It cites sources including KhiCAS at the end of the page.
In college they have a docking station for calculators that used the two metal tabs on any “permitted for use on tests” model that locks them into secure testing mode for the duration, which would inhibit access to the program menu. Unsure if lower ed schools have these but TI’s been in the monopoly long enough to have propagated them, and this exact thing is 100% of why they’re so hostile about patching the OS to disallow usermods and machine code: their monopoly’s benefit to customers is that they fight modders. I suspect those school docks also force a firmware update, but haven’t verified as it’s quite expensive an object to brick and risky to my education to find out.
I look forward to seeing whether the predicted GTA6 (at price ~$100) spike occurs next month, as that will help distinguish between ‘spending power decrease’ (if the trend is not reversed) and ‘cost-value decrease’ (console pricing is too high for perceived value).
I’d love if my blouses were on their twentieth iteration without decaying quality every year for two decades like the clothes market has done recently; so, yes, we absolutely can benefit from such investment. Uniqlo is the only instance I know of a new clothes retailer publishing release notes for their iterations, so I know it’s possible and profitable, but it’s just extraordinarily rare in any segment — whether the emperor’s phone, or the emperor’s clothes.
Oh I hate this so much. Spend months trying to find a good, well made tshirt that’s out of a good quality fabric. Find one and a month or two later (after you’re sure of the quality) order a few more. Nope! Pattern is different, fabric is worse quality. Start the cycle again.
I truly hate their site animations but once you focus through the hot mess of flashiness, they itemize specific customer feedback quotes and specific changes to the product, and they have posted hundreds of these over time. (Linking to AU copy of site since US emits a tempfail.)
This is really cool. It gives each item a "narrative" and it allows the user to be "involved" in the design process. I have never seen an outfit (in all senses of the word) do that.-
Given how often HN trends to the frontpage “rage for views” posts that link to GitHub issues where the submitter dislikes the current outcome, this three-word argument against the post is uniquely unpersuasive here. This US foods practice is a worthwhile topic to rage about given the severity of public health impact of the mislabeling alone, and it’s an easily-solved problem when regulators aren’t captured.
> You must mention the quantity (by percentage) of any ingredients that: appear in the name of the product (example: ‘apple pie')
[; or] are emphasised on the labelling in words, pictures or graphics (example: ‘with walnuts')[; or] are essential to characterise the food and to distinguish it from other foods[.]
This would be rather interesting, I've noticed whenever a product is "with ___" [insert hot substance or ingredient], its almost always near the very end of the ingredients list, meaning its among the lowest in amounts of ingredients used in the product
Yes, it’s generally bad to have a high percentage of capsaicin, but it’s still a figure worth noting :) I would encourage in that scenario specifying the % and then also the estimated scovilles total.
The editor’s summary of the linked paper may be of more use:
> The ability to cool levitated nanoparticles to ultralow temperatures for accessing mechanical quantum states of the system provides a platform for probing fundamental physics. Deplano et al. demonstrated the generation of entanglement between a macroscopic mechanical oscillator and a freely propagating optical field. Such optomechanical entanglement at room temperature involving a levitated nanoparticle and a propagating optical mode and could also be used to develop quantum sensing technologies.
I think part of this is simply “no one has ever previously mechanically linked a classical-scale object to quantum-scale entanglement” and they managed to do so, which is pretty cool. To construct a theoretical idea as analogy of sorts: Imagine a supercooled fiberoptic link where the two transceivers both fire a laser at a liquid nitrogen hose filled with glass beads, and so packets end up sent by the tranmissions vibrating the suspended nanospheres entangled with both transceivers which can be sensed instantaneously by the receiver since they’re quantum-mechanically entangled and thus not subject to lightspeed delays, rather than having to wait for a wave packet arriving at the mere speed of light through photonic propagation as they do today. This is probably formally wrong on some level but it’s only meant as an analogy to get a toehold of understanding, not as a statement of outcome or certainty.
Most Midea units can be swapped for an ESPhome USB dongle if you ever wish to have remote control on your own terms — note various countries’ shop links, and the various wiki and other outlines for DIY etc: https://smlight.tech/product/slwf-01
The YAML file for customizing the firmware on that dongle is here; v2.1, b/c USB-C port on the side, and if you do customize it, comment out the `update:` block. I've detailed my customizations below.
> To flash the device: Connect the device to the PC with the button pressed. After the flashing starts, you can release the button. If the flashing has not started, repeat the first step!
Once flashing is complete, wait a couple seconds, then unplug the USB-C connector and plug in the USB-A connector to boot up the dongle and confirm it's connecting to WiFi.
