2y ago
      I could've uninstalled the package, but I moved it all to a separate VLAN until the warranty is over. I'm debating writing a custom firmware, the GPIO pins are documented somewhere. * Run pump. * Turn lights on / off / %. * Measure water in tank. * And then they have a moisture / temperature which they use for their 'AI' / heuristics on whether to water more or less. You don't need that. You just water more often. The point of hydroponics is that the roots sit in water. * Occasional photo (via USB). I'm trying to find a Raspberry Pi Zero 2 W with the GPIO pins soldered on the 'other side', as that is how the Gardyn is setup.
neop1x 2y ago
That's why I have a separate VLAN and wifi AP for devices I don't trust. And where possible, I use them over LAN only and block their access to the internet on the firewall. That's also why I like zigbee devices and why I am not very happy about Matter and "IP everywhere".
- cirelli94 2y ago
  I'd like to do this but I need some more hardware. I'm thinking to buy a Mikrotik hAP Ax3 Router WiFi 6 or a more expensive Turris Omnia or MOX... The standard home routers doesn't have those features!
  - neop1x 2y ago
    For IOT AP I use an old olinuxino with MT7612U 2.4G wifi dongle running Arch Linux ARM as most of my wifi iot devices run on 2.4Ghz wifi anyway. Then I have a normal wifi in a ASUS PRIME N100I-D D4 x86 low power mobo which I also use as a media box. It has a Mediatek mt7916 wifi 6e-capable (but running wifi 6 currently anyway) M.2 card by AsiaRF in a short cable extender. I took a long time to find a well-supported wifi card. Then I have a third box which is also a router and has normal 5GHz AP. It also hosts a radius daemon used by all APs which assigns MAC addresses to VLANs, optionally forces them to their unique passphrases. All boxes are connected by LAN cables. It works perfectly with no issues but it took gradual smaller improvements over many days until I ended up with this setup. It would also be possible to cram everything into a single box if the area to be covered isn't very large.
malfist 2y ago
Which indoor garden? Was thinking about some but want to make sure to avoid this company
- archon810 2y ago
  https://news.ycombinator.com/item?id=43139381 https://news.ycombinator.com/item?id=43139381 Gardyn

robertclaus 2y ago

Cat food dispensers are an interesting product where this trend hasn't quite landed - it's still easy to get a new model without WiFi for roughly the same price. I wonder if the possibility of your pet not getting fed is a line consumers won't cross for convenience features.

cytocync 2y ago

[dead]

sailfast 2y ago

Total aside: it’s illegal for any company to provide goods or services for free to the government, so the Pod CEO would be breaking the law sending DOGE employees bed pods. It’s basically seen as a bribe - which is true! These beds are $2000 each but it’s pretty cheap for favorable regulatory treatment after a small donation. :/

archon810 2y ago
He'll say that DOGE is not part of the government but a private endeavor by Elon Musk. Also: citation needed. A quick Google says it's not illegal as long as the government entity confirms it in writing.
- daveguy 2y ago
  Doge couldn't even secure their "transparency tweets" website when it went up. I get the impression they don't have the organization to confirm anything in writing.

unosama 2y ago

If you suffer from insomnia, there are so many other things you can do. Check your Vitamin D and B levels. Meditate. Don't get a bed that emits more EMF. That definitely won't help you. before anyone tries to mock me for mentioning EMF: https://pmc.ncbi.nlm.nih.gov/articles/PMC5247706/ https://pmc.ncbi.nlm.nih.gov/articles/PMC5247706/

tills13 2y ago

> Beyond the basics, what does access to a device on your home network grant them? Any other device connected to that home network - smart fridges, smart stoves, smart washing machines, laptops - is typically routable via your bed. The (in)security of those devices is now entrusted to random Eight Sleep engineers. And this is why I have any device that needs connectivity to the Internet to function in its own vlan with very specific and oppressive rules about what can talk with what. If you don't have a fancy router, use your guest network for these things. I hate this future.

aranelsurion 2y ago

> Imagine your ex works for Eight Sleep. Or imagine they want to know when you’re not home. I think what is often missed in "company gathers data it doesn't need" scenarios is not that someone inside Eight Sleep abuses the data, or the company itself does it, but them gathering this data for years and then losing it to some 14yo hacker who promptly posts it and suddenly all your data is public. The inside job may sound a little far fetched, but the latter is only a matter of time. Once it happens multiple times with different services, everyone gets access to everything about you.

motbus3 2y ago

I honestly cannot understand why pay 19 USD/month for something you paid 2000. It is not like they are providing you stellar quality software nor that it needs to be done remotely

nadis 2y ago

"When I say backdoor, what am I referring to? Sure, Eight Sleep needs a way to push updates, provide service, and offer support. That’s expected. What goes too far in my opinion, is allowing all of Eight Sleep’s engineers to remotely SSH into every customer’s bed and run arbitrary code that bypasses all forms of formal code review process. And yes, I found evidence that this is exactly what’s happening." ^ wow, this is pretty wild. <insert joke about being careful about who you share a bed with>

