10 ms·
Vacuum bricked after user blocks data collection – user mods it to run anyway
- homeonthemtn 1y ago[flagged]
- ThePowerOfFuet 1y agoThe business has no right to remotely kill a device purchased by an end user.
- whycome 1y agoYeah! Just degrade the battery life and user experience through forced updates so they are pushed to upgrade instead!
- sidewndr46 1y agoYou don't own the software on the device, they do. If they choose to revoke that license, that is their choice.
- chrismcb 1y agoWell, no. You can't just revoke a license. As far as owning the software in the device, I works would argue that you do own a copy of it. I'm sure there is some buried tos claiming you just own a license to run it, and I know this is still being litigated. But when the average person purchases someone their expectation is that they've purchased it, not licensed it.
- awefasdf 1y agoI own the device and all of its storage. The exact state of that storage is my business and precisely no one else's.
- sidewndr46 1y agoYou can own as many storage devices as you wish, it doesn't give you the right to make copies of others works and use them without license.
- kdmtctl 1y agoIn EU you have the right to use bundled software as long as you own the appliance. Not sure this is true for US.
- sidewndr46 1y agoHow does that work? What if the company licenses technology from company A to build product B, but the license is only good for 2 years? What happens 2 years after you buy product B? Also doesn't Apple, Google, & other remove features from people's smartphones after release all the time in the EU?
- kdmtctl 1y agoThis is not legal to sell a finished product which has a license time bomb, I suppose. Google and Apple can change the future set but they do not brick the device which was discussed and it works as advertised at the moment of purchase.
- sidewndr46 1y agoWhat is the "future set" ?
- kdmtctl 1y agoTypo. "Feature set", referring to your comment. Functions of software. Quoted below, source is widely available. “The notion of goods with digital elements should refer to goods that incorporate or are inter-connected with digital content or a digital service in such a way that the absence of that digital content or digital service would prevent the goods from performing their functions.” — Recital 14, Directive (EU) 2019/771.
- dylan604 1y agoDid you accept the EULA?
- homeonthemtn 1y agoOnly sane comment in this thread
- SchemaLoad 1y agoConsumer law comes above the EULA. A clause which states the company can remotely brick your hardware should be rendered invalid.
- ptrl600 1y agoOK, no _moral_ right. They could probably stick a clause in there about the vacuum eating my pets for nourishment, but...
- bigbadfeline 1y ago> Why would they not be homogenous? Why would a business have the power to decide what should and what shouldn't be homogeneous about the property of others? A transaction took place, property has legally changed hands and the former owner is exerting control over property that isn't theirs any more. How about if the builder of your house comes into your home via an access route unknown to you, and starts rearranging where things are placed, or where you and your wife are placed, etc. in order to maintain homogeneous layout?
- below43 1y agoThis is a cool article, and neat he got it working in the end. One thing that is odd - if he blocked it calling home, it doesn't make sense that the kill code was issued remotely. It makes more sense that there is a line of code internally that kills the machine when it can't call home (which would be far less malicious).
- DaSHacka 1y ago> It makes more sense that there is a line of code internally that kills the machine when it can't call home (which would be far less malicious). Would it be? Whether the line of code is on the server or the device, what's the difference?
- deleted 1y ago[deleted]
- fragmede 1y agoIf you bring me your silverware from the kitchen, or I go into your house to take it, what's the difference? (CFAA charges)
- DaSHacka 1y agoIf you sell me silverware that, unless I share my eating habits with you, automatically disintegrates, or if you break in and steal them back, what truly is the difference? It's funny you think a vacuum automatically bricking itself if you try to prevent its connection to the mothership is at all equivalent to someone choosing to give someone silverware.
- Sanzig 1y agoThe owner did not hack the vacuum, he blocked the IP address on his network for the telemetry server. Same thing tons of people do with Pi-Hole DNS blocking, for example. There's no sane world where it is defensible to remotely brick a device because it can't communicate with a telemetry server.