For my Midea U AC, I chose to commented out HEAT_COOL, HEAT, HORIZONTAL, BOTH as they're not supported on this cooling-only unit. I also plan to comment out the indoor humidity sensor since my unit doesn't have one and always reports 0%, but for now it's just disabled in HomeAssistant.
For (all) ESP8266 chips, I add `wifi: phy_mode: 11G` to disable 802.11b (never, thank you) and to disable 802.11n (incompatibility issues with my router); I also set `min_auth_mode: WPA2` (highest 8266 supports), `post_connect_roaming: true` (don't make me reboot my AC to roam APs), `fast_connect: true` (since I specify SSID anyways).
Once it booted up and DHCP'd an IP and showed up in the ESPhome dashboard, I wrote that IP into an appropriate `manual_ip` block and updated the firmware.
Then, when installing the dongle into my Midea U AC, I had to rotate-CCW into place under the top notch-holder rather than tilt-forward into place (as OEM dongle) due to the very short USB cable length.
It seems like, at 16000TbaseT anyways, you’re adding an overhead of about 150% on top of copper/fiber latency plus transmit time latency to process data at that bandwidth. I wonder if the same holds true at 100 vs 1000, 2500, 10000? Certainly this is a known tradeoff for DDR performance tuning — if you don’t mind spiking response times greatly, you can get the advertised maximum speeds, else you accept less bandwidth for somewhat less latency — and they’re both effectively using the same strategies to talk over copper.
> WTF!! When did we land in the middle of a Black Mirror episode?
At least a decade ago! The first TVs with Automatic Content Recognition shipped in 2013[0]. There was also a brief panic in 2024 about air fryers spying on people[1].
And of course practically every website you visit is doing a full session recording with mouse movements and key presses captured.
Ah the good old days when "we kill people based on metadata"[0] was the conversation and we thought it wouldn't get more invasive. Now we just straight up extract data
...and that was before 2014... over 12 years ago... now people paste into chatbot every content and any content then scan their faces, fingerprints, and documents as a routine.
Before that. Around 2005: DVD players that require updating cryptography keys and hence want an internet connection (and consequently can send around data).
And the first store clerks at the time that shout that "all people have agreed on that, period, complaints are non appropriate because society decided".
A small step for senseless humanity, a giant leap for the beast with big promises (that we are still seeing in development).
> And of course practically every website you visit is doing a full session recording with mouse movements and key presses captured.
Well yeah at the very least, that’s Google Analytics and/or similar alternatives.
Most individual websites outside of Google/Facebook/Amazon don’t get any data other than what you do on their website, so it doesn’t seem quite as creepy to me as a device on your home network port scanning and sniffing other traffic.
Google and Facebook can and do ‘spy’ a lot, of course, but otherwise the browser does protect you from most trivial spying by random sites. Not that that’s reason to feel any safer; the few people actually spying on what you do everywhere on the web are the ones with the most resources. This is all going to get way weirder with AI logs, I’m guessing.
You can check this claim for yourself by opening NetworkTools in your browser, then moving your mouse and pressing a few keys to see what data is sent to the server.
You can prob just identify some outbound reqs with like ss -tulpn then use those to set up a Wireshark packet filter and wire as needed to automate. Not sure how but I bet you could set up a hook to listen for any such reqs being made and then start the capture
I’ll keep repeating this but I used to be a technical project manager for “advance analytics” for a major media agency and we used this data in our reporting for ad reach effectiveness.
I worked at a major media buyer agency “big 5” in advanced analytics; we were a team of 5-10 data scientists. We got a firehose on behalf of our client, a major movie studio, of search of their titles by zip code from “G”.
On top of that we had clean roomed audience data from “F” of viewers of the ads/trailers who also viewed ads on their set top boxes. Basically any internet connected device you get is probably doing whatever it can to sniff mac addresses of your network at the least.
From a previous comment of mine:
> … my Insignia TV (best buy store brand) with fire tv built in is basically unusable. Echoing a previous comment I made too, about “smart tvs” and the “streaming sticks”: Hey, have you ever thought of why even the $149 Black Friday loss-leader no-name-brand TVs all have Amazon Fire, Roku, or are now "Smart" in some way? Certainly isn't because they need to incentivise you to connect it to the internet so it acts as a Nielsen-esq measurement device of all media you view on the screen via digital fingerprints that exist in all commercial media and advertisements. [1][2]
A 55" Walmart store brand TV is $200. That's the regular price.
And yes, it's for the reasons those of us who have been in the tech field for a while would guess: it's "smart". It comes preloaded with apps for several streaming services, from which it surely gets a cut. It probably displays ads if allowed to connect to the internet. No doubt it reports what you watch.