HNdev1995 2y ago
I agree with you but please explain how this is any different than when an app on your phone gets updated
- physicles 2y ago
  It’s completely different. Could a rogue engineer inject whatever code they want into an app update? Possibly yes, but 1) that code will get shipped to every phone at the same time, 2) that code has to do its thing without anyone noticing, which is tricky at scale (this is how malware gets discovered), and 3) there’s an audit trail so that engineer will be exposed to legal risk. The difference here is that with Eight Sleep, an engineer can remotely access the customer device in real time and poke around the network the bed is connected to, and there may be no audit logs. They can exfiltrate sensitive data with much less effort and less legal risk than with an app update.
SeanAnderson 2y ago
Sounds like a good way to get bed bugs. .. I'll see myself out.
Linkd 2y ago
even more so combined with the fact that these are supposedly being sent into the government.
fra 2y ago
You’d be surprised at how many hardware companies think this is a good idea! I’m the founder and CEO of a company called Memfault, we make observability SaaS for hardware companies. I constantly get asked if we could just offer a remote access solution. Many of our competitors do! But we think it’s (a) a huge security liability and (b) too ripe for abuse. But fundamentally consumers do not care, and until that changes you can expect any embedded Linux device to have this kind of backdoor (they do more often than not).

EvanAnderson 2y ago

The state of the product's security wasn't unexpected. I was, however, shocked by this part: > I was willing to overlook: > The bed costs $2,000 > It won’t function if the internet goes down > Basic features are behind an additional $19/mo subscription > The bed’s only controls are via mobile app Nothing about this bed should depend on off-site servers. Nothing about the product should necessitate a subscription fee. The market is clearly too stupid to vote against the rent seeking tech industry. It makes me so sad.

chrisandchris 2y ago
> Basic features are behind an additional $19/mo subscription One can just question how we want to live our lives in the future. Behind each and every step a subscription? And all of them seem to be priced 10-20/month, no matter how much value they provide.
readthenotes1 2y ago
Conspicuous consumption drives a lot of irrational behavior
jjice 2y ago
I've heard the sleep people get with this is excellent, but no way in hell am I paying a subscription and requiring an internet connection for my bed. The entire concept is just absurd. If it sells, it sells, I guess.
- megadata 2y ago
  I've also heard people are having excellent sleep in their traditional modern beds. Me included.
  - amarcheschi 2y ago
    I've also heard about people finding new foam mattresses too hot :( like me. will buy a spring mattress next time Edit thank you for your recommendation but I'm in italy, European and American mattresses are quite different. Before discovering this, I once wrote to the customer support of the flamingo hotel, Las Vegas, because I loved their mattress: Hi, i do think that what i'm gonna write is weird, but anyway haha. On july of the summer 2019 i visited the fabulous las vegas. nor the nightlife neither the opulence of sin city could, however, reach the pinnacle of the human civilization, the mattress on which i slept at flamingo. I now have to change my own mattress at home, and i'm looking for the model on which i slept. the website only says "Simmons beautyrest", although Beautyrest is just a brand name used by simmons and doesn't mean a specific model. could you help me in this modern day divine comedy, be my Virgil and help me find the mattress name? Regards Name I got an answer: Thank you for contacting Caesars Entertainment. I was delighted to hear that you enjoyed our mattress on your visit! Currently, we are using the Simmons Hospitality Beautyrest Felicity Pillow Top. They can be purchased at https://caesarsguestpurchase.com/shop https://caesarsguestpurchase.com/shop or 1-866-926-8233. Please feel free to write back if you have any further questions. Thank you for choosing Caesars for your gaming entertainment! Have an amazing day! Shirley

deleted 2y ago

[deleted]

dsalzman 2y ago

Using the aquarium chillers is really smart! Just need someone to mfg the mattress membrane covers.

deleted 2y ago
[deleted]
hangonhn 2y ago
I didn't realize they've come down so much in price. Another really useful application would be to hook it up to pads used to ice joints post joint surgery. I was sold a $100+ dollar medical device which was basically a water pump in a cooler chest (like one of those Polar ones) that circulated water through some pads. I had to refill it every hour or so with ice. This is right after a knee surgery so caring the cooler around was literally painful. Having it connected to the aquarium chiller would have been great.
- LoganDark 2y ago
  you know those "VR backpacks"? imagine... knee chiller backpack
beala 2y ago
I'd love to be wrong about this, but I'm very skeptical that the aquarium chiller pictured in the post can move enough heat to cool a human. As mentioned in the article, it uses thermoelectric coolers which are extremely inefficient. I see at least one aquarium chiller on amazon that uses a compressor, but then you have to wonder if it's quiet enough to sleep next to.
- zemvpferreira 2y ago
  Same, though I've seen thermoelectric chillers of that size moving ~200 Watt and a human produces less than 100 Watt at rest. The ones I saw on Amazon for $150 claimed to move around 70 Watt which is ballpark useful. You wouldn't want to cool down to a very low temperature anyway, just remove the heat you produce yourself.

ipython 2y ago

[flagged]

AtlasBarfed 2y ago

Um, is that Bezos or the AWS account of the company? Alas, our hope to recover whatever social benefit was in SpaceX and Tesla is with Bezos's companies, although at least the EV space is more diverse. SpaceX cannot be wrested from Musk and TSLA and its board is preferred-stock controlled by Musk.