- consp 1y agoNot just devices. Same for apps. If you block the live monitoring features of some crash accumulators apps will not function. (Looking at you dexcom)
- hulitu 1y ago> There's no sane world where it is defensible to remotely brick a device because it can't communicate with a telemetry server. Just today: Setting up an old smartphone: "Google assistant cannot work on this device." The only choice was "back". Had to search on the internet the solution: do not connect to wi-fi.
- Zak 1y ago> As the business running the servers of smart vacuums, if I saw an atypical device reporting in, without context, I too would kill that device. If you want to block a device from accessing your servers because it's behaving in an odd way, such as this one that was contacting the update server but not the telemetry server, that's not entirely unreasonable. Sending it a command to modify its software to stop it from operating entirely is outrageous.
- alvah 1y agoDoes low-effort rage-bait belong on HN? aka, are you f**ing kidding?
- sema4hacker 1y agoI wish I had the abilities of the engineer, plus the time he could devote to the problem.
- MostlyStable 1y agoThere is a significantly easier option (although still more work than just buying a vacuum and using it as the manufacturer intended): get one of the Valetudo supported vacuums[0]. This firmware replacement blocks telemetry and allows for near complete feature parity with the original firmware, and flashing is (usually) relatively simple. Certainly much simpler than the process described here. [0] https://valetudo.cloud/pages/general/supported-robots.html https://valetudo.cloud/pages/general/supported-robots.html
- deleted 1y ago[deleted]
- erulabs 1y agoThankful for people like this - with kids and family and work I’d probably have had this sit bricked for a year in my garage before finding time to tinker with it. Now I can just never buy any iLife product ever. We should probably update this story to link directly to the hackers blog, they deserve the credit! https://codetiger.github.io/blog/the-day-my-smart-vacuum-turned-against-me/ https://codetiger.github.io/blog/the-day-my-smart-vacuum-tur...
- goku12 1y ago> I wish I had the abilities of the engineer, plus the time he could devote to the problem. Ability is a matter of patience and persistence. And both are the results of motivation. Anyone can learn anything as long as they really want it. (barring disabilities like depression that destroy motivation. But some people use even that as an opportunity to learn new skills that in turn help them recover.) But Time is an entirely different matter. You can find time if you really want to, but life has other priorities too - including time doing nothing (rest). Finding the extra time in between all that will depend on your craftiness. That's the true skill here.
- m463 1y agoI block this nonsense before it gets to the cash register.
- HiPhish 1y agoThat's always a good idea, but how many people have the resources to research these details? First of all you have to be aware that this issue even exists. Then you have to scrape the corners of the internet for whether an appliance has any anti-features, because no manufacturer will ever write "collects unsolicited data about you, we will break the appliance if you refuse us your personal information" on the box. And finally you need to be able to afford the time and patience for the whole process. I don't own a smart vacuum cleaner because the trouble is not worth it to me. However, I can see smart vacuum cleaners being very good for elderly or disabled people, or someone who has very limited free time and could let the robot clean the house on its own while the owner is out. It is really disgusting that scumbag manufacturers are exploiting those people.
- pfdietz 1y agoThe simplest way is to just not buy any IoT devices.
- jacquesm 1y agoI don't. I take it home, open the package and return it as defective. You see the same everywhere. Lawnmowers even. A goat is more user friendly.
- charcircuit 1y agoI suspect this is not the full story. Why would someone waste their time manually disabling a device? That makes me think that this device was doing something malicous to their servers, enough to trip an alert.
- xupybd 1y agoNot really. They probably flagged this as someone modifying the device and thought it could be someone reverse engineering it.
- Mashimo 1y agoMight just be a "could not contact server for X days in a row" thing.
- close04 1y agoTo "encourage" the owner to re-enable the connectivity. Google threatens to ban your Youtube account if you block ads. Companies will go out of their way to nudge, push, or force you to keep the data collection (or ads) gravy train going.