I despise the ones that then, after you decline, tell you the app doesn’t work without Bluetooth enabled although the functionality does not need Bluetooth for anything
Do you remember how a series of crazy coincidences and freak accidents kept preventing the LHC from being turned on? What if the LHC was causing world-ending or life-ending events, and we simply kept surviving only in thinner and thinner slices of amplitude (timelines) where those freak accidents happened, but where also more improbable world conditions took place?
LHC is a pea shooter compared to the absolute ion cannons that are cosmic rays hitting the upper atmosphere, which are pea shooters compared to acretion disk collisions or particle collisions about a magnetar. Sorry to ruin the fun! :^)
The center of mass of these natural collisions is a huge Lorentz transformation away from Earth's center of mass, which could explain why some unwanted effects are harmless to us. To put a paranoid person at ease you'd need to go a bit further. It's all covered in detail here: https://cds.cern.ch/record/1111112?ln=en
Started sliding down this slope back when the DMCA was introduced and made tinkering with software or firmware protected by any form of encryption incredibly illegal. That's effectively made it so that any hardware you buy isn't really acting in your best interest, but that of their manufacturers.
The EFF, Doctorow, et. al. were warning us that this was going to happen, over and over again for a really long time. Then they were saying it was beginning to happen for a really long time. Well guess what, the thing they were saying was going to happen happened!
No one cares. There’s little serious pushback to privacy invasions by big tech. Flock cameras have been a rare exception. Half the people “have nothing to hide” and half aren’t willing to give up the convenience that the popular app or gadget gives them.
I'm convinced this is the state because people don't know the implications and scale of the privacy invasion. The flock camera incident shows that when people can sense, understand and feel the impact they don't like it. If we pose it as they are selling network data, nobody minds, if we pose it as they are selling your identity on the internet people get uncomfortable. But its hard to convince people of the latter. Mostly because nothing big happens due to big data breaches as someone on HN was remarking recently. Additionally, I think people have resigned to the status quo as they think that is the only way they can get their gadgets for cheap. That is just not true, companies can still make a profit without being predatory. Its just that it will not be the maximum profit.
Part of the problem is most people don't have an idea of what's being collected.
With just a little bit of interaction with the modern internet, the profiles created are stunningly accurate. Age, gender, political ideology, favorite food, relationship status, how many kids you have.
All this stuff gets slowly collected, aggregated and shared amongst data brokers.
People would care so much more if they knew just how invasive advertising actually is. All to try and convince you to drink one more coke or grab one more cheeseburger.
You don't need a new toilet seat? But you just looked at toilet seats and then bought one. Are you sure you don't need another? Don't you like toilet seats?
I see this as a failure of news media. Specially tragic as they don't even recognize this as their duty. Their reporting is almost always single data points. They don't make the overall picture clear when reporting this stuff. Imagine if the financial crisis was reported as individual shares crashing and not a market trend.
What are they going to say? "Trackers, like these 300 we have on our site, are monitoring all this stuff and our NDA doesn't let us tell you what they are doing."
You can’t realistically stop this. The industry is international and any interaction being shared across companies allows you to build this profile. It’s impossible to be fully private while having the openness of our internet interactions. You can try to limit the implications but that’s it
I don't truly understand what you are suggesting here. None of these interactions need to be recorded by anyone. You definitely don't need to sell that data.
It cannot be outlawed 100%, no problem can truly be solved by legislation. But that doesn't mean we can't start by banning sale of user data. I don't understand how it is legal to do even today.
330M people in the country, you can run that entirely though a remote FBI office.
and the people using the data are gonna be the local cops; FBI ain't flying out to chase a couple of basic-ass assault charges or thefts.
email snooping, hand full of highway cameras at known bottlenecks, border crossings -- these are abstractions to most people. the flock cameras in their neighborhood are not, and cannot be absractions.
Seriously? Literally every appliance that demands an internet connection and use of an app does this. That's why the cheapest products on the market are designed to need apps and connectivity, the prices are subsidized by the assumption of ad data to sell. Been like this for years.
> I'm half convinced the first run of the LHC split the timeline and we've landed in the evil one.
Sadly the real answer is much less dramatic: we did this entirely to ourselves, voluntarily, purely out of lazily taking the path of least resistance offered us by companies that don't have our best interests in mind.
when? It started when we accepted a world where companies could shovel T&Cs at us and pretend it means anything. It worsend when we accepted that companies could change those terms at any time.
We really need laws protecting consumers from "data collection for advertising". It should be a default no with a requirement for explicit opt-in /and with no legal way for companies to charge less for the advertising model/. In fact, customers who agree to the advertising model should be able to get profit sharing revenue.