lotsofpulp 2y ago
> TSLA and its board is preferred-stock controlled by Musk. Any source for this? I can’t find anything that says the Musk has enough voting power in Tesla to not need others’ votes: https://www.techopedia.com/largest-tesla-shareholders https://www.techopedia.com/largest-tesla-shareholders This is a pretty in depth analysis that shows that Musk needed retail votes for last year’s compensation and re-domiciling votes: https://clsbluesky.law.columbia.edu/2024/07/01/how-tesla-pumped-the-vote/ https://clsbluesky.law.columbia.edu/2024/07/01/how-tesla-pum...
- rtkwe 2y ago
  Tesla actually has a 1 share 1 vote right now but it also has super majority voting rules which means Musk's ~22% stake is nearly a veto unless the entire rest of the stockholders vote for a measure he's against. https://www.thestreet.com/investing/stocks/how-elon-musk-controls-tesla-with-only-a-minority-stake-14564491 https://www.thestreet.com/investing/stocks/how-elon-musk-con...
  - lotsofpulp 2y ago
    That is an Apr 2018 article. Elon has a substantially smaller share now. From first link in above post: > Elon Musk is the largest individual Tesla shareholder, with 410.79 million shares, representing 12.8% of Tesla ownership as of December 2024. https://www.secform4.com/insider-trading/1494730.htm https://www.secform4.com/insider-trading/1494730.htm

kaonwarb 2y ago

Interesting article; clickbait title. There's very little about Amazon in here, never mind its chairman.

martinsnow 2y ago
It drives clicks! I don't understand why someone would buy a bed chiller. But perhaps the US is a unique market.
- skizm 2y ago
  I’m in the market for one. I want a cool sleep in the summer with fresh air (not recycled AC air). I haven’t found one with good reviews and also no required spyware unfortunately. So AC plus humidifier is needed, but I still sweat on the parts of my body in contact with the mattress no matter how much I crank the AC in the middle of Aug.
  - martinsnow 2y ago
    What's the difference between recycled air thats been cooled and then blown into your bed and the air from your air conditioner?
    - BobaFloutist 2y ago
      I can't speak to the person you're replying to, but it's like the difference between an electric blanket and a space heater. It's energetically cheaper to cool just the bed than the whole room, and it won't dry out the air as much.
    - skizm 2y ago
      The air from my air conditioner sits on top of me like a blanket, not touching the parts of me in contact with the mattress. If the mattress itself is actually cool, it will stop me from sweating. The recycled air thing is just personal preference, breathing fresh air feels subjectively better than recycled air so I keep my window open as much as possible. If the weather is hot, but my mattress is cold, then I can keep the window open and still be cool on hot days.

j2kun 2y ago

> While the Eight Sleep CEO Matteo seems focused on providing DOGE with great sleep More sycophants coming out of the woodwork.

LordShredda 2y ago
It's him and that mattress guy, and the whole stereotype of mattress stores being money laundering fronts. What's up with the bed industry in general?
- bloopernova 2y ago
  Could you please let me know who the "mattress guy" is?
  - duskwuff 2y ago
    Possibly thinking of Mike Lindell? He sold pillows, not mattresses, but I'll count that as close enough. https://en.wikipedia.org/wiki/Mike_Lindell https://en.wikipedia.org/wiki/Mike_Lindell
ta1243 2y ago
"We may not have that many outright Nazis in America, but we have plenty of cowards and bootlickers, and once those fleshy dominoes start tumbling into the Trump camp, the game is up" That's the health secretary's words.

dangoodmanUT 2y ago

Title is bad, but the piece is good

dang 2y ago
Ok, we've replaced the article title with a more representative sentence from the article.

sxp 2y ago

I have an EightSleep from before their enshittification into a subscription model. It is a good piece of hardware, but I can no longer recommend it because the software is so crappy. I checked the logs on my router and found that it was streaming tons of data to servers even when I wasn't using it. I have no idea why it would stream that much data since the trivial sensors it has shouldn't be producing that much data even if it had multi Hz sampling. I can't tell if this is incompetence or some sort of malfeasance where they are secretly recording audio data via motion sensors and streaming that.

wedn3sday 2y ago
Maybe this guy isnt the first person to discover the backdoor and your mattress has been mining crypto. This whole thing is straight out of a Cory Doctorow novel.
micromacrofoot 2y ago
> I have no idea why it would stream that much data I think the blog post uncovered that here... the CEO is a total creep
throwway120385 2y ago
Because they want to know what you're doing in bed and when.

j2kun 2y ago

> but the eight sleep sure does harvest people’s bed data, and occasionally tweet about how they’re watching you sleep [Followed by a screenshot of the EightSleep CEO publicly tweeting about SF sleep data in Nov 2023.] This is reason enough to not patronize this business. What a creep.

hackernewds 2y ago
The company itself is also run by a race car driver and has typical Miami hype. Not sure why they are often tagged as tech companies, besides making a black version of Casper. Could be the heavy Elon association.
xyst 2y ago
This brand was heavily advertised on social media (TT, YT ads) as well. I remember because I signed up for e-mail updates. Glad I never signed up though. IIRC, I was turned off by the same issues the author “overlooked”. A subscription for a bed? Fuck off
kristofferR 2y ago
They don't have any competitors, for people who need their product it's the only real option. The only competitors have a much worse core product unfortunately, so we have to put up with EightSleep's shit.