- Telaneo 1y ago> Why would someone waste their time manually disabling a device? What what makes you think it was manual? > That makes me think that this device was doing something malicous to their servers, enough to trip an alert. Sounds like a them problem, and not a problem that should affect the consumer (beyond losing functionality directly tied to the server, which bricking of any kind goes far beyond)
- charcircuit 1y ago>What what makes you think it was manual? The article said that someone from the company logged in to his device and edited a file on it to disable it. Even if it was automatic someone would manually have to write a script to login and edit a file.
- 1y ago
- dylan604 1y ago"From there, he built a Raspberry Pi joystick to manually drive the vacuum, proving that there was nothing wrong with the hardware." He should make these and sell them. It would be worth it to just drive it in "discovery" mode and give it the exact path to follow while cleaning. The constant inability to learn the floor plan is beyond annoying.
- HiPhish 1y agoDepending on where he lives this might be illegal. Yes, we live in a cyberpunk dystopia where the manufacturer can break what you bought and then send you to jail for repairing it. You can read more about it here: https://consumerrights.wiki/w/Digital_Millennium_Copyright_Act https://consumerrights.wiki/w/Digital_Millennium_Copyright_A... This shit is absolutely dystopian. The law must not just be reversed, manufacturers need to be taken to court for shoddy software. Insecure data collection and transmission should be treated the same as having unsafe electrical wiring. It is a defect that needs to be either fixed or the product recalled. As long as manufacturers are not just allowed to but rewarded for selling defective products this won't change. I expect the moment unsolicited data collection becomes a liability manufacturers will drop it like a hot potato.
- analog31 1y ago>>>>> I expect the moment unsolicited data collection becomes a liability manufacturers will drop it like a hot potato. Possession of the data needs to be illegal. Here's how it could work. It's similar to how copyrights for music are enforced. A person whose data are found in someone's files or server can sue for "statutory" damages, which are levied on a per-offense basis.
- dylan604 1y agoWhat are the odds individuals learn their data has been found. What kind of damages could be awarded that would make hiring a lawyer and giving them 50% of winnings a worth while effort? I could also easily see individual cases combining to become class action reducing the winnings even further. In other words, I find this a silly suggestion as it's just never going to work in the real world.
- habibur 1y agoPrevious post https://news.ycombinator.com/item?id=45503560 https://news.ycombinator.com/item?id=45503560 which points to the actual blog of the author on github, instead of a news coverage of it.
- booleanbetrayal 1y agoNever connected my Roomba to the internet and it has worked fine for the past several years. It insists that I should connect to it via the app to resolve the occasional minor issue, but I would always ignore those. It's starting to show its wear and it's probably time for a new vacuum. I'm not sure if I'll be able to bootstrap one without connectivity, nowadays. Any good recommendations out there?
- MrZander 1y agoYou might be interested in this project https://valetudo.cloud/ https://valetudo.cloud/ They have a list of supported vacuums
- whatsupdog 1y agoValetudo is the best out there. I rooted my Roborock, and connected it my home assistant. It's super useful without having to send data to the cloud. The only thing is the developers are severely limited by how many vacuums they can support. I recently bought a Dreame X50 and it's still not supported.
- testing22321 1y agoBuy a used one the same as your current one. Find one with little use and you’ll be good for many more years.
- bitwize 1y agoProbably a felony under the DMCA. I'm reminded of when AWS us-east-1 went down and all the beds made by EightSleep (business model: Juicero for beds) became disabled. EightSleep put all the significant control for their beds in the cloud, doubtless because they couldn't or didn't know how to hire embedded engineers, and the only devs they could find were node.js flunkies who only knew how to do cloud. Looks like the makers of this vacuum did the same thing; they didn't know how or didn't want to build just enough smarts to do the localization and mapping itself, and said "fuck it, we'll do it in the cloud".