Well it's completely voluntary since no sane person would ever need a "smart" coffee machine connected to the internet. So IMHO it's more Idiocracy than Black Mirror
We were living in a "simulated" reality, where tech corporations produced amazing things a ran services practically for free asking very little in return, because it was all being funded by "stimulus" money - effectively the country getting into debt and creating money out of thin air. Once we reached the limit of this we had to face the reality of these companies actually having to pay their own way.
I don’t dispute the purpose of the data collection, but I can’t believe this quantity of data collection is intentional.
There’s no way Keurig is has the intention of paying the kind of costs required to collect a terabyte of data every two weeks for millions of people who own their coffee makers.
There must be some kind of bug here. I imagine if you unplugged it and plugged it in again the data usage would settle down.
As article says, the coffee machine didn't 'collect' or phone home a TB of data. It just saturated the local network looking for data to collect. This doesn't cost Keurig or any other IoT device company a single cent. It might have been a bug, or maybe not. Without some bad press, like this post; they have no incentive to change anything
Oh let's be charitable! A parameter measured in ms is mistakenly thought be measured in s. Hilarity ensues.
Real world example: þe Windows registry DWORD time periods seems to invite 10^-3s granularity for totally inappropriate timescales. Perhaps its considered a "best practice" by the dick heads that decide to do these things, who knows? Why bother considering how a sysadmin might actually want to use the knobs and dials and what is an appropriate value for a parameter.
I could probably find a better example but this is recent: Smoothwall has an agent (IDEX) that you install on a Windows domain controller and one of its functions can be to harvest DHCP data and pass it onto the firewall so that it can track sessions. The upload period is a registry DWORD value.
I fixed a "problem" by stopping IDEX trying to upload data a thousand times per second. I will also point out that switching on this functionality and the periodicity setting is only applied by editing the registry - there is no GUI for this. The dReal world example -ocs are clear that you should initially set 1000 as the period.
For me that sort of thing comes under the heading of "you are holding it wrong", potential victim shaming and rubbish engineering.
This is what I suspect. A retry every X milliseconds actually being used against a variable nanoseconds, a broken loop condition that ends up always retrying, something like that.
Its the letter thorn, which was turned into y in print back in the day because ... cost. It was originally the leading letter in the (or thee) instead of th.
Nowadays, and for quite a lot of the past, people like to riff on "ye olde shoppe" and the like to imply "ye olden dayes".
The problem, as I don't really see it, is that a possible cost cutting measure in printing seems to have swung back and changed the English alphabet. I don't really buy the official explanation for the loss of thorn. I think it simply wandered off and got bored, it looks quite like a p too. I gather that it originally sounded slightly different to "th" but English has largely lost that distinction.
Not making an accusation, but it reminds me of a chat transcript oddity I saw while using opencode back in August. It replace a syllable of a word with a punctuation mark that has the same pronunciation or HTML entity. It was something like "...the &litude of that waveform..." but I can't remember exactly, nor which model I was using. I just noticed it and thought, that's weird. A few days later I read about text watermarking and figured it may be that.
Happens on paid too. Every once in a while, one of my conversation names will have random Chinese characters in them. I guess distillation goes both ways.
It's impossible to tell the difference between being malicious and being ignorant.
With this particular company, everything else they do is malicious so I won't ever give them the benefit of the doubt.
I tried to use a reusable pod in one of their machines the other day and when I shut it the handle broke off leaving me rather confused. Turns out in the closing head of the machine they stuck in 4 big metal spikes to destroy anything put in there. There is absolutely no reason to do this, none, other than being dicks. Had to get out the epoxy and repair the handle of a friends machine.
Exactly. The whole thing is weird and creepy and wrong.
I understand why a TV would keep track of what I’m watching so they can sell the data. I think it should be illegal. It’s horrible. My TV isn’t connected. But the reason they would do it fits in my brain. I can see how they got there.
How a coffee machine got to running network probes… nothing. It seems like some sort of Internet of Things DEFCON presentation topic made up by putting random words together.
So to think that on top of that they were purposefully causing so much traffic on the local network is just a few steps too far for me to think that part was intentional.
The reason is that probably the coffee machine vendor doesn't know what is going on. They probably got that module from.some third party, like "hey, you want to cheapen your smart coffee machine? - take out network stack!" and then they don't have to hire developers doing all the work to implement a network configuration system and all that stuff, but have a simple API for the App telling you coffee is ready
I think the reason to use a coffee machine is because it's an innocent device that doesn't require any data whatsoever, so nobody would ever suspect it of something so nefarious.
They're explicitly taking advantage of their customers' trust, and deserve to go bankrupt.