WalterBright 2y ago

I've bought several internet radio streaming devices over the years, and they all eventually brick when the server goes out of business.

neogodless 2y ago
I was so pleasantly surprised when my Microsoft / Harman Kardon "smart" speaker (Invoke) issued a firmware update upgrading it to act as a simple Bluetooth speaker. It's wildly more useful now! A rare exception to the usual.
- modeless 2y ago
  Google has done this with the Stadia controller, and also recently open sourced the firmware for the Pebble smartwatch. They may discontinue a lot of stuff but their track record for discontinued hardware is pretty decent IMO.
NotYourLawyer 2y ago
ROI!
optymizer 2y ago
Offtopic: I grew up in a tiny post-soviet third world country. Aside from the usual daily struggles, one lesser known aspect of that life is that we did not have access to primary sources of information or the people who invented the things we were using. We only had a book in my native language on Pascal. I had heard of C from a magazine that had a CD with a C compiler on it, and I walked into a library wanting to learn C but all they had was a dusty book on COBOL in Russian. Later I bought a book on x86 assembly, also in Russian, because that's all I could find, and it just felt like I'm living inside a leaky bucket whereas I was hungry for the firehose of knowledge. When we got dial-up Internet, I did not sleep for days. The floodgates were open. I had access to tons of information online, in original English, from primary sources. People I've only had heard about, like Torvalds, would just share information directly on the Internet, like it's another Tuesday. To me it felt like I went to Disneyland and I was meeting all my heroes. You can just... learn about any topic and see the people who invented those topics. You could even send them messages. 25 years later, I still feel like that kid sometimes. I'm thankful for HN. Alan Kay replied to me once, and it made my year! Alan M-Fing Kay. I met rms once in the flesh and could not believe my eyes. I regularly see messages from Walter Bright on HN like he's a real human being and I have to remind myself that yes, he's alive, real and I exist in the same world as him and can actually interact. I and kids around the world these days are lucky to not be stuck in a world where you cannot learn more than they let you.

blackeyeblitzar 2y ago

Clickbait title.

dang 2y ago
Ok, we've replaced the article title with a more representative sentence from the article.

nrki 2y ago

Love the part about the CEO being a Musk sycophant. Right down to the similar language in tweets: "Some of SF got poor sleep. We must fix this."

duxup 2y ago
I remember when mimicking Steve Jobs dress and etc was a thing and how it was kinda cringey. Man I could go for some of that these days.
- steve_adams_86 2y ago
  We were spoiled back then. Creeps and weirdos were relatively endearing.
- EdwardDiego 2y ago
  Yeah, in hindsight, the black turtlenecks everywhere were the good ol days.
  - deleted 2y ago
    [deleted]
deepsquirrelnet 2y ago
> While the Eight Sleep CEO Matteo seems focused on providing DOGE with great sleep, the real doge (pictured above), whose name is Latte, is sleeping great tonight. It’s better than that. He’s putting in backdoors where they sleep. I’m sure there’s a market for that data.

amarcheschi 2y ago

here a related discussion about a guy who did a similar thing with an aquarium cooler to cool his bed https://news.ycombinator.com/item?id=41824138 https://news.ycombinator.com/item?id=41824138

modeless 2y ago

> the Eight Sleep cover, which is available on eBay for a few hundred Uh, I don't think I want to buy a used mattress cover on eBay, thanks.

pimlottc 2y ago

While we're all here, what are some good alternatives to Eight Sleep? The idea seems to have merit but the required IoT subscription is a dealbraker.

0x2a 2y ago
I use one of their competitors (Sleepme Ooler) but they're not great either. Did not know about aquarium chillers, that seems like a better option. Could probably pair it with Home Assistant too if you wanted to more easily set the temperature.

WalterBright 2y ago

I always knew that internet-connected thermostat was a bad idea.

whatshisface 2y ago

You would have to be insane to buy a computer that remains someone else's computer...

doublerabbit 2y ago
[flagged]
- paldepind2 2y ago
  I think the key feature is _cooling_ the bed, with warming secondary to that. That arguably sounds like a great nicety to have, notwithstanding all the downsides mentions in the post.
  - doublerabbit 2y ago
    So now your getting hacked and breathing in toxins while you sleep. Hacked up the arse and in the mouth too. Nice. Yeah, no thanks. I try to make my bedroom as technology free as possible. Apart from a digital alarm clock; at night I put my phone on aeroplane mode and place it outside my closed bedroom door. It's the best I can do with today's bullshit tech. I've never had a problem with not having a cold bed, so maybe it's the next best thing after the bidet.
    - perching_aix 2y ago
      Toxins? What?
      - doublerabbit 2y ago
        Why else is there plastic in your brain? How do you think you make "cold"? when cold leaks, it can be toxic.
        perching_aix 2y ago
        Cold cannot be "made", as it's an absence of something (energy), nor can it "leak" as a result. I take what you mean is that there will be a refrigeration loop involved, and in that, a refrigerant. Just like all substances, refrigerants can be toxic, sure, but that alone is not what makes a toxin [0]. It's also not a binary thing, and between air conditioning and refrigerators, an appliance like this I don't see why would stand out. I further haven't got a clue what microplastics having been found to pass the blood brain barrier have to do with this, or how you're able to determine whether that applies to me or not, specifically. [0] https://en.m.wikipedia.org/wiki/Toxin https://en.m.wikipedia.org/wiki/Toxin

wedn3sday 2y ago

A $20/month bed subscription is objectively hilarious. I cant imagine how this company attracts a non-zero number of clients.

