IMO a company should lose all control over technology once you've purchased it. Doesn't matter if it's "smart" or not. If the company wants to do something like telemetry, they can buy a license from you for that data. See how they like it when the tables are flipped.
Can't you trivially reframe the initial purchase as being subsidized by that license? Your $200 smart knife sharpener would be $300 if it weren't recording audio 24/7 (for VAD, surely!)
Then I invite them to offer such a product. I would love to buy e.g. YouTube premium, but as far as I know they still collect my data for advertising purposes, they just don't show the ads.
We’ve lived with companies that didn’t need to take pics of my dick while I’m shitting to subsidize their operation for as long as companies were a thing. Anyone saying this dick pic status quo is inevitable and necessary is too VC-brained to be allowed to run a company.
I think you frame it that way you need to offer the other version.
I do wonder how many people would buy non-spy versions of devices given the option. More specifically, what that differential in price would be too. At worst it would be interesting to have a price explicitly stating what our data is worth. Many people actually internalize that it's not that valuable, but doing this would make it explicit.
Its also because people don't trust companies to not spy on them, even when they say they aren't, even when you paid them not to. They still will. So if I see a offer for to pay $100 more for a vacuum that won't spy on me, I think - yeah right, you're going to spy on me AND get any extra hundred bucks.
> I do wonder how many people would buy non-spy versions of devices given the option.
Depending on the discount for the spyware version, I'd guess close to zero. The general public has become completely numb to being spied on. It's hard to get someone to give up $50 (a real cost) for something nebulous like "very slightly less of your life is known by marketing companies".
> It's hard to get someone to give up $50 (a real cost) for something nebulous like "very slightly less of your life is known by marketing companies".
I'd gladly pay that price. I'm pretty sure there's a large number of us that would.
It's easy to make claims like yours without the real world data. To believe that things are the way they are because that's the most efficient way. Back justification is not logical. Idk about you, but I frequently make mistakes and need to redo things. I'm pretty confident it's just because I'm human and not an omniscient god.
Also, I'd suspect it might be more than $50. We didn't create a surveillance capitalist economy with trillion dollar businesses that resulted in everything including your vacuum spying on you because your data isn't valuable. Clearly it is...
The problem more is that people don't understand how that data is used and can be used. Which I don't blame anyone for that. It's abstract and honestly sounds like the stuff of tin foil hat conspiracy theorists. But at the same time, here we are. The point of ads is to manipulate you to buy things. Which isn't always bought with money. We have several multi trillion dollar companies and I'm pretty sure they don't exist for nothing
Sure, that's basically how Kindle pricing works ($X with ads, or $X+$Y without ads) and it's infinitely better having the choice. If Amazon ever gets rid of the without ad version they will lose me as a customer overnight.
Likewise, there are a whole lot of products that don't have an "unsubsidized" version that I simply refuse to purchase (or have purchased and returned after confirming that they will not work when locked in IOT jail where they can't talk to the internet.)
I would encourage you to partake in sharing files with your neighbor, and on the occasion you feel strongly you want to support something, get that subscription for a month or buy some merch or similar to show you really appreciate what you watched.
It's what we've come to. If buying isn't owning, piracy isn't theft. And in a market where data theft is built into the price, well... you are the one to set the price and the recipient of who you deem deserves it.
>If Amazon ever gets rid of the without ad version they will lose me as a customer overnight.
Didn't they already remove the option for a completely ad free prime video experience or am I hallucinating that? They have such a ridiculous hold on the e reader market I feel like it is just matter of the next down quarter.
They seem to own 75% of the market, and I think you can get pretty much every book on every device, right? Of course your existing library is locked-in; ideally, that'd be illegal.
Worse - they actually can remove books that you've purchased. Not only revoke license for future downloads - but actually remove them from your device.
Does it actually make a difference?
I have an old Kindle (from 2013 I think) and I opted for the ad version. I only see ads on the lock screen, which means I never really read the ads. The few times I’ve looked at them intentionally, they were books I’d never consider reading, just from the title and cover; in other words, a terrible ad for the recipient.
Does the ad-free version not collect your data too?
I don't actually care if they collect my data in that particular case. There's really nothing of significance that Amazon gets from my reading habits that it Visa doesn't already get from my purchasing the book in the first place.
I care if I see ads, even if I "don't read them". And when it comes to other devices, like IP security cameras I might care a lot more about whether the manufacturer has access to the device once it's set up.
My goal was just to point out that there is at least one existing case where you can pick between a subsidized and unsubsidized (or less subisdized if you prefer) product, and having the choice is strictly better than not having the choice.
> I don't actually care if they collect my data in that particular case. There's really nothing of significance that Amazon gets from my reading habits that it Visa doesn't already get from my purchasing the book in the first place.
Visa knows you bought a book. That's all they know. Amazon knows that you actually read the book (or didn't), how long it took you to read the book, how many times you read it, every date/time when you opened it, what specific pages you flip to and re-read later, etc. Maybe you consider that data to be "nothing of significance", but Amazon doesn't see it that way. They spend a lot of time and money collecting, storing, and analyzing that data and it isn't because they didn't think it's worth anything.
That has been the way things work since the early 2000s. PCs started to come loaded with junk malware, and what those malware makers were willing to pay was the only profit the PC makers were making. Modern smart TVs are exactly at the same place; everybody is adamant that the only profit in TVs is with the sale of the usage data.
Once again, I'm amazed some HN readers, like yourself, are unfamiliar with the basic tenets of the GDPR. (Hint: A company cannot provide a service on the condition that you provide unnecessary personal data or consent to spying)
If you work in a tech field, there is simply no reason for such ignorance.
It's adorable that you think every company actually abides by these rules. There have been class action lawsuits recently against the largest tech companies. Why wouldn't the smaller ones break the rules too?
It's akin to cheating in financial markets. Hedge funds will gladly commit fraud or other cheating methods as long as the fine is less than the income gained.
Well the article then proves clear violation of those rules. Not only is no consent or notification provided but when the secret data collection is blocked the device gets remotely disabled. Perhaps someone should file a complaint against this company and see if they get fined to death.
I do not think the value difference is $100 ;-) In fact, the longer you use it, the more money they can make off of you. (In that sense, that $200 is already WAY too expensive to start ;-) )
So yeah, reversing this would make the most sense. The default is: local data only and not connected. They need to pay me to get data.
Just like car companies, phones, etc, should be forced to do that as well.
And no, they shouldn't be allowed to set the price. If I buy a license from Steam, I can't name my price, so I don't see why these companies should either. If they want my data, then they'll either pay the money I demand or they won't get the data at all. Cutthroat, perhaps, but necessary.
It's not, things haven't gotten that much relatively cheaper (have you looked at phones? The biggest pieces of spyware you can buy?). This is a line corporations like to feed us so we feel guilty about being bad instead of putting that where it belongs: every CEO.
I haven't tried it personally because my particular model of vacuum has some complicated and potentially destructive procedure to get the required access, but there's quite a few models where it can be installed easily.
Since the robots got cameras and microphones, it's a no-go for me to have it in my home connected to some cloud.
It's little bit challenging to orient oneself in the project (tip: read a couple of the last release notes), but once you do, it's great.
I bought a new robot vacuum that was specifically recommended by the Valetudo project (Dreame L10s Pro Ultra Heat). The rooting was straightforward and non-destructive. The robot works great.
And the usage is much better even for non-developer people (i.e. my wife), as the UI is simple, not constantly changing under your hands, no ads, no upseling. It's a tool as it should be.
> ... because my particular model of vacuum has some complicated and potentially destructive procedure to get the required access
This right there is the root of the entire problem. We had IBM PC clones that you could recover and keep running for decades by easily replacing expansion cards, HDDs, RAM sticks, peripherals and even circuit components like caps, ICs and batteries. We used to partition our 50 GB HDD into a dozen little partitions and multiboot every conceivable OS out there. Now we have an oligarchic dystopia where even RAMs and batteries are soldered on and bonded with single-use resins instead of age-old screws. Even if you get through, you can't salvage or swap ICs because they're paired individually at device level. You can't reach the boot partition without a Ph.D in RevEng and a risk of still bricking the device 3 out of 4 times. And that's all for technological progress and security, they say! Those claims have as much credibility as their claims to making an honest living. It's weasel-speak, not engineering insight.