The funny part is that the manufactures shitty QA made this a much bigger thing that it could have been. Had the machine done a scan once every week, which is more than enough for their purpose, diffed the result locally and pushed the few kB of data to the internet, then no one would have noticed anything.
Yes, it's malicious and completely unnecessary, but incompetence has potentially made it a PR problem.
I was talking to the guy who used to run our ITSM system at work. He said a team was trying to query the system 10x per second to check for updates, which was causing performance issues. Assuming it was a bug, he went to the team to have them tone it down. He was shocked when they fought with him over it. It was working as designed and they didn't want to check less frequently, despite there being no logical reason to do this.
This may be working exactly as designed, as it costs them effectively nothing to constantly scan.
I don't understand giving the benefit of the doubt to a company that is actively spying on its customers, which in some jurisdictions would be illegal.
All these companies make their money as 'feeders' to the advertising industry, they just sell a different device to consumers in order to achieve it.
Selling devices to consumers is a solved problem. The problem we're currently trying optimise solutions for is selling consumers to the advertising companies.
Maybe they literally just don't care about how much traffic they put on your network. Maybe the thought is "1 tb of traffic internally is very low utilization of the network over the course of a month".
Whatever they're trying to accomplish with these scans would probably be impeded in some way by this much volume. Like it'd compete with the link it's using to phone home or overload whatever on-device processing it does with that data. The man in the article who discovered this called it a bug, I agree with him.
I'm not saying there's no malice, it's just that maliciously spamming the network would get in the way of the malicious spying they actually want to do.
When the cost of the action to you is 0, why not do it as fast and as frequently as possible until you get your intended benefit.
Even the act of engineering rate limiting costs you more than just having this run wild over your customers networks because the vast majority of people buying these machines do not have the inclination or skills to detect this activity.
Here that means no lawyers, no discovery, $100 to file in plain language, and a company employee (not a company lawyer, or a contractor, or a temp employee) must attend or they default.
$15k damages.
Reasons it could happen? Imagine grandpa has a tech come out 4 times, because his network is super slow. EG, this thing pounding his wifi for its scans.
Grandpa gets his money back. The company? Well, it has to spend money talking to a lawyer, because even though a lawyer can't attend small-claims court, they still consult.
They also have to send an employee to small-claims court, just have to deal with it. In the end it costs the company thousands of dollars maybe even over ten grand. It costs you a hundred bucks and you get your money back. That sort of asymmetry is beautiful, and if everybody availed themselves in small claims court, it would be far better than any class action lawsuit.
Grandpa is definitely not getting $15k in damages, and Keurig can deal with this with their in house lawyer that they're already paying a salary for. They're definitely not shelling out big bucks here. It'd be cheaper for them to let the default judgement happen than to actually show up.
In which case, your grandpa gets his money back, plus filing costs, plus serving costs, and if it's a default judgement, no one to argue against the gas costs, and time costs you tack on.
Please show me how this is suboptimal? Especially with LLMs to write the demand letter, and walk you through the process.
And 'using their in house lawyer' still has time cost, as does dealing with the routing and pondering the service letter. And accounting paying up. There is no aspect of your 'worst case' where it's bad. It's still all pluses. And if as I suggest, lots and lots of people do it, then they end up with a loss on that product.
If each case is $1000, or even $500 payout, how much profit does that take? Profit on 100 units? 50? If a product is horrifically bad, and everyone runs to small claims court, that's disaster for a company.
I'm not saying any of this is bad at all. I'm saying you can't expect the $15k damages you mentioned in your post that I first replied to. It won't cost Keurig anywhere near that even with fees and such. That's why I quoted it specifically in both of my comments.
> If each case is $1000, or even $500 payout
How many people are going to spend $500 on service techs coming out to their house? So far we've got a report from one guy who figured it out with no damages at all, and therefore no case for a small claims court. Since it was found to be defective 10 days after first use, it's probably still eligible to be returned for a refund, so even the cost of the machine isn't eligible.
> If a product is horrifically bad, and everyone runs to small claims court, that's disaster for a company
This much I can agree with for sure. While it is definitely bad, I don't think flooding small claims courts is going to be a viable strategy in this particular case.
I get it now. Looking back at my post, I left out something important. 15K is the maximum damage allowed in small claims court where I live.
For whatever reason I didn't finish that sentence, and just said 15k. Sorry about that.
Where I am, you can get back the cost for sending a registered letter by courier to have it served, signature required. Also for the demand letter. You can get money back for filing, the $100 for example. Lots of little incidentals.
To me, it's when the damages are smallest, that small claims court is the biggest benefit. Losing $30, suddenly becomes a bill of $200, after it goes through small claims court.