lijok 2y ago
*subjectively. Once you realize just how important quality sleep is, and how much this can help, $20/month bed subscription becomes a laughably small price to pay.
- JTyQZSnP3cQGa8B 2y ago
  Do you have the same reasoning with cigarettes? $10 every day is a small price to pay to avoid having to stop smoking.
  - lijok 2y ago
    I don't follow, sorry
  - trzeci 2y ago
    Cigarettes is a consumable resources, as for any resources like that it has fifferen justification as you cant produce it. The subscription for bed is not, it locks artificially features to pay monthly. Even more, it collecs data to improve the product (which sounds good) - but you need to pay for this. They have an ability to run model locally - they choose to not. I like Topaz approach: you have an ability over some time (subscription period) to have up to date model that will help you recognise snoring etc, then if you choose not to pay - you stick with this model, but it still works. Subscription in addition is something that limits an ability to sell it in the future.
- low_tech_love 2y ago
  How much can this help?
  - lijok 2y ago

avalys 2y ago

This is a bunch of nonsense, assumption and leaping to conclusions without evidence. "In the second screenshot, we have the public key that’s authorized to access the device. The email address attached to the public key, eng@eightsleep.com, to me suggests the private key is likely accessible to the entire engineering team." He has no evidence for this whatsoever and not really any good reason to assume it either. "In the first image, we see evidence SSH is being exposed remotely, to a far away host, remote-connectivity-api.8slp.net. Typically SSH would only be accessible to the local area network, but the variables in production.json would seem to imply this access was opened up to a remote host." This isn't how SSH works and he doesn't seem to have enough information, or enough knowledge of SSH, to understand what's being done with the "far away" hostname. This article is just clickbait nonsense, which should have been obvious from the title. It is clearly intended to draw traffic to their company website, which is some kind of venture-backed security startup. Based on the fact that the founders seem to have a superficial understanding of technology but a well-developed understanding of hype and bullshit, I am not interested in exploring their business further.

ta1243 2y ago
Are you denying the existence of an authorised ssh key on each of these beds allowing the holder of the key? Are you denying there is a config file pointing to a target called remote-connectivity-api.8slp.net? No there's not enough evidence to prove in a court of law who has access to the private key, or that the config file is enabling a return ssh connection, but it's pretty damning. The only thing that's not newsworthy about this is that large amounts of IOT shit does this.
- duskwuff 2y ago
  > Are you denying there is a config file pointing to a target called remote-connectivity-api.8slp.net? Under the path ".ssh.endpoint", too. It's not like it's just a mystery hostname; it clearly has something to do with SSH. > The only thing that's not newsworthy about this is that large amounts of IOT shit does this. And - just to be clear - that doesn't mean it shouldn't be reported on! Talking about this stuff, and having concrete, specific examples, is good.

bloopernova 2y ago

My wife uses a Bedjet which has both a remote and app. Thankfully it works without an active Internet connection. It uses a bag-like sheet that it blows air into, to adjust temperature. For women suffering* through menopause, being able to adjust around hot/cold flushes is sanity-preserving! * Some women don't suffer much during perimenopause or menopause, but it's a process that seriously fucks with one's hormones. A word of advice to any partner of a woman going through perimenopause: believe them when they tell you what they're going through! So many partners don't realize just how much this can mess up someone, they deserve every sympathy possible.

hn_acc1 2y ago
I may suggest this to my wife.. She's going through the hot flash stage..
zemvpferreira 2y ago
My friend Sara had a rare form of breast cancer at 34. Thankfully she survived, but to improve her odds of staying alive she's been essentially put into permanent menopause for the next decade. Constant hot flashes. Is the Bedjet really that good? Would your wife recommend it without reservations? Are there any other product that have made a difference for her? Apologies if that's intrusive but improving Sara's sleep would be life-changing for her.
- bloopernova 2y ago
  Yes, my wife would recommend it without reservations. There's also a cold water circulator, useful for icing a painful limb etc. https://www.amazon.com/gp/aw/d/B09VRJ153X https://www.amazon.com/gp/aw/d/B09VRJ153X Not intrusive at all, I hope your friend can find some relief. I hope she can find strength and joy in life.
  - zemvpferreira 2y ago
    Thank you both very much for your kind words and advice, ordering one now. No doubt it will make a dramatic difference.

chinathrow 2y ago

That CEO tweet to Elon is peak cringe.

mitjam 2y ago

Can recommend hot water bottles and a hairdryer for occasional on demand bed warming.

electroly 2y ago

I'm a two-time Eight Sleep customer and the CEO could post my sleep history specifically with my full name and I'd still use it. It's really comfortable. I think most of the detractors were never remotely in the market for such a product. Everything negative said about the product and the company is true, and they should do better, but it's not enough to scare me away thanks to how good the base product is.

yuvalr1 2y ago
If there was a similar product that does not upload any of your extremely personal data, like whether you're now in your bed, to some server on the internet, would you prefer it?
- electroly 2y ago
  Sure, there are lots of ways it can be improved. I'd like it to be cheaper too. I'd be happy to switch to an alternative that is just as good but without the Internet nonsense, but SleepMe isn't it. I've got my eyes open for viable competitors for the next time I need to outfit a mattress or when this one dies. For now, Eight Sleep is the best one I've found.
mimischi 2y ago
But is it more comfortable, then say, an old school analog expensive mattress? I can’t shake the feeling these companies are selling snake oil (that is not to say that old school analog mattresses aren’t overpriced either)
- electroly 2y ago
  You may be misunderstanding the product--it's a topper that goes on top of your existing mattress. It doesn't replace the mattress. I do indeed have it on top of an old school analog expensive mattress. It cools/warms to the desired temperature without impacting the comfort from the mattress. I don't think there's much room for snake oil here: it pumps cooled or heated water through the mattress topper. There's no mystery.

yuvalr1 2y ago

Are there any consumer products offered that provide similar functions (heating, controlling with an app etc.), but which never try to connect to a remote server, other than looking for the control app in the local LAN?