Modifying the device that you paid for should never be this complicated. Those greedy corpos are usurping the consumer's rights and wealth, plain and simple.
From my understanding (I might be wrong) the images are pre-built by the owner of the project right? I remember there being a form you fill and you receive a download link.
If that's the case what guarantees do I have there's no "funny business" on the image?
It runs entirely on LAN, ie; you just go to the vacuums IP address in a browser to control it. So you can block internet access for it if you're worried with no negative effects.
> (I have no skin in this game --- my vacuum is as dumb as they come, and can be fixed with basic machine shop tools.)
The real question is, is that still an option? If it is, then for how long? Sadly, there are several other product lines that have entirely crossed that line a while ago.
If the day ever comes where this is not an option anymore, then I will just clean my house with a broom. Same thing goes for washing machines. If I can't buy one without internet, then I will clean my clothes by hand.
Smart things are the worst shit ever. They make everything take longer, given the debugging/upgrading overhead. Not buying into that. What would be smart, would be a washing machine that cleans, dries, sorts and folds my clothes. Without talking to facebook. I would buy into that, but I don't need to share my washing machine status on instagram
> If the day ever comes where this is not an option anymore, then I will just clean my house with a broom. Same thing goes for washing machines. If I can't buy one without internet, then I will clean my clothes by hand.
Perfect! I wish a large enough section of the population took this principled stance. Those greedy corpos wouldn't be abusing their customers so much if the latter were united in denying them the market and the opportunity. Those 'smart devices' really need and deserve a lobotomy.
There's a reason the vintage appliance community exists, and is growing. Replacement parts are still available for my decades-old vacuum cleaner, and even if they weren't, they're basic electromechanical parts that I could make or substitute easily.
"From there, he built a Raspberry Pi joystick to manually drive the vacuum, proving that there was nothing wrong with the hardware."
He should make these and sell them. It would be worth it to just drive it in "discovery" mode and give it the exact path to follow while cleaning. The constant inability to learn the floor plan is beyond annoying.
Depending on where he lives this might be illegal. Yes, we live in a cyberpunk dystopia where the manufacturer can break what you bought and then send you to jail for repairing it. You can read more about it here: https://consumerrights.wiki/w/Digital_Millennium_Copyright_A...
This shit is absolutely dystopian. The law must not just be reversed, manufacturers need to be taken to court for shoddy software. Insecure data collection and transmission should be treated the same as having unsafe electrical wiring. It is a defect that needs to be either fixed or the product recalled. As long as manufacturers are not just allowed to but rewarded for selling defective products this won't change. I expect the moment unsolicited data collection becomes a liability manufacturers will drop it like a hot potato.
>>>>> I expect the moment unsolicited data collection becomes a liability manufacturers will drop it like a hot potato.
Possession of the data needs to be illegal.
Here's how it could work. It's similar to how copyrights for music are enforced. A person whose data are found in someone's files or server can sue for "statutory" damages, which are levied on a per-offense basis.
>Here's how it could work. It's similar to how copyrights for music are enforced. A person whose data are found in someone's files or server can sue for "statutory" damages, which are levied on a per-offense basis.
That's not how copyright lawsuits work though. For the typical person torrenting, it's because they were caught in the act of torrenting (eg. they had a torrent client in the swarm connecting from an ip that was assigned to them). Otherwise it's a DMCA takedown and companies don't even bother suing. Nobody is getting their hard drives searched for illegal music and getting sued as a result.
That's right. I'm not talking about copyright, but about a new restriction on possession of the data. The only parallel is the use of statutory damages as a remedy.
What are the odds individuals learn their data has been found. What kind of damages could be awarded that would make hiring a lawyer and giving them 50% of winnings a worth while effort? I could also easily see individual cases combining to become class action reducing the winnings even further.
In other words, I find this a silly suggestion as it's just never going to work in the real world.
I seem to find out my data has been leaked in a breach every other month. I don't even care if I actually get the money for it, let it go to the class action lawyers. Life is good so long as the companies pay more than they make by holding the data.
There's an exemption from Section 1201 for "Computer programs that control devices designed primarily for use by consumers for diagnosis, maintenance, or repair of the device or system".
Are you allowed to share how you repaired the software? Because if not then what I said stands, he cannot sell these little Raspberry Pis or publish information on how people can build them themselves. That's one of the problems Louis Rossmann has been talking about in regards to the FULU bounty program.
I see in the "final rule" for 2024 (PDF) a section titled "11. Computer Programs—Repairs of
Devices Designed Primarily for Use by Consumers", although it seems to indicate that nothing changed, as opposed to telling you what stayed the same.
I actually was just reading up on it yesterday because I've rooted a commercial e-ink word processor and was trying to sort out how much about the process I can legally share. The sibling post has the link to the LoC rulemakings that define the exemption categories. These exemptions are the same basis for any phone jailbreak, which makes me suspect it could be legal to publish methods as well as do it your self, but I'm still unsure.
Thankful for people like this - with kids and family and work I’d probably have had this sit bricked for a year in my garage before finding time to tinker with it. Now I can just never buy any iLife product ever.
There is a significantly easier option (although still more work than just buying a vacuum and using it as the manufacturer intended): get one of the Valetudo supported vacuums[0]. This firmware replacement blocks telemetry and allows for near complete feature parity with the original firmware, and flashing is (usually) relatively simple. Certainly much simpler than the process described here.
> I wish I had the abilities of the engineer, plus the time he could devote to the problem.
Ability is a matter of patience and persistence. And both are the results of motivation. Anyone can learn anything as long as they really want it. (barring disabilities like depression that destroy motivation. But some people use even that as an opportunity to learn new skills that in turn help them recover.) But Time is an entirely different matter. You can find time if you really want to, but life has other priorities too - including time doing nothing (rest). Finding the extra time in between all that will depend on your craftiness. That's the true skill here.
Never connected my Roomba to the internet and it has worked fine for the past several years. It insists that I should connect to it via the app to resolve the occasional minor issue, but I would always ignore those. It's starting to show its wear and it's probably time for a new vacuum. I'm not sure if I'll be able to bootstrap one without connectivity, nowadays. Any good recommendations out there?
Valetudo is the best out there. I rooted my Roborock, and connected it my home assistant. It's super useful without having to send data to the cloud. The only thing is the developers are severely limited by how many vacuums they can support. I recently bought a Dreame X50 and it's still not supported.
I wish every product like this had giant warnings on the box, in the online listing, etc.
I bought a robot vac (after owning an early roomba for some time)
- Opened it up, ready to use it
- instructions said download the app to make it work.
It's back in it's box somewhere around here and never used.
Sure, but a cleaner coming twice is the same cost of a robot vacuum that will work for a couple of years, typically. They do an okay enough job, but they need to run daily, sometimes twice a day, to really keep up considering it's limitations.
Robovacuums don't cost £150 an hour. If you buy one for £500 and run it every day for two years, you're paying ~70p per hour. Are there any cleaners who charge less than £1 per visit?
People obviously find them useful. But I will reiterate a sibling comments recommendation, get one that can run Valetudo : https://github.com/Hypfer/Valetudo
When I bought my Roomba in 2013, it cost as much total as I pay my cleaning ladies to come once every two weeks. If your floors get dirty easily, it's not really going to get them spotless, but it'll get them far cleaner than they'd otherwise be.
But the cleaners do more than the floors. Vacuuming takes me about 20 minutes once a week. I don't really see the point when I live in a 2 bed apartment.
I was surprised to discover that if you run the robot vac once a day or even every second day it significantly reduces the amount of dust that ends up on other surfaces.
You just schedule it and forget it. As everyone says it doesn't do as good of a job as you do but the main benifit is it's consistent about doing that job more frequently.
Considering some of these things can cost almost £1000. This firmly then lives in the total waste of money pile then. I will stick with my £50 tesco vacuum thank you.