But anyhow, I'm just happy if you like small claims court to some degree. I just think we should all use it more.
local area network traffic was sent out and received by the device to the tune of 1TB of traffic. not internet data but local area network data which is not ideal for a coffee machine either way you slice it. if it were some kind of local bonjour or whatever the open standard is called service that was just alerting the network of their name it would be understandable but the coffee maker is streaming the equivalent of about 17 high def movies every day to the local network.
I mean, it wasn't clear to me without the explanation (I too thought it used 1TB of public internet data), but it's clear now that it is accurate (it literally used 1 TB of private network data)
It might not seem to be anything (people will assume private network traffic is free) but there is a cost - it's capacity that could be used for other purposes, eg. home alarms.
One thing that confuses me is, well, at this point in the data collection game, is there still value in this 'local' data? I mean, everyone is doing it, collecting the same data - hasn't that decreased the value? Obviously not, but I still wonder.
Not in my house. What is even the point of connecting a coffee machine or a washing machine to the internet? I think my washing machine advertised that I could download new washing cycle programs in the app. Who on earth cares?
> I could see its use - you could remotely activate them
What is the point of activating a washing machine remotely if you aren't there to put your laundry inside? What is the point of activating your coffee machine remotely if you are not here to drink it? Even when you have to fill water in the machine and grind coffee beans, and wait for the machine to preheat the water.it takes less than 3 minutes to prepare an espresso.
Of course you can set up firewalls and VLANs to have the best of both worlds. You can remotely interact with an IoT device like this to set them off or check the status, but the device itself can't see anything else on the local network.
I have all of my IoT devices on separate Wifi network(s) and VLANs and almost all of them are isolated so they can't talk to each other, plus I occasionally look at how much data they are sending/receiving from the Internet (some is expected obviously, and it differs by device).
Doing this requires a considerable amount of admin work and IT knowledge though. It also requires something a step above most consumer grade or supplier provided networking equipment.
I've never spotted anything egregious like the coffee maker in the OP but if I did I'd be making sure other people knew about it and the device itself is either firewalled off properly or replaced by a brand that isn't a security risk.
> Doing this requires a considerable amount of admin work...
As someone who has done this, it's a one-time cost (as long as you're not the sort who simply can't stop tinkering with it and ends up totally rebuilding it like once a quarter (don't ask me how I know)) and -if you have even just a shaky understanding of how to do it- it's not _that_ large of a cost.
> ...and IT knowledge though.
I definitely agree that doing this requires quite a bit of IT knowledge... but it's all stuff that's pretty easily learnable for anyone who's interested in technical stuff and/or technically-inclined.
For folks who are looking to do this on their home LAN, I have some hardware manufacturer recommendations:
All of this VLAN work will be entirely pointless if your switches can't be programmed to enforce the separation, so one will need "managed" switches of some kind. I'd recommend anyone who wants to try to do this to have a look at Mikrotik switches... they are inexpensive and definitely more than good enough for a fancy home LAN.
Mikrotik also sells routers and WiFi APs. I can't comment on the quality, as I have slapped together my own router PC and use OpenWRT Ones for my APs... but I've found their switches to be more than good enough for my fancy home LAN. Perhaps their routers and AP are equally good?
Mikrotik publishes pretty comprehensive documentation here [0]. If you want to dick around with the Mikrotik management CLI for RouterOS -which is their name for their fancy management software- you can install the x86 version of RouterOS in a VM by booting a VM from one of the x86 install images at [1]. They also have a much simpler management software that you can run on all of their switches called "SwOS" -documented here [2]- but that doesn't have any x86 installation media so you can't play with it on your PC.
If there's one thing you can be absolutely certain of it's that every scrap of the data they collect is either making companies money hand over fist or they strongly believe that it will soon. No company is going to bother collecting, storing, (hopefully securing), backing up, and analyzing all this data without a reason, and to them money and power are the only reasons that matter.
Right now companies are somewhat limited in how much use they can get out their horde of private and personal information, but AI is changing that rapidly. As long as you don't mind a huge rate of error (and companies don't because it all becomes "good enough" at a large enough scale) it's basically perfect for the task of digging through endless amounts of information and spewing out bullet points.
Ha. I feel like you have never worked for a large company if you think they are making rational decision at all. They may “believe” this will make them money, but there is no guarantee that this isn’t just costing them money hand over fist.
Honda had enough customers that they still made millions selling that data. One company only gave them $25,920 for a bunch of it, but why should that matter when it was data they would have collected anyway, can still use themselves, and they're still able to sell it over and over and over again. It doesn't really cost Honda anything to do it so it's basically all profit for them. It tells us how little Honda values our privacy, not the value of that data to Honda.