TheGRS 2y ago

> In the end, I got enough of the cyber ick, I decided to seek a simpler, less internet-connected solution to my temperature-controlled bed needs. Great line. And my eyes bugged out a little at this part as I also realized what the implications were: > - They can know when you sleep > - They can detect when there are 2 people sleeping in the bed instead of 1 > - They can know when it’s night, and no people are in the bed I have a more pragmatic question. Do any consumer publications do security reviews for products? I'm thinking like consumer reports and how they should probably publish if a product is a security nightmare or not. At the end of the day you still need people publish this stuff out and for social media to spread to consumers to beware, but maybe a magazine type of publication could take on part of that responsibility.

Tijdreiziger 2y ago
Just wait until you hear about Wi-Fi sensing. https://www.technologyreview.com/2024/02/27/1088154/wifi-sensing-tracking-movements/ https://www.technologyreview.com/2024/02/27/1088154/wifi-sen...
bovinegambler 2y ago
Mozilla does something like that, privacy reviews of consumer products: https://foundation.mozilla.org/en/privacynotincluded/ https://foundation.mozilla.org/en/privacynotincluded/
- deleted 2y ago
  [deleted]
knallfrosch 2y ago
The people who care about security don't buy cloud-connected bed heaters – or run their own software on their IoT devices. You'll have exactly zero ad revenue because there is no overlap between prospective buyers and people who care about security.
- haswell 2y ago
  Most people I know that own these beds (myself included…was an early adopter before they started enshittefying their product): 1. Work in tech 2. Do care about security I think this product in particular really attracts the tech nerd life optimizer types.

keysersoze33 2y ago

I bought an Eight Sleep Pod 3, as I'm light sleeper who wakes up often at 3 or 4am, and struggles to get the final hours of sleep. I have to say it made my sleep significantly worse - I was shocked at how bad the temperature setting was - shifting 1 degree warmer or colder was often too much. I also noticed quite a bit of manipulation of reviews & comments on Reddit / subtle sponsorship on YouTube. (=> fake comments, upvoting/downvoting, and unofficial sponsorship). Maybe it really does improve some people's sleep, but just the noise itself from the Pod meant I needed earplugs to not be disturbed by it. My suggestion is to avoid buying at all costs...

6stringmerc 2y ago

As a creative writer I love detailed explanations like this because it helps me recall prior fictional scenarios - in particular, Mom’s Friendly Robot Co. from Futurama. Exploits are innocuous until a use case arises, and the IoT devices in the wild make for a thrilling garden for “what if” contemplation.

the_plus_one 2y ago

- They can know when you sleep - They can detect when there are 2 people sleeping in the bed instead of 1 - They can know when it’s night, and no people are in the bed I'm probably naive, but I'm failing to see how any of this is exclusive to having remote SSH access to the bed. Who's to say this isn't already happening with other binaries in the firmware? Maybe they're already phoning home? [...]that bypasses all forms of formal code review process. How does the author know if anything else in the firmware goes under any kind of code review process? It's not a bad article, but it does seem to make a lot of assumptions, and you already agreed to let arbitrary code run on your network when you added an IoT device to it.

lilyball 2y ago
It is in fact already sending this data to their servers, because it doubles as a sleep tracker and everything goes through their servers. I really wish there was an option to do local-only connectivity, but very few internet-enabled products these days actually care about supporting a local-only mode, and I suspect the number of products that do would be even smaller if HomeKit didn't mandate it (sadly, temperature-controlled beds are not a HomeKit product category).
zemvpferreira 2y ago
I think what he's trying to emphasise is the idea that anyone who's part of the engineering team could spy on you, without anyone else knowing. It's bad enough that the company has this data, sure, but there's at least an assumption that it will be secured and penalties can be enforced if not. Some random engineering being able to look into your life intimately by themselves is a completely different level of violation.

zamalek 2y ago

I'm not sure about the latest models, but my early-revision BedJet has no smart features at all: it was all bluetooth. It solves much the same problem as the product here: warm/cool the bed, not the house.

leftcenterright 2y ago

> exceeding $300 million dollars in annual revenue I would be interested in knowing who the buyers for this stuff are ..

kylecazar 2y ago

Bed as a service? Hell no. What an awful idea.

DarmokJalad1701 2y ago

I have one of these bed covers. I bought it before the subscription crap started and I am very satisfied with the product. The dual-zone cooling/heating is super good and has been a big improvement to my quality of life/sleep. Especially considering that my wife has different ideas than me about temperature and what constitutes hot/cold. Yes, it would be nice if I had local control but I am willing to ignore that as long as I don't have to pay more. But I wouldn't recommend anyone buy it now because of the subscription. It is good to know that there is an option to continue using it if the company decided to no longer grandfather in people who bought before the subscription crap started.

jmuguy 2y ago

In case anyone is wondering why someone would pay so much to control their bed temp - I have a similar product the "Chillipad". Essentially I'm a furnace when I sleep and wake up covered in sweet. This thing keeping my bed cool was the biggest single thing I've done to improve sleep quality. Its not quite as stupid as Eight Sleep in terms of initial cost and there's no ongoing subscription but it was still expensive. I've also had to open it up and replace a faulty check valve, and it occasionally floods so I have it sitting in a tray. But damn... it works. However now I want to try this aquarium chiller...