I think it’s one of the most idiotic devices anyone could own. Buy a normal vacuum cleaner for half the price, spend 10 minutes a week vacuuming your apartment, and you won’t come home and find that your cleaning robot spent the afternoon choking on a shoelace.
Because it is relatively expensive, totally unnecessary and decadent and probably doesn't do a particularly good job (as people have admitted in their replies to me).
Additionally much like people ubering a McDonalds when the drive through is less than a 2 minute drive away. It actually causes additional headaches (food is more likely to come col and/or incorrect) and complications that don't exist with simply just spending a few minutes not being lazy is actually easier.
It's not the same as a full vacuum run. But it's god as what they are designed to do. Clean a bit every single day.
All the crumbs that fall down in the kitchen over a day, don't get chance to get stamped into the floor. Noticeable less dust buildup on top of counters. I come home and it's done. Mental load removed.
It's neat. And you can get them from 80 EUR. Even if they only last 5 years, that's 16 EUR per year, but saves you maybe 8h per year. Maybe it's because I live in a relative rich country, but here that is not decadent. People buy cars for 50 000 EUR :3
If getting a small vacuum out quickly is a big mental load, I dunno what to say to that. It all seems like it isn't necessary.
It is like having a smart fridge or something that produce ice-cubes for me and loads of other stupid kitchen gadgets. I didn't feel the need to have a robot vacuum cleaner in the past and I don't feel the need to have one now. Especially with all the iffy spying stuff that it might be doing.
Also any of these things that is less than 100 euros is likely to be crap. I just got rid of a lot of old electronics tat.
The cheaper ones are great, because they don't connect to an app or wifi. Mine just has a remote with a timer. Like I wrote you, mine has been going for 6 or 7 years.
I'm not trying to convince you to buy one, I'm trying to explain why you have one. Because YOU said that you don't understand it. I'm trying to explain my needs. No need to shame me.
Of all the household items i have, the robot vacuum I would certainly buy again.
Which one is that? I want one without cloud and valetudo seems like a pain. Buying an 800 dollar vacuum only to risk bricking it right away is scary. I'd buy a simple one for $80 right away though.
Hypothetically, some people who own such an idiotic device might have pets that bring in lots of dirt from the fields, lose lots of hair, and get a little bit agitated by the normal vacuum cleaner but more or less ignore the robot vacuum.
Cats aren't that bothered by vacuum cleaners unless you come at them with it and they normally just run into another room. Never seen a dog that bothered by them.
The point being made is that some people like to make much a do about nothing. Just put the dog or cat temporarily in the other room, outside and the problem is solved.
> Buy a normal vacuum cleaner for half the price, spend 10 minutes a week vacuuming your apartment
You obviously don't have a pet or a baby.
Make that 15 minutes of vacuuming AND mopping 3 times a day for a baby.
Suddenly it seems very attractive to have a clean house while not having to find the time during the baby's sleep and nap time to do it manually.
You could argue the same for a dishwasher:
I used to only use a single fork, glass and pot (eat out of the pot). A dishwasher seemed like the most idiotic device anyone could own if that's all you need to rinse every day.
Until of course you add more people to that equation...(and maybe cook more than just pasta)
I've had three babies and three dogs (fortunately not all at the same time). I've never mopped or vacuumed three times a day, I can't imagine the need for that.
Maybe our threshold for cleanliness is vastly different, or you somehow managed to produce babies don't throw half of their food on the floor after every meal (3x a day)?
But even with a magic baby and magical dogs, you mentioned only spending 10 minutes a week vacuuming. I have no idea how that is possible with babies and dogs unless your threshold for when something requires cleaning is extremely high.
Before having a robot vacuum/mop I would have to go and pick up every piece of food and wipe the floor after every meal. Sure, the whole kitchen didn't technically need a mop, but there's usually also food in other places simply through the action of cooking. We cook every meal for the baby and most meals for ourselves.
Do you just leave the food and crumbs on the floor until your weekly 10 minute vacuum?
In which case, yes, the notion of a robot vacuum must feel idiotic to you. The notion of a vacuum would also feel idiotic to me in that scenario as you can surely just use a broom and a dustpan for such a small amount of cleaning.
When smart devices started becoming common I looked at them and made the decision that it was a hard no from me - I didn't trust that they'd secure the data properly, I didn't trust the privacy aspect and I really didn't trust that they'd continue to support the product for the life of the hardware.
Here we are 10-15 years later and I see no reason to change that view in the slightest.
It surprises the none-techies I know that I don't have any smart devices in my home because they assume I would been a computer geek but its because I'm a computer geek that I don't.
My hoover is a switch connected to an electric motor, I can service it with a phillips screwdriver.
Even my TV is just a fedora box connected to a regular Samsung TV (which has never been on the network and never will).
I'm reminded of when AWS us-east-1 went down and all the beds made by EightSleep (business model: Juicero for beds) became disabled. EightSleep put all the significant control for their beds in the cloud, doubtless because they couldn't or didn't know how to hire embedded engineers, and the only devs they could find were node.js flunkies who only knew how to do cloud. Looks like the makers of this vacuum did the same thing; they didn't know how or didn't want to build just enough smarts to do the localization and mapping itself, and said "fuck it, we'll do it in the cloud".
That's awfully generous. Forcing phone-home, remote control, data harvesting features to be always-on creates a huge amount of data that can be sold for a lot of money. It gets all the wrong people excited about investing and normalizing the level of intrusion into your privacy, with some faceless corporation harvesting gigabytes of data per month from the most intimate and vulnerable physical location in nearly anyone's life.
Yes, I was thinking he needs an attorney to file suit against them for intentionally damaging his property, and then charge them for the 'repair' which would be the months he probably spent fixing it at a top grade engineering salary.
That's always a good idea, but how many people have the resources to research these details? First of all you have to be aware that this issue even exists. Then you have to scrape the corners of the internet for whether an appliance has any anti-features, because no manufacturer will ever write "collects unsolicited data about you, we will break the appliance if you refuse us your personal information" on the box. And finally you need to be able to afford the time and patience for the whole process.
I don't own a smart vacuum cleaner because the trouble is not worth it to me. However, I can see smart vacuum cleaners being very good for elderly or disabled people, or someone who has very limited free time and could let the robot clean the house on its own while the owner is out. It is really disgusting that scumbag manufacturers are exploiting those people.
The owner did not hack the vacuum, he blocked the IP address on his network for the telemetry server. Same thing tons of people do with Pi-Hole DNS blocking, for example.
There's no sane world where it is defensible to remotely brick a device because it can't communicate with a telemetry server.
> There's no sane world where it is defensible to remotely brick a device because it can't communicate with a telemetry server.
Just today: Setting up an old smartphone: "Google assistant cannot work on this device." The only choice was "back". Had to search on the internet the solution: do not connect to wi-fi.
> As the business running the servers of smart vacuums, if I saw an atypical device reporting in, without context, I too would kill that device.
If you want to block a device from accessing your servers because it's behaving in an odd way, such as this one that was contacting the update server but not the telemetry server, that's not entirely unreasonable. Sending it a command to modify its software to stop it from operating entirely is outrageous.
Why would a business have the power to decide what should and what shouldn't be homogeneous about the property of others? A transaction took place, property has legally changed hands and the former owner is exerting control over property that isn't theirs any more.
How about if the builder of your house comes into your home via an access route unknown to you, and starts rearranging where things are placed, or where you and your wife are placed, etc. in order to maintain homogeneous layout?
> How about if the builder of your house comes into your home via an access route unknown to you, and starts rearranging where things are placed, or where you and your wife are placed, etc. in order to maintain homogeneous layout?
And if you complain he kicks you and your wife out of the house you bought. And if you dare to close off the backdoor he sends you to jail.
> How about if the builder of your house comes into your home via an access route unknown to you, and starts rearranging where things are placed, or where you and your wife are placed, etc. in order to maintain homogeneous layout?
I've seen this movie. Only, the twist was that the home was built 100+ years ago and the builder long since dead. The family living in the home currently had to resort to an exorcist.