I was thinking that repeated small probes add up quicker than you'd expect. But this is ~1.1MB/sec, which still seems a few orders of magnitude off.
Now I'm left wondering what this traffic actually is - assuming probe (arp/icmp) packet size of 64 byte, that's 17kpps. I don't think an ESP32 class Internet-of-Trash chip can even do that. Even bulk transfers rather than small probes would be pushing it.
Perhaps this thing found some fellow-traveler device streaming video on a port it happened to connected to?
... the linked xit says it "broadcast 1TB of data". So maybe some protocol with a much larger packet than icmp, spammed in a hard loop without any delay?
I think it's high time for legislatures (US, California, EU, whatever) to make this kind of thing outright illegal. No consent popups. No fine print. Just illegal.
Coffee machine scans network? Nope.
Coffee machine reports things about your network? Nope.
TV does ACR? Nope.
TV reports things it incidentally learns about your listening habits? Nope.
TV transmits any microphone data or things derived from mic data that aren't explicit user commands? Nope.
Companies who collect this data even though it's illegal want to sell it or use it for marketing or transfer it to anyone else? Nope.
Company A provides an SDK to company B that does this kind of thing and company B sells the product? A is liable, civilly and criminally, and B is also civilly liable to the extent that they should have and did not exercise due diligence to prevent it.
Company A, company B, and/or the end user have some contract shifting liability? Nope. The parties that the law said are liable are liable, cannot use the contract to avoid liability, cannot use the contract to recover money they have paid as a result of this liability, and cannot enforce arbitration provisions.
Anyone tries to use a contract that is considered illegal under this law? That party becomes responsible for their opposition's legal fees even if they are ultimately found not liable for some other reason.
Police wants to buy this data? Sure, they're welcome to buy what's legally available, except that they, like everyone else, will have a hard time getting the data because it's illegal for anyone to acquire it or sell it.
It's high time to get this done. We've got this and the recent evidence of LG doing all kinds of worse crap and it really should be possible to get some legislators on board.
I would be a single-issue voter on this. If anyone running for office is doing this, and can get it done, they are getting my vote. I'm so tired of this kind of thing being normal and accepted. It has eroded the public's trust in pretty much all of corporate America, or has at least had a hand in it.
With all the hacks going on, I can't imagine why any company would even want to collect anything if they have a business model that works without it. I would think selling coffee makers and coffee pods would easily be a business model that works without data harvesting. Companies made whole businesses out of selling coffee makers alone for decades.
Why would a company integrate bullshit SDKs into a coffee maker? Because coffee maker ACR isn’t worth anything and because there are companies that will pay absolutely freaking crazy amounts of money, possibly in excess of the entire sale price of the machine.
Stop spreading this idea that all politicians are corrupt. You're killing democracy, and watering down revelations of specific proven cases of corruption.
I understand your feeling of despair. Of course I do. But you don't have to make other people despair. History has shown us where we end up when enough people despair.
> Stop spreading this idea that all politicians are corrupt.
For certain definitions of corrupt, with almost no exceptions, all politicians in neoliberal democracy are corrupt, because they serve the needs of Capital rather than people.
There's some interesting things happening with DSA in the USA but it feels like plugging a thumb in a dam.
I'm hardly killing democracy. More like poking a rotten corpse with a stick.
I don't despair, btw, I don't rely on the continuation of liberal democracy for my happiness. I'm waaaaaaay left of that.
My general theory is that the aggregate spent on marketing is largely a function of marketers’ budgets. They’ll spend it in whatever way they think is cost effective, but the amount spent may not vary all that strongly with as the set of available marketing technologies changes.
If marketers cannot pay Google, Meta, etc to show their ads to people whom pervasive surveillance indicates are the appropriate targets, then they will pay companies (probably still Google and Meta and very likely still American companies) to show ads to people selected by other means. Everyone’s retirement account will be just fine.
For that matter, consider who some of the biggest offenders are right now. LG and Samsung are Korean. Sony is Japanese. (But Vizio is American and seems to be owned by Walmart.) Maybe reducing surveillance capitalism will make it harder for some of these foreign companies to extract money from the US.
There’s also the national security aspect. Right now, we expect foreign corporations to extensively spy on us. Sure, a law would not necessarily stop foreign powers from spying on us, but at least if we banned the general practice, then foreign powers who do spy on us might get noticed.
To me, this is begging for a class-action lawsuit.
Yeah, sure, the terms of service probably say that they can do that. That's still in "unconscionable" territory. And courts do not like unconscionable contracts. If it's unconscionable, it's invalid (if I understand the law correctly).
Is this why everybody wants to make appliances with wireless?