userbinator 2y ago

If I'm reading this correctly, the product is just a temperature-controlled mattress? Well, each bed contains a full Linux-based computer. If my estimations above are correct, all of Eight Sleep engineering can take full control of that computer any time they want. I think that was already a given once you agree to silent automatic updates.

pbhjpbhj 2y ago
Wow, a full Linux-based computer... what did they spend the other $1990 on?

lilyball 2y ago

Nothing here is particularly surprising. The worries about engineers ssh'ing into the machine to see if anyone is sleeping seems rather overblown though. The product itself doubles as a sleep tracker and all data goes through their servers (as is sadly the norm for smart home appliances these days) so they have that data anyway. I have to take it on faith that they anonymize and aggregate the data before doing any analysis on it, but the very nature of the product means they have the data.

r1b 2y ago

re: the kinesis key - curious, what is the right way to configure log delivery for remotely deployed appliances?

r1b 2y ago
in this situation, is it just like, you should front kinesis with a service that can apply appropriate quotas / limits?

pshirshov 2y ago

> (the bed...) won’t function if the internet goes down Who in the sane mind buys that.

13_9_7_7_5_18 2y ago

[dead]

rmason 2y ago

I looked really hard at buying an 8 Sleep. I have techie friends who swear by them. But one of the big reasons I didn't go forward I don't see mentioned here and that is noise. I need a dark and quiet room to sleep. Someone told me they returned their 8 sleep because of the constant fan noise of the computer running the thing. He told me it was like having a server in your bedroom. I am also not keen at all needing to have my phone in my bedroom either. At the end of his life my father had some health challenges and it wasn't uncommon for a nurse to call me in the middle of the night. It was all the other calls, people tweeting or slacking at me that made it really challenging to get any sleep. Still looking for something where I can collect sleep data if any entrepreneurs can solve these problems.

I_Write_It 2y ago
If your goal is just collect sleep data, I personally use my Withings Scanwatch with a leather bracelet, But if you're not willing to keep a watch while you're sleeping they have "Sleep analyzer" that you put under your bed to collect Sleeping data, but I never tried it ! The link : https://www.withings.com/eu/en/sleep-analyzer https://www.withings.com/eu/en/sleep-analyzer
pedalpete 2y ago
I have a friend who felt the cover was really uncomfortable as well. He had a really expensive mattress, but said he could feel the cooling tubes in the cover. I'll do you one better on "collecting sleep data". I've been in the neurotech/sleeptech space for the last 5 years developing https://affectablesleep.com https://affectablesleep.com After getting an Oura ring years ago, and it telling me "you didn't get enough sleep[deep, REM]" I was left thinking "so what?? don't tell me I didn't do it, help me to do it!" From what I've seen in the market, possibly with the exception of 8Sleep or CPAP (for those who need it), is that everyone is focused on counting minutes, and adding a few minutes to sleep. Particularly "fall asleep faster" where they promote "fall asleep x% faster" where x% in minutes is like 7 or 8 minutes. What is really valuable in sleep, and particularly deep sleep, is not really the time, it's the restorative brain functions, and at the moment, we are focused on one metric slow-wave delta power. It's not how many minutes you sleep, it's how much sleep is in each minute. Of course, there is sleep data along with that, but if your sleep is optimized in the time you get, do you really care about the daily data?

xyst 2y ago

We give these companies hard earned fucking cash and they want _more_. Rapacious neoliberal capitalists will be the end of capitalism itself.

sigmonsays 2y ago

This is so cringe, i am getting motivated to only use dumb devices. I no longer can trust that someone is looking at my TV data, Oven data, thermostat data, etc and tweeting about it.

max_ 2y ago

A night mare I have is that alot of these products like 8 Sleep are actually scams. Not scams in the sense of swindling money, but that they are appendages of a private or government intelligence network. If you genuinely care about your customers, can't you simply feel guilty of doxing such sensitive data about them? Some evil entities what to know when you sleep, wake up or if there is someone else in the bed. I am not against technology, this can be done responsibly via offline support, self hosting options, E2E Encryption, Homomorphic computing, differential privacy etc. But I guess implementing those would interfere with the scam i.e the main objective, which is spying on you.

kapka6700 2y ago

How did the author find the backdoor URL in the first place?

jimt1234 2y ago

> For someone who suffers from insomnia this seemed worth a shot. I can relate, having suffered the same for most of my life. One thing that really helped me was a simple white noise machine, typically used to help babies sleep. Good: I sleep great with it. Also, it's not connected to the internet and doesn't require an app. Bad: I basically can't sleep without it. I have to travel with it (camping!). I even purchased a backup in case the primary fails, which has happened. The other major sleep improvement was putting effort into accepting that life is pretty great; all of my worries that kept me awake at night were overblown. This took actual work, but it paid off. Anyway, just thought I'd pass that along, hoping it might help someone else that struggles with sleep. https://www.amazon.com/Yogasleep-Portable-Soothing-Rechargeable-Baby-Safe/dp/B01D50RYSC https://www.amazon.com/Yogasleep-Portable-Soothing-Rechargea...