Edit to say that the sarcasm is direct rebuttal with the preposterous nature of the hypothetical.
This is a cool article, and neat he got it working in the end.
One thing that is odd - if he blocked it calling home, it doesn't make sense that the kill code was issued remotely. It makes more sense that there is a line of code internally that kills the machine when it can't call home (which would be far less malicious).
That would in many ways be even worse because it means that if the manufacturer were to go out of business all of the stuff they sold would stop working. That's more malicious, not less.
He implied they were remoting in after he blocked network traffic. It could easilyl be a standard exception handling approache when it can't call home and fetch latest settings etc. It might not be malicious - not defending the architecture, just think that there is an assumption of intent here.
Whether they remote into his device or it kills itself is irrelevant except that if it's local code that's even worse, as they've programmed in future obsolescence. That is indefensible, full stop, do not pass go.
If you sell me silverware that, unless I share my eating habits with you, automatically disintegrates, or if you break in and steal them back, what truly is the difference?
It's funny you think a vacuum automatically bricking itself if you try to prevent its connection to the mothership is at all equivalent to someone choosing to give someone silverware.
it's funny you read my comment in a way I did not write. User asked for an explanation of the difference between two fairly scenarios, so I provided one.
How has making up things that other people haven't said been working out for you?
Your comments would come off a lot better, and the conversation would be less shitty, if you'd just leave off the last sentence. It's pervasive across HN, so it's not just you, but just FYI. Just write out the whole comment, including the qwip at the end that you just can't help, and post it, and then edit the comment and delete it.
The contrast is that the vacuum isn't a sentient being, and so from there, you don't see the device reaching out, vs being told what to do, as being any different. I'm not a judge in overseeing a court case in your jurisdiction though, so no matter how much of a distinction I personally may think there is, is irrelevant.
Well, no. You can't just revoke a license.
As far as owning the software in the device, I works would argue that you do own a copy of it. I'm sure there is some buried tos claiming you just own a license to run it, and I know this is still being litigated. But when the average person purchases someone their expectation is that they've purchased it, not licensed it.
How does that work? What if the company licenses technology from company A to build product B, but the license is only good for 2 years? What happens 2 years after you buy product B?
Also doesn't Apple, Google, & other remove features from people's smartphones after release all the time in the EU?
Typo. "Feature set", referring to your comment. Functions of software. Quoted below, source is widely available.
“The notion of goods with digital elements should refer to goods that incorporate or are inter-connected with digital content or a digital service in such a way that the absence of that digital content or digital service would prevent the goods from performing their functions.” — Recital 14, Directive (EU) 2019/771.
I suspect this is not the full story. Why would someone waste their time manually disabling a device? That makes me think that this device was doing something malicous to their servers, enough to trip an alert.
> Why would someone waste their time manually disabling a device?
What what makes you think it was manual?
> That makes me think that this device was doing something malicous to their servers, enough to trip an alert.
Sounds like a them problem, and not a problem that should affect the consumer (beyond losing functionality directly tied to the server, which bricking of any kind goes far beyond)
The article said that someone from the company logged in to his device and edited a file on it to disable it. Even if it was automatic someone would manually have to write a script to login and edit a file.
> The article said that someone from the company logged in to his device and edited a file on it to disable it.
I can't find that in the article. Could you quote it?
The closest I got to finding this is:
> The manufacturer added a makeshift security protocol by omitting a crucial file, which caused it to disconnect soon after booting, but Harishankar easily bypassed it.
> deep in the logs of his non-functioning smart vacuum, he found a command with a timestamp that matched exactly the time the gadget stopped working. This was clearly a kill command
> So, why did the A11 work at the service center but refuse to run in his home? The technicians would reset the firmware on the smart vacuum, thus removing the kill code, and then connect it to an open network, making it run normally. But once it connected again to the network that had its telemetry servers blocked, it was bricked remotely because it couldn’t communicate with the manufacturer’s servers.
Which to me reads 'automatic script on the server tells device to delete file and reboot, causing it to brick', using the same kind of mechanism that an automatic firmware update would use, not 'human at company logs into device and tells it to brick'.
To "encourage" the owner to re-enable the connectivity. Google threatens to ban your Youtube account if you block ads. Companies will go out of their way to nudge, push, or force you to keep the data collection (or ads) gravy train going.
IMO a company should lose all control over technology once you've purchased it. Doesn't matter if it's "smart" or not. If the company wants to do something like telemetry, they can buy a license from you for that data. See how they like it when the tables are flipped.
Advocating regulation against dark patterns is tantamount to summoning the antichrist. All the money will run away to Galt's Gulch, or maybe Texas.
Keep telling yourself that.
Can't you trivially reframe the initial purchase as being subsidized by that license? Your $200 smart knife sharpener would be $300 if it weren't recording audio 24/7 (for VAD, surely!)
I don't like it either but here we are
Then I invite them to offer such a product. I would love to buy e.g. YouTube premium, but as far as I know they still collect my data for advertising purposes, they just don't show the ads.
I want to buy privacy, but it's not offered.
We’ve lived with companies that didn’t need to take pics of my dick while I’m shitting to subsidize their operation for as long as companies were a thing. Anyone saying this dick pic status quo is inevitable and necessary is too VC-brained to be allowed to run a company.
I think you frame it that way you need to offer the other version.
I do wonder how many people would buy non-spy versions of devices given the option. More specifically, what that differential in price would be too. At worst it would be interesting to have a price explicitly stating what our data is worth. Many people actually internalize that it's not that valuable, but doing this would make it explicit.
Its also because people don't trust companies to not spy on them, even when they say they aren't, even when you paid them not to. They still will. So if I see a offer for to pay $100 more for a vacuum that won't spy on me, I think - yeah right, you're going to spy on me AND get any extra hundred bucks.
> I do wonder how many people would buy non-spy versions of devices given the option.
Depending on the discount for the spyware version, I'd guess close to zero. The general public has become completely numb to being spied on. It's hard to get someone to give up $50 (a real cost) for something nebulous like "very slightly less of your life is known by marketing companies".
You vastly over-estimate the average ROI per user being spied on.
I'd pay for it if I could somehow know that they also deleted all the data they tracked in the past (impossible since they already sold it 100x)
It's easy to make claims like yours without the real world data. To believe that things are the way they are because that's the most efficient way. Back justification is not logical. Idk about you, but I frequently make mistakes and need to redo things. I'm pretty confident it's just because I'm human and not an omniscient god.
Also, I'd suspect it might be more than $50. We didn't create a surveillance capitalist economy with trillion dollar businesses that resulted in everything including your vacuum spying on you because your data isn't valuable. Clearly it is...
The problem more is that people don't understand how that data is used and can be used. Which I don't blame anyone for that. It's abstract and honestly sounds like the stuff of tin foil hat conspiracy theorists. But at the same time, here we are. The point of ads is to manipulate you to buy things. Which isn't always bought with money. We have several multi trillion dollar companies and I'm pretty sure they don't exist for nothing
Sure, that's basically how Kindle pricing works ($X with ads, or $X+$Y without ads) and it's infinitely better having the choice. If Amazon ever gets rid of the without ad version they will lose me as a customer overnight.
Likewise, there are a whole lot of products that don't have an "unsubsidized" version that I simply refuse to purchase (or have purchased and returned after confirming that they will not work when locked in IOT jail where they can't talk to the internet.)
> If Amazon ever gets rid of the without ad version they will lose me as a customer overnight.
A couple of years ago, I subscribed to Peacock Premium (or whatever it was called). The selling point was access to all their library.
At that time, it was ad-free.
It is now packed with ads, and they want me to upgrade to “Peacock Squeal Like A Pig,” or whatever they call it.
Instead, I just canceled my subscription, and avoid any Peacock stuff, which isn’t difficult. They don’t have much I want to see.
I have a friend who pirates everything. I have always believed in paying for my media, but it’s become such a clusterfuck, that I can sympathize.
