3 ms·
> Are you denying there is a config file pointing to a target called remote-connectivity-api.8slp.net? Under the path ".ssh.endpoint", too. It's not like it's
by duskwuff 2y ago
> Are you denying there is a config file pointing to a target called remote-connectivity-api.8slp.net?
Under the path ".ssh.endpoint", too. It's not like it's just a mystery hostname; it clearly has something to do with SSH.
> The only thing that's not newsworthy about this is that large amounts of IOT shit does this.
And - just to be clear - that doesn't mean it shouldn't be reported on! Talking about this stuff, and having concrete, specific examples, is good.
- avalys 2y ago"I downloaded the firmware and I found an SSH key and a configuration file that mentions an SSH endpoint; therefore, I know that all of Eight Sleep’s engineers are allowed to remotely SSH into every customer’s bed and run arbitrary code!" Do you not see a problem with this line of reasoning? That's literally what he says in the article, and he presents it as a near-certainty, not the wild leap of unsupported reasoning that it is.
- ta1243 2y agoIs your argument that there may be an internal policy which restricts access to the private key to a subset of engineers?