mihaaly 2y ago
White noise machine: FM radio tuned to an empty frequency. Very low tech, very cheap, very secure, very effective.
specialist 2y ago
Me too. Tried all the things. No improvement. Turns out most of my anxiety, insomnia, etc sensations were caused by pinched spinal nerves. I say sensation because I believe, but cannot prove, that my physical sensation led to my mental state. Most diagnosis assume the reverse; that mental state leads to physical symptoms (restlessness, clinching, pit-in-stomach, whatever). I have not yet read anything or met anyone (care providers) supporting my hunch. So... Anyone experiencing treatment resistent pinched nerves, eg sciatica pain, may want to consider possible physical causes. In my case, it was collapsing vertebrae due to osteoporosis resolved with a S1-L5-L4 lumbar fusion. Yes, that surgery and recovery was very difficult. The upside is I now often sleep like a corpse. It's glorious. YMMV.
- genewitch 2y ago
  is osteo something that isn't detectable with an xray? I ask because if i go to the doctor for back pain et al and they can't find anything wrong, i'd expect the next referral to be to imaging so they can see if it's skeletal. I have a slight curve in my spine, but not enough to be a clinical diagnosis of scoliosis. So i will just have "back pain" of all sorts my entire life and that's great, super. But if i get a different sort of back pain i'd expect an xray at some point, right?

throwaway81523 2y ago

Yuggh. There is also a bed chilling thing from sleep.me that is around $600. I haven't looked into it enough to tell whether it is internet connected. But I've been aware of it because my mom is very fussy about her sleeping temperature and it might be something I should look into when it gets warmer.

owenversteeg 2y ago

Anyone here tried those aquarium chillers? Sounds like a great alternative, I would love to read more about using them in practice.

qwertox 2y ago

I have an esp32 next to my bed. I log the rssi strength and with that i know when i was in the bed and when i changed position. It also has a pir which detects movement, but tracking the rssi is good enough. A phone would be just as good, and I wouldn't be surprised if some sdk tracks the rssi of the phone to check if something changes around the phone. It's very telling.

polishdude20 2y ago
Oh that's clever! Can you explain more how the rssi changes when you change positions? Is it fairly obvious in a graph?
- qwertox 2y ago
  It's like this https://imgur.com/a/SLrGHas https://imgur.com/a/SLrGHas I was in bed from close to midnight to somewhat before 8:00.

akerl_ 2y ago

I’m missing a step here. I see a var called ssh, and an authorized key, but I don’t see where they’re seeing any method for the device to expose itself outside the NAT that’s in place on basically every consumer LAN. This looks a lot more like the device fetches updates via SSH to a remote update server, and the authorized_keys entry is vestigial.

circular_logic 2y ago
You're right it would be nice to see some more detail. Perhaps it requires sending a custom update when it reaches out via ssh or it does something wild like opening a reverse shell
- akerl_ 2y ago
  Evidence of it opening a reverse shell would be wild, and should be possible to spot, if it’s happening, by monitoring what network traffic to that domain looks like. Beyond that, companies being able to push changes via custom firmware is sort of the normal state of consumer IoT devices. And it doesn’t really imply the kind of broad “the whole engineering team can access my LAN” that the OP is speculating about. Now, from a design standpoint, using SSH to pull firmware updates would be a bit of a wonky choice. But the world is full of wonky choices.

gfkclzhzo 2y ago

I have a chilipad - https://sleep.me/ https://sleep.me/ It's good for temperature control, you can set a profile that changes over night. The cooling is a complete fix for night sweats. It heats too, but I don't use it. I don't use the sleep tracking features. My only semi-major complaint is that the pump is kind of loud. Only annoyance is that you need to have it connected to wifi w/ internet to set the temperature profile w/ the app, but it keeps working afterwards w/o internet.

polishdude20 2y ago

I knew there was some shady shit going on with eight sleep! Back last year I posted a comment on Veritasium's YouTube channel because he had eight sleep as a sponsor. I commented that eight sleep is a privacy nightmare. Anyways, feels good to be vindicated.

cafard 2y ago

Can't but think of He knows when you are sleeping, He knows when you're awake, He knows when you've been bad or good...

abetancort 2y ago

Happens when you buy expensive garbage with a subscription attached.

noisy_boy 2y ago

> There’s some zip ties securing the tubes you have to cut, but other than that, it’s a totally reversible, non-destructive process that takes 30 seconds. Wait until Eight Sleep "upgrades" the connectors to be "incompatible" with Aquarium chillers.

kpollls 2y ago

isn't it safe if your home network is not exposing port 22?

1vuio0pswjnm7 2y ago

Actual title: "Removing Jeff Bezos from my bed"

gnabgib 2y ago
https://news.ycombinator.com/item?id=43133674 https://news.ycombinator.com/item?id=43133674
bambax 2y ago
Editing of titles on HN is annoying; I maintain this Tampermonkey script to mark moderated titles and show the original one: https://raw.githubusercontent.com/bambax/hntitles/refs/heads/master/hntitles.user.js https://raw.githubusercontent.com/bambax/hntitles/refs/heads...
- 13_9_7_7_5_18 2y ago
  [dead]

bambax 2y ago

After skimming most comments here I still wonder what people want from a temperature-controlled mattress? Is it to have a warmer bed or a cooler one? Or does it depend on each person, some like it hot and some don't? And for those who prefer a warm bed, isn't it simpler and cheaper to warm the room?

peteforde 2y ago

If the OP sees this, I'd be very curious if they used the 70 watt or the 100 watt aquarium chiller.

trumpvoter 2y ago

Interesting article but have to raise the issue of calling just any dog a doge. While I can understand the difficulty of resisting a joke, doges deserve better. (Not talking about DOGE btw).

croemer 2y ago

Great article, two typos: 1. Kenises should be Kinesis 2. The URL template contains {anynumber}, the text refers to anynumbers (plural)