I would encourage you to partake in sharing files with your neighbor, and on the occasion you feel strongly you want to support something, get that subscription for a month or buy some merch or similar to show you really appreciate what you watched.
It's what we've come to. If buying isn't owning, piracy isn't theft. And in a market where data theft is built into the price, well... you are the one to set the price and the recipient of who you deem deserves it.
>If Amazon ever gets rid of the without ad version they will lose me as a customer overnight.
Didn't they already remove the option for a completely ad free prime video experience or am I hallucinating that? They have such a ridiculous hold on the e reader market I feel like it is just matter of the next down quarter.
They seem to own 75% of the market, and I think you can get pretty much every book on every device, right? Of course your existing library is locked-in; ideally, that'd be illegal.
Worse - they actually can remove books that you've purchased. Not only revoke license for future downloads - but actually remove them from your device.
Ironically they did that to 1984 book.
The “good news” is you can get a refund for titles that are removed. But you have to ask for it.
Will they adjust it for "inflation" before refunding?
Does it actually make a difference? I have an old Kindle (from 2013 I think) and I opted for the ad version. I only see ads on the lock screen, which means I never really read the ads. The few times I’ve looked at them intentionally, they were books I’d never consider reading, just from the title and cover; in other words, a terrible ad for the recipient.
Does the ad-free version not collect your data too?
I don't actually care if they collect my data in that particular case. There's really nothing of significance that Amazon gets from my reading habits that it Visa doesn't already get from my purchasing the book in the first place.
I care if I see ads, even if I "don't read them". And when it comes to other devices, like IP security cameras I might care a lot more about whether the manufacturer has access to the device once it's set up.
My goal was just to point out that there is at least one existing case where you can pick between a subsidized and unsubsidized (or less subisdized if you prefer) product, and having the choice is strictly better than not having the choice.
> I don't actually care if they collect my data in that particular case. There's really nothing of significance that Amazon gets from my reading habits that it Visa doesn't already get from my purchasing the book in the first place.
Visa knows you bought a book. That's all they know. Amazon knows that you actually read the book (or didn't), how long it took you to read the book, how many times you read it, every date/time when you opened it, what specific pages you flip to and re-read later, etc. Maybe you consider that data to be "nothing of significance", but Amazon doesn't see it that way. They spend a lot of time and money collecting, storing, and analyzing that data and it isn't because they didn't think it's worth anything.
That has been the way things work since the early 2000s. PCs started to come loaded with junk malware, and what those malware makers were willing to pay was the only profit the PC makers were making. Modern smart TVs are exactly at the same place; everybody is adamant that the only profit in TVs is with the sale of the usage data.
They should be forced to present both options, and the price difference must equal the revenue they actually make from spying.
Once again, I'm amazed some HN readers, like yourself, are unfamiliar with the basic tenets of the GDPR. (Hint: A company cannot provide a service on the condition that you provide unnecessary personal data or consent to spying)
If you work in a tech field, there is simply no reason for such ignorance.
It's adorable that you think every company actually abides by these rules. There have been class action lawsuits recently against the largest tech companies. Why wouldn't the smaller ones break the rules too?
It's akin to cheating in financial markets. Hedge funds will gladly commit fraud or other cheating methods as long as the fine is less than the income gained.
Well the article then proves clear violation of those rules. Not only is no consent or notification provided but when the secret data collection is blocked the device gets remotely disabled. Perhaps someone should file a complaint against this company and see if they get fined to death.
The GDPR doesn't impact a lot of companies, if you are acting on behalf of a customer who is the actual data processor for instance.
I do not think the value difference is $100 ;-) In fact, the longer you use it, the more money they can make off of you. (In that sense, that $200 is already WAY too expensive to start ;-) )
So yeah, reversing this would make the most sense. The default is: local data only and not connected. They need to pay me to get data.
Just like car companies, phones, etc, should be forced to do that as well.
Yes. That's what my comment was getting at.
And no, they shouldn't be allowed to set the price. If I buy a license from Steam, I can't name my price, so I don't see why these companies should either. If they want my data, then they'll either pay the money I demand or they won't get the data at all. Cutthroat, perhaps, but necessary.
It's not, things haven't gotten that much relatively cheaper (have you looked at phones? The biggest pieces of spyware you can buy?). This is a line corporations like to feed us so we feel guilty about being bad instead of putting that where it belongs: every CEO.
Yes, but then it should be sold as such.
If you're buying a service and not a product, then the consumer has a right to know!
This could be the sort of thing that a Nielsen takes care of, just like viewing data for TV.
... a Liam Nielsen with a particular set of skills?
Previous post
https://news.ycombinator.com/item?id=45503560
which points to the actual blog of the author on github, instead of a news coverage of it.
A good time to point out https://github.com/Hypfer/Valetudo.
I haven't tried it personally because my particular model of vacuum has some complicated and potentially destructive procedure to get the required access, but there's quite a few models where it can be installed easily.
I am super happy with Valetudo.
Since the robots got cameras and microphones, it's a no-go for me to have it in my home connected to some cloud.
It's little bit challenging to orient oneself in the project (tip: read a couple of the last release notes), but once you do, it's great.
I bought a new robot vacuum that was specifically recommended by the Valetudo project (Dreame L10s Pro Ultra Heat). The rooting was straightforward and non-destructive. The robot works great.
And the usage is much better even for non-developer people (i.e. my wife), as the UI is simple, not constantly changing under your hands, no ads, no upseling. It's a tool as it should be.
> ... because my particular model of vacuum has some complicated and potentially destructive procedure to get the required access
This right there is the root of the entire problem. We had IBM PC clones that you could recover and keep running for decades by easily replacing expansion cards, HDDs, RAM sticks, peripherals and even circuit components like caps, ICs and batteries. We used to partition our 50 GB HDD into a dozen little partitions and multiboot every conceivable OS out there. Now we have an oligarchic dystopia where even RAMs and batteries are soldered on and bonded with single-use resins instead of age-old screws. Even if you get through, you can't salvage or swap ICs because they're paired individually at device level. You can't reach the boot partition without a Ph.D in RevEng and a risk of still bricking the device 3 out of 4 times. And that's all for technological progress and security, they say! Those claims have as much credibility as their claims to making an honest living. It's weasel-speak, not engineering insight.
Modifying the device that you paid for should never be this complicated. Those greedy corpos are usurping the consumer's rights and wealth, plain and simple.
Recently discussed: https://news.ycombinator.com/item?id=45642571
From my understanding (I might be wrong) the images are pre-built by the owner of the project right? I remember there being a form you fill and you receive a download link.
If that's the case what guarantees do I have there's no "funny business" on the image?
It runs entirely on LAN, ie; you just go to the vacuums IP address in a browser to control it. So you can block internet access for it if you're worried with no negative effects.
You can then cut the robot off the internet completely.
Which you cant do with the 1st party apps. This alone is enough for me.
The private builder is not great, but the reason are understandable, it is what it is.
I have it on two of my Roborocks and it rocks.
First of all, it's Android Debug Bridge, which gives him full root access to the vacuum, wasn't protected by any kind of password or encryption.
Good. You bought it, you own it.
(I have no skin in this game --- my vacuum is as dumb as they come, and can be fixed with basic machine shop tools.)
> (I have no skin in this game --- my vacuum is as dumb as they come, and can be fixed with basic machine shop tools.)
The real question is, is that still an option? If it is, then for how long? Sadly, there are several other product lines that have entirely crossed that line a while ago.
If the day ever comes where this is not an option anymore, then I will just clean my house with a broom. Same thing goes for washing machines. If I can't buy one without internet, then I will clean my clothes by hand.
Smart things are the worst shit ever. They make everything take longer, given the debugging/upgrading overhead. Not buying into that. What would be smart, would be a washing machine that cleans, dries, sorts and folds my clothes. Without talking to facebook. I would buy into that, but I don't need to share my washing machine status on instagram
> If the day ever comes where this is not an option anymore, then I will just clean my house with a broom. Same thing goes for washing machines. If I can't buy one without internet, then I will clean my clothes by hand.
