5 ms·

Already seeing some of the new Moltbot deployments exposed to the Internet: https://www.shodan.io/search/report?query=http.favicon.hash%3A-805544463%20http http

Already seeing some of the new Moltbot deployments exposed to the Internet: https://www.shodan.io/search/report?query=http.favicon.hash%3A-805544463%20http https://www.shodan.io/search/report?query=http.favicon.hash%...

rahimnathwani 8mo ago
Maybe those folks buying Mac Minis to host at home weren't so silly after all. The exposed ones are almost all hosted on VPSs which, by design, have publicly-routable IP addresses. But anyway I think connecting to a Clawdbot instance requires pairing unless you're coming from localhost: https://docs.molt.bot/start/pairing https://docs.molt.bot/start/pairing
- paxys 8mo ago
  The silly part is buying a $600 Mac mini when any $100 NUC or $50 raspberry pi or any cheap mini PC off of eBay will do the job exactly the same.
  - rahimnathwani 8mo ago
    If you want iMessage you still need an always-on Mac, whether that's the main moltbot gateway, or the MacOS app running in 'node mode' to allow a moltbot gateway to use it to send/receive iMessages.
    - Fnoord 8mo ago
      > need an always-on Mac Not really, you can emulate macOS on any Linux/x86-64. But it is actually a good point to get a Mac Mini instead of a NUC. The Mac Mini is going to deliver better performance per Watt.
      - aschobel 8mo ago
        Can you really register iMessage on an emulated MacOS these days? I'd love to learn more, the AIs I asked say it doesn't seem possible in VMs anymore.
        Fnoord 8mo ago
        I think you need to register on a real Mac (2 of 3 of my MBPs use OCLP), but then can use an emulated one if you add it to your Apple account. Either way, I don't recommend to use a protocol behind such a moat. Probably better to use Signal or Threema.
        dpoloncsak 8mo ago
        Moltbot is supposed to be a 'personal AI assistant' with >60% market share in US, you can't really expect people to just 'not use iMessage'. It's what the messages are going to be coming in on
      - rovr138 8mo ago
        > Not really, you can emulate macOS on any Linux/x86-64. Intel is going to stop being supported with the current OS version (Tahoe, 2025). OS are supported for about 3 years. I'm curious what will happen after. If they'll break it or if they'll allow the services to keep running on unsupported hardware. Got a couple years left
        fc417fc802 8mo ago
        I expect someone will eventually get around to reverse engineering the various M series specific instructions for qemu. Does imessage make use of hardware attestation to register with the remote endpoint?
    - noahjk 8mo ago
      I noticed when I was reading Federico Viticci's post about it that he was using telegram, which has much better support for "markdown"-y rendering, which looks a lot nicer than iMessage. And then I thought to myself, why would iMessage actually matter? The only other use-case would be interacting with texts, but almost anyone can tell when someone is using an LLM to text - I feel like our texting styles are so personal, and what is there even to gain from using an LLM just with text messages? So is it even worth it to run on a Mac?
      - JoblessWonder 8mo ago
        I see value in the LLM being able to read/integrate my iMessages since a lot of my scheduling/commitments are discussed on there.
  - deaux 8mo ago
    The silly part is buying a $50 raspberry pi, then storage and memory and so on, when a $200 used M1 Mac mini is plug-and-play.
    - cbdevidal 8mo ago
      The silly part is buying a $200 used M1 Mac mini, when a $5 Arduino clone can be used to blink an LED. Oh wait—that’s the silly part
      - cbdevidal 8mo ago
        That was supposed to be a joke. Guess I won’t give up my day job
      - ern_ave 8mo ago
        "What is my purpose?" "You turn this LED on or off"
    - PufPufPuf 8mo ago
      $40 used ThinkCentre Tiny is also plug and play! Or Dell Optiplex Micro, practically the same thing.
  - dpoloncsak 8mo ago
    Doesn't Moltbot specifically require MacOS for iMessage, Apple reminders, and some other Apple-ecosystem features? HN is the last place I expected to see someone laugh at self-hosting
  - port11 8mo ago
    Our SFF HP came out at 150€ with flash storage and 16GB of RAM. I see used M1s for 200-250€ where we live. The only drawback of the M1 is you’d be stuck buying a NAS/DAS for the storage part, whereas the HP has 3 internal SATA ports. Neither option is silly, they have different pros/cons. Managing Linux quirks has gotten frustrating, for example.
- johntash 8mo ago
  depending on how you set up the reverse proxy, clawdbot can think _all_ traffic comes from localhost
rvz 8mo ago
Like I said before [0] infosec professionals are going to have a great time collecting so much money from vibe coders and crypto bros deploying software they openly admit that they have no idea what it does. If you are very clever there is a chance that someone connected Moltbot with a crypto wallet and, well... A opportunity awaits for someone to find a >$1M treasure and cut a deal with the victim. [0] https://news.ycombinator.com/item?id=46774750 https://news.ycombinator.com/item?id=46774750
swah 8mo ago
Wasn't aware about this favicon trick, nice :)
- achillean 8mo ago
  FYI we released a tool to calculate a bunch of these types of hashes: https://book.shodan.io/command-line-tools/shodan-hash/ https://book.shodan.io/command-line-tools/shodan-hash/ More info about the favicon hashing technique: https://blog.shodan.io/deep-dive-http-favicon/ https://blog.shodan.io/deep-dive-http-favicon/