- observationist 1y agoThat's awfully generous. Forcing phone-home, remote control, data harvesting features to be always-on creates a huge amount of data that can be sold for a lot of money. It gets all the wrong people excited about investing and normalizing the level of intrusion into your privacy, with some faceless corporation harvesting gigabytes of data per month from the most intimate and vulnerable physical location in nearly anyone's life.
- fron 1y ago"Never attribute to incompetence that which can be attributed to malice" or something. Clearly automatic beds have some degree of embedded software. The decision to put the controls in the cloud was certainly a conscious one.
- goku12 1y ago> "Never attribute to incompetence that which can be attributed to malice" or something. Isn't that the inverse of the Hanlon's razor? But I agree - the Occam's razor says that the inverse Hanlon's razor is most likely the case here.
- cyberax 1y agoAnd what the company did is a felony under CFAA.
- 1y ago
- brenainn 1y agoA good time to point out https://github.com/Hypfer/Valetudo https://github.com/Hypfer/Valetudo. I haven't tried it personally because my particular model of vacuum has some complicated and potentially destructive procedure to get the required access, but there's quite a few models where it can be installed easily.
- darknavi 1y agoI have it on two of my Roborocks and it rocks.
- rendaw 1y agoRecently discussed: https://news.ycombinator.com/item?id=45642571 https://news.ycombinator.com/item?id=45642571
- goku12 1y ago> ... because my particular model of vacuum has some complicated and potentially destructive procedure to get the required access This right there is the root of the entire problem. We had IBM PC clones that you could recover and keep running for decades by easily replacing expansion cards, HDDs, RAM sticks, peripherals and even circuit components like caps, ICs and batteries. We used to partition our 50 GB HDD into a dozen little partitions and multiboot every conceivable OS out there. Now we have an oligarchic dystopia where even RAMs and batteries are soldered on and bonded with single-use resins instead of age-old screws. Even if you get through, you can't salvage or swap ICs because they're paired individually at device level. You can't reach the boot partition without a Ph.D in RevEng and a risk of still bricking the device 3 out of 4 times. And that's all for technological progress and security, they say! Those claims have as much credibility as their claims to making an honest living. It's weasel-speak, not engineering insight. Modifying the device that you paid for should never be this complicated. Those greedy corpos are usurping the consumer's rights and wealth, plain and simple.
- witx 1y agoFrom my understanding (I might be wrong) the images are pre-built by the owner of the project right? I remember there being a form you fill and you receive a download link. If that's the case what guarantees do I have there's no "funny business" on the image?
- StarGrit 1y agoWhenever I read about robovac. I wonder gow good are these robot vacs really? Maybe it is just me, but surely would be less effort to hire a cleaner and they can do more than just vacuuming.
- Jeremy1026 1y agoSure, but a cleaner coming twice is the same cost of a robot vacuum that will work for a couple of years, typically. They do an okay enough job, but they need to run daily, sometimes twice a day, to really keep up considering it's limitations.
- StarGrit 1y agoIt really depends on how big your properties is. A cleaner here could be done in less than an hour and there is no cleaner charging £150 an hour.
- smt88 1y agoWhat math are you doing here? Robovacuums don't cost £150 an hour. If you buy one for £500 and run it every day for two years, you're paying ~70p per hour. Are there any cleaners who charge less than £1 per visit?
- StarGrit 1y agoI was being hyperbolic because people seem to be overstating the cost of a cleaner. I used to pay my Spainish cleaners about €20 euros a week for two cleaners. Granted that was while ago, but it was peanuts. Also I'd rather have cleaner do it properly, than by a robovac that (as everyone says on the sibling comments) does half a job.
- chipsrafferty 1y agoChildren are free
- 1y ago
- deleted 1y ago[deleted]
- ethin 1y agoIMO a company should lose all control over technology once you've purchased it. Doesn't matter if it's "smart" or not. If the company wants to do something like telemetry, they can buy a license from you for that data. See how they like it when the tables are flipped.