Perfect! I wish a large enough section of the population took this principled stance. Those greedy corpos wouldn't be abusing their customers so much if the latter were united in denying them the market and the opportunity. Those 'smart devices' really need and deserve a lobotomy.
There's a reason the vintage appliance community exists, and is growing. Replacement parts are still available for my decades-old vacuum cleaner, and even if they weren't, they're basic electromechanical parts that I could make or substitute easily.
"From there, he built a Raspberry Pi joystick to manually drive the vacuum, proving that there was nothing wrong with the hardware."
He should make these and sell them. It would be worth it to just drive it in "discovery" mode and give it the exact path to follow while cleaning. The constant inability to learn the floor plan is beyond annoying.
Depending on where he lives this might be illegal. Yes, we live in a cyberpunk dystopia where the manufacturer can break what you bought and then send you to jail for repairing it. You can read more about it here: https://consumerrights.wiki/w/Digital_Millennium_Copyright_A...
This shit is absolutely dystopian. The law must not just be reversed, manufacturers need to be taken to court for shoddy software. Insecure data collection and transmission should be treated the same as having unsafe electrical wiring. It is a defect that needs to be either fixed or the product recalled. As long as manufacturers are not just allowed to but rewarded for selling defective products this won't change. I expect the moment unsolicited data collection becomes a liability manufacturers will drop it like a hot potato.
>>>>> I expect the moment unsolicited data collection becomes a liability manufacturers will drop it like a hot potato.
Possession of the data needs to be illegal.
Here's how it could work. It's similar to how copyrights for music are enforced. A person whose data are found in someone's files or server can sue for "statutory" damages, which are levied on a per-offense basis.
>Here's how it could work. It's similar to how copyrights for music are enforced. A person whose data are found in someone's files or server can sue for "statutory" damages, which are levied on a per-offense basis.
That's not how copyright lawsuits work though. For the typical person torrenting, it's because they were caught in the act of torrenting (eg. they had a torrent client in the swarm connecting from an ip that was assigned to them). Otherwise it's a DMCA takedown and companies don't even bother suing. Nobody is getting their hard drives searched for illegal music and getting sued as a result.
That's right. I'm not talking about copyright, but about a new restriction on possession of the data. The only parallel is the use of statutory damages as a remedy.
What are the odds individuals learn their data has been found. What kind of damages could be awarded that would make hiring a lawyer and giving them 50% of winnings a worth while effort? I could also easily see individual cases combining to become class action reducing the winnings even further.
In other words, I find this a silly suggestion as it's just never going to work in the real world.
I seem to find out my data has been leaked in a breach every other month. I don't even care if I actually get the money for it, let it go to the class action lawyers. Life is good so long as the companies pay more than they make by holding the data.
There's an exemption from Section 1201 for "Computer programs that control devices designed primarily for use by consumers for diagnosis, maintenance, or repair of the device or system".
Are you allowed to share how you repaired the software? Because if not then what I said stands, he cannot sell these little Raspberry Pis or publish information on how people can build them themselves. That's one of the problems Louis Rossmann has been talking about in regards to the FULU bounty program.
https://bounties.fulu.org/
That's news to me. Do you have a source for that I can look at? Not being snarky. I would legitimately like to read more about this.
Probably refers to regulatory exceptions that aren't in the statue directly, which are updated every 3 years:
https://www.copyright.gov/1201/2024/
I see in the "final rule" for 2024 (PDF) a section titled "11. Computer Programs—Repairs of Devices Designed Primarily for Use by Consumers", although it seems to indicate that nothing changed, as opposed to telling you what stayed the same.
I actually was just reading up on it yesterday because I've rooted a commercial e-ink word processor and was trying to sort out how much about the process I can legally share. The sibling post has the link to the LoC rulemakings that define the exemption categories. These exemptions are the same basis for any phone jailbreak, which makes me suspect it could be legal to publish methods as well as do it your self, but I'm still unsure.
This is why lidar based robot vacuums are superior over random walk vacuums.
That’s a fantastic idea. The blind bumbling has always irritated me too.
I wish I had the abilities of the engineer, plus the time he could devote to the problem.
Thankful for people like this - with kids and family and work I’d probably have had this sit bricked for a year in my garage before finding time to tinker with it. Now I can just never buy any iLife product ever.
We should probably update this story to link directly to the hackers blog, they deserve the credit! https://codetiger.github.io/blog/the-day-my-smart-vacuum-tur...
There is a significantly easier option (although still more work than just buying a vacuum and using it as the manufacturer intended): get one of the Valetudo supported vacuums[0]. This firmware replacement blocks telemetry and allows for near complete feature parity with the original firmware, and flashing is (usually) relatively simple. Certainly much simpler than the process described here.
[0] https://valetudo.cloud/pages/general/supported-robots.html
> I wish I had the abilities of the engineer, plus the time he could devote to the problem.
Ability is a matter of patience and persistence. And both are the results of motivation. Anyone can learn anything as long as they really want it. (barring disabilities like depression that destroy motivation. But some people use even that as an opportunity to learn new skills that in turn help them recover.) But Time is an entirely different matter. You can find time if you really want to, but life has other priorities too - including time doing nothing (rest). Finding the extra time in between all that will depend on your craftiness. That's the true skill here.
Never connected my Roomba to the internet and it has worked fine for the past several years. It insists that I should connect to it via the app to resolve the occasional minor issue, but I would always ignore those. It's starting to show its wear and it's probably time for a new vacuum. I'm not sure if I'll be able to bootstrap one without connectivity, nowadays. Any good recommendations out there?
You might be interested in this project https://valetudo.cloud/
They have a list of supported vacuums
Valetudo is the best out there. I rooted my Roborock, and connected it my home assistant. It's super useful without having to send data to the cloud. The only thing is the developers are severely limited by how many vacuums they can support. I recently bought a Dreame X50 and it's still not supported.
Buy a used one the same as your current one. Find one with little use and you’ll be good for many more years.
I wish every product like this had giant warnings on the box, in the online listing, etc.
I bought a robot vac (after owning an early roomba for some time) - Opened it up, ready to use it - instructions said download the app to make it work.
It's back in it's box somewhere around here and never used.
Whenever I read about robovac. I wonder gow good are these robot vacs really?
Maybe it is just me, but surely would be less effort to hire a cleaner and they can do more than just vacuuming.
Sure, but a cleaner coming twice is the same cost of a robot vacuum that will work for a couple of years, typically. They do an okay enough job, but they need to run daily, sometimes twice a day, to really keep up considering it's limitations.
It really depends on how big your properties is. A cleaner here could be done in less than an hour and there is no cleaner charging £150 an hour.
What math are you doing here?
Robovacuums don't cost £150 an hour. If you buy one for £500 and run it every day for two years, you're paying ~70p per hour. Are there any cleaners who charge less than £1 per visit?
I was being hyperbolic because people seem to be overstating the cost of a cleaner.
I used to pay my Spainish cleaners about €20 euros a week for two cleaners. Granted that was while ago, but it was peanuts.
Also I'd rather have cleaner do it properly, than by a robovac that (as everyone says on the sibling comments) does half a job.
Children are free
In what universe?
People obviously find them useful. But I will reiterate a sibling comments recommendation, get one that can run Valetudo : https://github.com/Hypfer/Valetudo
I am not interested in getting one at all.
When I bought my Roomba in 2013, it cost as much total as I pay my cleaning ladies to come once every two weeks. If your floors get dirty easily, it's not really going to get them spotless, but it'll get them far cleaner than they'd otherwise be.
But the cleaners do more than the floors. Vacuuming takes me about 20 minutes once a week. I don't really see the point when I live in a 2 bed apartment.
I was surprised to discover that if you run the robot vac once a day or even every second day it significantly reduces the amount of dust that ends up on other surfaces.
You just schedule it and forget it. As everyone says it doesn't do as good of a job as you do but the main benifit is it's consistent about doing that job more frequently.
If 20 minutes is all you need once a week, yeah it maybe doesnt make sense for you.
I have a dog and need to vacuum at least once a day, currently.
Without a robot vacuum, Id go crazy.
Ok fair enough.