rahimnathwani 8mo ago

Maybe those folks buying Mac Minis to host at home weren't so silly after all. The exposed ones are almost all hosted on VPSs which, by design, have publicly-routable IP addresses. But anyway I think connecting to a Clawdbot instance requires pairing unless you're coming from localhost: https://docs.molt.bot/start/pairing https://docs.molt.bot/start/pairing

paxys 8mo ago
The silly part is buying a $600 Mac mini when any $100 NUC or $50 raspberry pi or any cheap mini PC off of eBay will do the job exactly the same.
- rahimnathwani 8mo ago
  If you want iMessage you still need an always-on Mac, whether that's the main moltbot gateway, or the MacOS app running in 'node mode' to allow a moltbot gateway to use it to send/receive iMessages.
  - Fnoord 8mo ago
    > need an always-on Mac Not really, you can emulate macOS on any Linux/x86-64. But it is actually a good point to get a Mac Mini instead of a NUC. The Mac Mini is going to deliver better performance per Watt.
    - aschobel 8mo ago
      Can you really register iMessage on an emulated MacOS these days? I'd love to learn more, the AIs I asked say it doesn't seem possible in VMs anymore.
      - Fnoord 8mo ago
        I think you need to register on a real Mac (2 of 3 of my MBPs use OCLP), but then can use an emulated one if you add it to your Apple account. Either way, I don't recommend to use a protocol behind such a moat. Probably better to use Signal or Threema.
        dpoloncsak 8mo ago
        Moltbot is supposed to be a 'personal AI assistant' with >60% market share in US, you can't really expect people to just 'not use iMessage'. It's what the messages are going to be coming in on
    - rovr138 8mo ago
      > Not really, you can emulate macOS on any Linux/x86-64. Intel is going to stop being supported with the current OS version (Tahoe, 2025). OS are supported for about 3 years. I'm curious what will happen after. If they'll break it or if they'll allow the services to keep running on unsupported hardware. Got a couple years left
      - fc417fc802 8mo ago
        I expect someone will eventually get around to reverse engineering the various M series specific instructions for qemu. Does imessage make use of hardware attestation to register with the remote endpoint?
  - noahjk 8mo ago
    I noticed when I was reading Federico Viticci's post about it that he was using telegram, which has much better support for "markdown"-y rendering, which looks a lot nicer than iMessage. And then I thought to myself, why would iMessage actually matter? The only other use-case would be interacting with texts, but almost anyone can tell when someone is using an LLM to text - I feel like our texting styles are so personal, and what is there even to gain from using an LLM just with text messages? So is it even worth it to run on a Mac?
    - JoblessWonder 8mo ago
      I see value in the LLM being able to read/integrate my iMessages since a lot of my scheduling/commitments are discussed on there.
- deaux 8mo ago
  The silly part is buying a $50 raspberry pi, then storage and memory and so on, when a $200 used M1 Mac mini is plug-and-play.
  - cbdevidal 8mo ago
    The silly part is buying a $200 used M1 Mac mini, when a $5 Arduino clone can be used to blink an LED. Oh wait—that’s the silly part
    - cbdevidal 8mo ago
      That was supposed to be a joke. Guess I won’t give up my day job
    - ern_ave 8mo ago
      "What is my purpose?" "You turn this LED on or off"
  - PufPufPuf 8mo ago
    $40 used ThinkCentre Tiny is also plug and play! Or Dell Optiplex Micro, practically the same thing.
- dpoloncsak 8mo ago
  Doesn't Moltbot specifically require MacOS for iMessage, Apple reminders, and some other Apple-ecosystem features? HN is the last place I expected to see someone laugh at self-hosting
- port11 8mo ago
  Our SFF HP came out at 150€ with flash storage and 16GB of RAM. I see used M1s for 200-250€ where we live. The only drawback of the M1 is you’d be stuck buying a NAS/DAS for the storage part, whereas the HP has 3 internal SATA ports. Neither option is silly, they have different pros/cons. Managing Linux quirks has gotten frustrating, for example.
johntash 8mo ago
depending on how you set up the reverse proxy, clawdbot can think _all_ traffic comes from localhost

rvz 8mo ago

Like I said before [0] infosec professionals are going to have a great time collecting so much money from vibe coders and crypto bros deploying software they openly admit that they have no idea what it does. If you are very clever there is a chance that someone connected Moltbot with a crypto wallet and, well... A opportunity awaits for someone to find a >$1M treasure and cut a deal with the victim. [0] https://news.ycombinator.com/item?id=46774750 https://news.ycombinator.com/item?id=46774750

swah 8mo ago

Wasn't aware about this favicon trick, nice :)

achillean 8mo ago
FYI we released a tool to calculate a bunch of these types of hashes: https://book.shodan.io/command-line-tools/shodan-hash/ https://book.shodan.io/command-line-tools/shodan-hash/ More info about the favicon hashing technique: https://blog.shodan.io/deep-dive-http-favicon/ https://blog.shodan.io/deep-dive-http-favicon/