- blueboo 1y agoCan't you trivially reframe the initial purchase as being subsidized by that license? Your $200 smart knife sharpener would be $300 if it weren't recording audio 24/7 (for VAD, surely!) I don't like it either but here we are
- 0xffff2 1y agoSure, that's basically how Kindle pricing works ($X with ads, or $X+$Y without ads) and it's infinitely better having the choice. If Amazon ever gets rid of the without ad version they will lose me as a customer overnight. Likewise, there are a whole lot of products that don't have an "unsubsidized" version that I simply refuse to purchase (or have purchased and returned after confirming that they will not work when locked in IOT jail where they can't talk to the internet.)
- bragr 1y ago>If Amazon ever gets rid of the without ad version they will lose me as a customer overnight. Didn't they already remove the option for a completely ad free prime video experience or am I hallucinating that? They have such a ridiculous hold on the e reader market I feel like it is just matter of the next down quarter.
- morsch 1y agoThey seem to own 75% of the market, and I think you can get pretty much every book on every device, right? Of course your existing library is locked-in; ideally, that'd be illegal.
- userbinator 1y agoFirst of all, it's Android Debug Bridge, which gives him full root access to the vacuum, wasn't protected by any kind of password or encryption. Good. You bought it, you own it. (I have no skin in this game --- my vacuum is as dumb as they come, and can be fixed with basic machine shop tools.)
- goku12 1y ago> (I have no skin in this game --- my vacuum is as dumb as they come, and can be fixed with basic machine shop tools.) The real question is, is that still an option? If it is, then for how long? Sadly, there are several other product lines that have entirely crossed that line a while ago.
- 334f905d22bc19 1y agoIf the day ever comes where this is not an option anymore, then I will just clean my house with a broom. Same thing goes for washing machines. If I can't buy one without internet, then I will clean my clothes by hand. Smart things are the worst shit ever. They make everything take longer, given the debugging/upgrading overhead. Not buying into that. What would be smart, would be a washing machine that cleans, dries, sorts and folds my clothes. Without talking to facebook. I would buy into that, but I don't need to share my washing machine status on instagram
- goku12 1y ago> If the day ever comes where this is not an option anymore, then I will just clean my house with a broom. Same thing goes for washing machines. If I can't buy one without internet, then I will clean my clothes by hand. Perfect! I wish a large enough section of the population took this principled stance. Those greedy corpos wouldn't be abusing their customers so much if the latter were united in denying them the market and the opportunity. Those 'smart devices' really need and deserve a lobotomy.
- userbinator 1y agoThere's a reason the vintage appliance community exists, and is growing. Replacement parts are still available for my decades-old vacuum cleaner, and even if they weren't, they're basic electromechanical parts that I could make or substitute easily.
- CGamesPlay 1y agoSounds like the "remote kill switch" was probably "log buffer was full", given that it comes back to life when used on a different network.
- xaxaxa123 1y ago[dead]
- markus_zhang 1y agoThanks for sharing. Removed this company from my list.
- Sharlin 1y agoHow did we let things get to this point? (A rhetorical question.)
- noir_lord 1y agoWhen smart devices started becoming common I looked at them and made the decision that it was a hard no from me - I didn't trust that they'd secure the data properly, I didn't trust the privacy aspect and I really didn't trust that they'd continue to support the product for the life of the hardware. Here we are 10-15 years later and I see no reason to change that view in the slightest. It surprises the none-techies I know that I don't have any smart devices in my home because they assume I would been a computer geek but its because I'm a computer geek that I don't. My hoover is a switch connected to an electric motor, I can service it with a phillips screwdriver. Even my TV is just a fedora box connected to a regular Samsung TV (which has never been on the network and never will).
- stevenicr 1y agoI wish every product like this had giant warnings on the box, in the online listing, etc. I bought a robot vac (after owning an early roomba for some time) - Opened it up, ready to use it - instructions said download the app to make it work. It's back in it's box somewhere around here and never used.