> I don't really see the point.
You save the 20 minutes once a week.
That's it. That is the whole point. A slight convenience. I use one in a 1 bedroom apartment.
Considering some of these things can cost almost £1000. This firmly then lives in the total waste of money pile then. I will stick with my £50 tesco vacuum thank you.
I bought mine about 6 years ago for 200 EUR then. Still works. Had to switch the battery once.
I think it’s one of the most idiotic devices anyone could own. Buy a normal vacuum cleaner for half the price, spend 10 minutes a week vacuuming your apartment, and you won’t come home and find that your cleaning robot spent the afternoon choking on a shoelace.
But what if I'm too lazy to vacuum 10 minutes a week and don't want to do it?
You could change your attitude. A vacuum cleaner is already a labour saving device
So could you. You're already using one labour saving device, why not another?
Because it is relatively expensive, totally unnecessary and decadent and probably doesn't do a particularly good job (as people have admitted in their replies to me).
Additionally much like people ubering a McDonalds when the drive through is less than a 2 minute drive away. It actually causes additional headaches (food is more likely to come col and/or incorrect) and complications that don't exist with simply just spending a few minutes not being lazy is actually easier.
> probably doesn't do a particularly good job
It's not the same as a full vacuum run. But it's god as what they are designed to do. Clean a bit every single day.
All the crumbs that fall down in the kitchen over a day, don't get chance to get stamped into the floor. Noticeable less dust buildup on top of counters. I come home and it's done. Mental load removed.
It's neat. And you can get them from 80 EUR. Even if they only last 5 years, that's 16 EUR per year, but saves you maybe 8h per year. Maybe it's because I live in a relative rich country, but here that is not decadent. People buy cars for 50 000 EUR :3
If getting a small vacuum out quickly is a big mental load, I dunno what to say to that. It all seems like it isn't necessary.
It is like having a smart fridge or something that produce ice-cubes for me and loads of other stupid kitchen gadgets. I didn't feel the need to have a robot vacuum cleaner in the past and I don't feel the need to have one now. Especially with all the iffy spying stuff that it might be doing.
Also any of these things that is less than 100 euros is likely to be crap. I just got rid of a lot of old electronics tat.
The cheaper ones are great, because they don't connect to an app or wifi. Mine just has a remote with a timer. Like I wrote you, mine has been going for 6 or 7 years.
I'm not trying to convince you to buy one, I'm trying to explain why you have one. Because YOU said that you don't understand it. I'm trying to explain my needs. No need to shame me.
Of all the household items i have, the robot vacuum I would certainly buy again.
Which one is that? I want one without cloud and valetudo seems like a pain. Buying an 800 dollar vacuum only to risk bricking it right away is scary. I'd buy a simple one for $80 right away though.
Mine is probably not for sell any more. It's from Eufy. No camera, thus no carpet detection.
As I said. I am not interested in any of this. I am glad you find it useful, but I have the level of technology I am comfortable with.
> "most idiotic devices anyone could own"
Ever been to Chesterton's Fence?
Hypothetically, some people who own such an idiotic device might have pets that bring in lots of dirt from the fields, lose lots of hair, and get a little bit agitated by the normal vacuum cleaner but more or less ignore the robot vacuum.
Cats aren't that bothered by vacuum cleaners unless you come at them with it and they normally just run into another room. Never seen a dog that bothered by them.
Oh, well if you’ve never seen one…
The point being made is that some people like to make much a do about nothing. Just put the dog or cat temporarily in the other room, outside and the problem is solved.
> Buy a normal vacuum cleaner for half the price, spend 10 minutes a week vacuuming your apartment
You obviously don't have a pet or a baby.
Make that 15 minutes of vacuuming AND mopping 3 times a day for a baby. Suddenly it seems very attractive to have a clean house while not having to find the time during the baby's sleep and nap time to do it manually.
You could argue the same for a dishwasher: I used to only use a single fork, glass and pot (eat out of the pot). A dishwasher seemed like the most idiotic device anyone could own if that's all you need to rinse every day. Until of course you add more people to that equation...(and maybe cook more than just pasta)
I've had three babies and three dogs (fortunately not all at the same time). I've never mopped or vacuumed three times a day, I can't imagine the need for that.
Maybe our threshold for cleanliness is vastly different, or you somehow managed to produce babies don't throw half of their food on the floor after every meal (3x a day)?
But even with a magic baby and magical dogs, you mentioned only spending 10 minutes a week vacuuming. I have no idea how that is possible with babies and dogs unless your threshold for when something requires cleaning is extremely high.
Before having a robot vacuum/mop I would have to go and pick up every piece of food and wipe the floor after every meal. Sure, the whole kitchen didn't technically need a mop, but there's usually also food in other places simply through the action of cooking. We cook every meal for the baby and most meals for ourselves.
Do you just leave the food and crumbs on the floor until your weekly 10 minute vacuum? In which case, yes, the notion of a robot vacuum must feel idiotic to you. The notion of a vacuum would also feel idiotic to me in that scenario as you can surely just use a broom and a dustpan for such a small amount of cleaning.
When smart devices started becoming common I looked at them and made the decision that it was a hard no from me - I didn't trust that they'd secure the data properly, I didn't trust the privacy aspect and I really didn't trust that they'd continue to support the product for the life of the hardware.
Here we are 10-15 years later and I see no reason to change that view in the slightest.
It surprises the none-techies I know that I don't have any smart devices in my home because they assume I would been a computer geek but its because I'm a computer geek that I don't.
My hoover is a switch connected to an electric motor, I can service it with a phillips screwdriver.
Even my TV is just a fedora box connected to a regular Samsung TV (which has never been on the network and never will).
Thanks for sharing. Removed this company from my list.
Wouldn't a blacklist make more sense than a whitelist?
These days? Probably not.
Probably a felony under the DMCA.
I'm reminded of when AWS us-east-1 went down and all the beds made by EightSleep (business model: Juicero for beds) became disabled. EightSleep put all the significant control for their beds in the cloud, doubtless because they couldn't or didn't know how to hire embedded engineers, and the only devs they could find were node.js flunkies who only knew how to do cloud. Looks like the makers of this vacuum did the same thing; they didn't know how or didn't want to build just enough smarts to do the localization and mapping itself, and said "fuck it, we'll do it in the cloud".
That's awfully generous. Forcing phone-home, remote control, data harvesting features to be always-on creates a huge amount of data that can be sold for a lot of money. It gets all the wrong people excited about investing and normalizing the level of intrusion into your privacy, with some faceless corporation harvesting gigabytes of data per month from the most intimate and vulnerable physical location in nearly anyone's life.
"Never attribute to incompetence that which can be attributed to malice" or something.
Clearly automatic beds have some degree of embedded software. The decision to put the controls in the cloud was certainly a conscious one.
> "Never attribute to incompetence that which can be attributed to malice" or something.
Isn't that the inverse of the Hanlon's razor? But I agree - the Occam's razor says that the inverse Hanlon's razor is most likely the case here.
And what the company did is a felony under CFAA.
Yes, I was thinking he needs an attorney to file suit against them for intentionally damaging his property, and then charge them for the 'repair' which would be the months he probably spent fixing it at a top grade engineering salary.
How did we let things get to this point? (A rhetorical question.)
I block this nonsense before it gets to the cash register.
That's always a good idea, but how many people have the resources to research these details? First of all you have to be aware that this issue even exists. Then you have to scrape the corners of the internet for whether an appliance has any anti-features, because no manufacturer will ever write "collects unsolicited data about you, we will break the appliance if you refuse us your personal information" on the box. And finally you need to be able to afford the time and patience for the whole process.
I don't own a smart vacuum cleaner because the trouble is not worth it to me. However, I can see smart vacuum cleaners being very good for elderly or disabled people, or someone who has very limited free time and could let the robot clean the house on its own while the owner is out. It is really disgusting that scumbag manufacturers are exploiting those people.
The simplest way is to just not buy any IoT devices.
I don't. I take it home, open the package and return it as defective.
You see the same everywhere. Lawnmowers even. A goat is more user friendly.
