User accidentally gains control of over 6,700 robot vacuums while tinkering with their own device to enable control with a PlayStation controller
2026-02-24 09:47 UTC
Replies (17)
-
@Deceptichum@quokk.au 2026-02-24 10:23
-
@suodrazah@lemmy.world 2026-02-24 09:55
"AI Strategist"
-
@ExLisper@lemmy.curiana.net 2026-02-24 13:10
You don't have to be smart to use a broom but you have to be stupid to buy a vacuum with microphone and camera.
-
@NewNewAugustEast@lemmy.zip 2026-02-24 18:41
Shame they didn't get access to the analytics. It would be very interesting to see the extent these data collected are used. For instance, training voice AI on customer data. Or voice printing to make a location map of users and selling that data. Or customizing ads that show up on their devices based on what's in the home, etc etc
-
@Bazell@lemmy.zip 2026-02-24 12:59
I have some suggestions about how their security engineer's routine looks like: 
-
@Chick0nPlayz@lemmy.world 2026-02-24 17:34
That's a tuff number boiii
-
@mcv@lemmy.zip 2026-02-25 15:53
Why are they collecting this data in the first place? You can't mishandle data you don't have. The fact that remote access to video is even possible, is very alarming.
-
@Ranulph@thelemmy.club 2026-02-24 10:24
Its a pretty good example of things you can do with Claude.
-
@Semi_Hemi_Demigod@lemmy.world 2026-02-24 13:57
A lot of times encryption “at rest” is just encrypting the partition the DB is sitting on. There are options for encrypting the database when it’s in use, but if you don’t set up the right access controls the on-the-fly decryption can have it show up as plaintext. The best option for this is to do the decryption/encryption in the application, so even if they get the DB credentials for the app user it’s still encrypted. One disadvantage is that you can’t do searches in the DB anymore. Of course, all of these are in increasing level of difficulty and adding them after the fact becomes a more daunting task the longer you put it off.
-
@derpgon@programming.dev 2026-02-24 18:43
> What's the point in encrypting user data in transit if you're just gonna leave it unencrypted at rest?? Basic HTTPS does the trick of encrypting transfer, easy as fuck to set up, does not mean the app is any more secure tho. Database encryption is usually not necessary if it is kept on a private network. Setting up sensible auth is usually enough. They kept some doors unlocked, tho.
-
@XeroxCool@lemmy.world 2026-02-24 18:29
> Did they build it though? Sounds like vibe-coding to me For all my gripes with AI/LLM and stolen valor-type misrepresentation, I'm not going to put too many asterisks on someone's personal project. Especially when it exposes shady corporate practice. It doesn't seem like they were professionally hired to create this app. There's plenty of tinkerers I follow that phone a friend to get a project back on track. But I have no idea what his day job is, being an AI Strategist
-
@postmateDumbass@lemmy.world 2026-02-24 17:27
This code uses truly global varriables.
-
@Landless2029@lemmy.world 2026-02-24 19:02
Security? How much? No. Skip it.
-
@FauxLiving@lemmy.world 2026-02-24 16:38
> Did they build it though? Sounds like vibe-coding to me Did you type that sentence though? It looks like keyboard manipulation to me
-
@FauxLiving@lemmy.world 2026-02-24 17:38
In the same spirit of pointless gatekeeping. You only pressed the buttons. That's hardly any of the work required for your text to show up on all of our computers. You didn't translate the pulses from your key switches into USB signals, or write the kernel code which translated those inputs into scancodes, or write the browser code which displayed the form box that packaged your text into an HTTP POST request. None of your work went into the firmware on the routers which carried your data and you didn't do a bit of work burying the cables between those routers. I haven't check but I'm pretty sure you're not a datacenter employee in Finland so you don't contribute to the labor required to manage the servers, you probably don't contribute to the Lemmy project or Mozilla/Chromium projects. Your post is the result of a huge amount of tools, services in infrastructure that you had no hand in inventing, deploying or maintaining. All you did was provide a few grams of force to some thermoplastic and sparked a few neurons.
-
@FauxLiving@lemmy.world 2026-02-25 15:33
I'm sorry that you read that as an actual literal argument instead of a satire comment
-
@Th4tGuyII@fedia.io 2026-02-24 12:12
> tinkerer built an app to control their own device with a PlayStation controller. > who used Claude Code to reverse engineer the protocol Did they build it though? Sounds like vibe-coding to me ---- > the problem does not lie in the encryption used by the robot vacuum when communicating with its server, but that all the data is stored in plain text and can easily be read by anyone who gains access to the server. Having said that, this is atrocious! What's the point in encrypting user data in transit if you're just gonna leave it unencrypted at rest?? If you're going to store user data, at least have the decency to make sure its protected against malicious actors. It's very lucky that the person who discovered it was a vibe-coding good Samaritan, rather than somebody willing to exploit it for money