[dead]
[flagged]
The owner did not hack the vacuum, he blocked the IP address on his network for the telemetry server. Same thing tons of people do with Pi-Hole DNS blocking, for example.
There's no sane world where it is defensible to remotely brick a device because it can't communicate with a telemetry server.
> There's no sane world where it is defensible to remotely brick a device because it can't communicate with a telemetry server.
Just today: Setting up an old smartphone: "Google assistant cannot work on this device." The only choice was "back". Had to search on the internet the solution: do not connect to wi-fi.
Not just devices. Same for apps. If you block the live monitoring features of some crash accumulators apps will not function. (Looking at you dexcom)
> As the business running the servers of smart vacuums, if I saw an atypical device reporting in, without context, I too would kill that device.
If you want to block a device from accessing your servers because it's behaving in an odd way, such as this one that was contacting the update server but not the telemetry server, that's not entirely unreasonable. Sending it a command to modify its software to stop it from operating entirely is outrageous.
> Why would they not be homogenous?
Why would a business have the power to decide what should and what shouldn't be homogeneous about the property of others? A transaction took place, property has legally changed hands and the former owner is exerting control over property that isn't theirs any more.
How about if the builder of your house comes into your home via an access route unknown to you, and starts rearranging where things are placed, or where you and your wife are placed, etc. in order to maintain homogeneous layout?
> How about if the builder of your house comes into your home via an access route unknown to you, and starts rearranging where things are placed, or where you and your wife are placed, etc. in order to maintain homogeneous layout?
And if you complain he kicks you and your wife out of the house you bought. And if you dare to close off the backdoor he sends you to jail.
> How about if the builder of your house comes into your home via an access route unknown to you, and starts rearranging where things are placed, or where you and your wife are placed, etc. in order to maintain homogeneous layout?
I've seen this movie. Only, the twist was that the home was built 100+ years ago and the builder long since dead. The family living in the home currently had to resort to an exorcist.
Edit to say that the sarcasm is direct rebuttal with the preposterous nature of the hypothetical.
This is a cool article, and neat he got it working in the end.
One thing that is odd - if he blocked it calling home, it doesn't make sense that the kill code was issued remotely. It makes more sense that there is a line of code internally that kills the machine when it can't call home (which would be far less malicious).
That would in many ways be even worse because it means that if the manufacturer were to go out of business all of the stuff they sold would stop working. That's more malicious, not less.
> It makes more sense that there is a line of code internally that kills the machine when it can't call home (which would be far less malicious).
Would it be? Whether the line of code is on the server or the device, what's the difference?
He implied they were remoting in after he blocked network traffic. It could easilyl be a standard exception handling approache when it can't call home and fetch latest settings etc. It might not be malicious - not defending the architecture, just think that there is an assumption of intent here.
Whether they remote into his device or it kills itself is irrelevant except that if it's local code that's even worse, as they've programmed in future obsolescence. That is indefensible, full stop, do not pass go.
If you bring me your silverware from the kitchen, or I go into your house to take it, what's the difference?
(CFAA charges)
If you sell me silverware that, unless I share my eating habits with you, automatically disintegrates, or if you break in and steal them back, what truly is the difference?
It's funny you think a vacuum automatically bricking itself if you try to prevent its connection to the mothership is at all equivalent to someone choosing to give someone silverware.
it's funny you read my comment in a way I did not write. User asked for an explanation of the difference between two fairly scenarios, so I provided one.
How has making up things that other people haven't said been working out for you?
And yet you're unable to vocalize the contrast in my interpretation and your message, because I interpreted it exactly as you intended for it to be.
How's that backpedaling working out for you?
Your comments would come off a lot better, and the conversation would be less shitty, if you'd just leave off the last sentence. It's pervasive across HN, so it's not just you, but just FYI. Just write out the whole comment, including the qwip at the end that you just can't help, and post it, and then edit the comment and delete it.
The contrast is that the vacuum isn't a sentient being, and so from there, you don't see the device reaching out, vs being told what to do, as being any different. I'm not a judge in overseeing a court case in your jurisdiction though, so no matter how much of a distinction I personally may think there is, is irrelevant.
The last sentence of my comment was a parodic reversal of the last sentence of your previous comment.
The business has no right to remotely kill a device purchased by an end user.
Yeah! Just degrade the battery life and user experience through forced updates so they are pushed to upgrade instead!
Did you accept the EULA?
Consumer law comes above the EULA. A clause which states the company can remotely brick your hardware should be rendered invalid.
OK, no _moral_ right. They could probably stick a clause in there about the vacuum eating my pets for nourishment, but...
And now you've lost the plot or jumped the shark depending on which side of the pond you're on.
The point is it's good to complain
Only sane comment in this thread
You don't own the software on the device, they do. If they choose to revoke that license, that is their choice.
Well, no. You can't just revoke a license. As far as owning the software in the device, I works would argue that you do own a copy of it. I'm sure there is some buried tos claiming you just own a license to run it, and I know this is still being litigated. But when the average person purchases someone their expectation is that they've purchased it, not licensed it.
I own the device and all of its storage. The exact state of that storage is my business and precisely no one else's.
You can own as many storage devices as you wish, it doesn't give you the right to make copies of others works and use them without license.
In EU you have the right to use bundled software as long as you own the appliance. Not sure this is true for US.
How does that work? What if the company licenses technology from company A to build product B, but the license is only good for 2 years? What happens 2 years after you buy product B?
Also doesn't Apple, Google, & other remove features from people's smartphones after release all the time in the EU?
This is not legal to sell a finished product which has a license time bomb, I suppose.
Google and Apple can change the future set but they do not brick the device which was discussed and it works as advertised at the moment of purchase.
What is the "future set" ?
Typo. "Feature set", referring to your comment. Functions of software. Quoted below, source is widely available.
“The notion of goods with digital elements should refer to goods that incorporate or are inter-connected with digital content or a digital service in such a way that the absence of that digital content or digital service would prevent the goods from performing their functions.” — Recital 14, Directive (EU) 2019/771.
Does low-effort rage-bait belong on HN? aka, are you f**ing kidding?
Sounds like the "remote kill switch" was probably "log buffer was full", given that it comes back to life when used on a different network.
I suspect this is not the full story. Why would someone waste their time manually disabling a device? That makes me think that this device was doing something malicous to their servers, enough to trip an alert.
> Why would someone waste their time manually disabling a device?
What what makes you think it was manual?
> That makes me think that this device was doing something malicous to their servers, enough to trip an alert.
Sounds like a them problem, and not a problem that should affect the consumer (beyond losing functionality directly tied to the server, which bricking of any kind goes far beyond)
>What what makes you think it was manual?
The article said that someone from the company logged in to his device and edited a file on it to disable it. Even if it was automatic someone would manually have to write a script to login and edit a file.
> The article said that someone from the company logged in to his device and edited a file on it to disable it.
I can't find that in the article. Could you quote it?
The closest I got to finding this is:
> The manufacturer added a makeshift security protocol by omitting a crucial file, which caused it to disconnect soon after booting, but Harishankar easily bypassed it.
> deep in the logs of his non-functioning smart vacuum, he found a command with a timestamp that matched exactly the time the gadget stopped working. This was clearly a kill command
> So, why did the A11 work at the service center but refuse to run in his home? The technicians would reset the firmware on the smart vacuum, thus removing the kill code, and then connect it to an open network, making it run normally. But once it connected again to the network that had its telemetry servers blocked, it was bricked remotely because it couldn’t communicate with the manufacturer’s servers.
Which to me reads 'automatic script on the server tells device to delete file and reboot, causing it to brick', using the same kind of mechanism that an automatic firmware update would use, not 'human at company logs into device and tells it to brick'.
To "encourage" the owner to re-enable the connectivity. Google threatens to ban your Youtube account if you block ads. Companies will go out of their way to nudge, push, or force you to keep the data collection (or ads) gravy train going.
Not really. They probably flagged this as someone modifying the device and thought it could be someone reverse engineering it.
Might just be a "could not contact server for X days in a row" thing.