Funny thing, that. Go into an electronics store now and pay attention to the TV boxes and the printer boxes. The amount of crazy fine print on both of them now is absurd. The printer boxes all now have lots of fine print about the various ink protection and DRM schemes and subscription services, the TV boxes have everything ranging from binding arbitration on the box (LG) to "(brand) accounts are REQUIRED to use this TV" (Visio).
Customers are gonna get lost in the sauce and skip right past all of that and toss the packaging.
Yes, this is why everybody wants to make vehicles and refrigerators and thermostats and ereaders with cellular and/or wireless: subscription revenue from bulk data purchasers of what their scans reveal. IIRC Amazon was an industry leader in this space by showing book authors what page you stopped reading on, and then bulk assessing that data at scale to estimate which sentence or word; of course, Google’s Android remains the most successful at-scale deployment of data collection for advertisers worldwide. See also, for recent context, the top comment (and others) of the LG Smart TV problem (30 days ago, 1012 comments) https://news.ycombinator.com/item?id=49592375
"Is this why everybody wants to make appliances with wireless?"
Which raises in my mind the obvious defense, which is that if you try to put four or five of these devices on your network they'll be too busy interfering with each other for them to actually spy on anything.
Let the wiretaps wiretap the wiretaps. Keeps 'em busy, makes 'em feel like they're doing something important.
> What is my purpose?
You wiretap the wiretaps wiretapping our wiretaps.
> Oh my god.
Tongue-in-cheek, but my Moccamaster which I bought second-hand is still doing great after 15 years. Two deep cleaning sessions in all that time and just running it with vinegar a couple of times a year seems to be all it needs.
The device is dead simple. No advanced electronics. Nothing complex that can break. Just a coffee maker fine-tuned to near perfection.
The only flaw it has is the handle for the pot. I've resorted to replacing the plastic handle with a fancy walnut one I made myself. I needed that because we tilt the pot sideways to fill the reservoir with water (because of the placement on the kitchen counter and the cabinets above), and that plastic handle is not designed for sideways stresses.
You shouldn’t fill the reservoir with the coffee pot, unless you’re really washing the pot super clean after each use. Better get a proper jug for filling the reservoir, so you’re not putting coffee residue and oils back into the clean-water system.
> Doubtful they just unboxed, plugged in, and it connected to the right AP and went
Why not? iirc some of the smart TVs have been shown to find open wifi networks on their own and upload data. (I'm not sure about that though. But it's plausible and undoubtedly will be implemented some day).
I've read this argument dozens of times on HN and on HN only - I'd love to see an example of that actually provably happening anywhere in the real world.
I would love to as well. It sounds like something that's plausible but potentially a minefield of liability for the manufacturer.
I could also see some kind of partnership with ISPs to use their "public" WiFi hotspots[1]. This seems more likely since it's (probably) harder to honeypot but requires making regional deals.
Maybe that's why I've never heard of the company here in Germany.
That, plus nobody in their right mind would buy American (vs French, Italian, German, Dutch...) when it comes to coffee. (yes, Starbucks is a thing here, but I'd argue people who are into _coffee_ don't go there, people go there for other reasons.)
Well, yeah sorta since the only reason appliances connect to the internet is to steal data. I mean, if you buy a connected x that normally would not be connected, it’s 99 percent there to do nefarious stuff for its real owners. It’s like having a pet lion. Sure, it’s horribly irresponsible that someone sold you a pet lion, but. Uuuh you bought at pet lion. What did you think it was going to do?
How does this analogy go when people buy a house kitten and it turns out they have been sold a lion cub? Most people simply do not have the tech literacy to understand that what they a are buying is actually a lion, they thought they were buying a coffeemaker with some cool features. It's difficult to blame the victim when they would need to spend hours trying to understand why the thing mapping out their local network is something that they should even care about
In that context the person is a fool who shouldn’t be in charge of another life, because they’re incapable of basic prudence.
I don’t actually think that applies to coffee makers spying on people though. People shouldn’t be expected to understand how computer networks or ad tech spying works in the same way that literally any child or idiot should know the difference between a lion cub and a house cat.
In the analogy, there is no such thing as a house kitten. They are all cute and cuddly lion cubs. Society needs to develop a deep awareness of this, in spite of the ocean of fraudulent advertising to the contrary. (individual-liberty-protecting regulation like the GDPR would be nice too, alas)
Since most appliances now contain a general-purpose computer, it would be unfair to say that a device is incapable of hacking or hosting malware, because any device with the given sensors and radios and capabilities can be essentially reprogrammed at any time.
So, if we're looking at smart TVs with cameras and microphones and Wi-Fi and Bluetooth and all the connectors, or if we're simply looking at a an ordinary network device, they all fall under the umbrella of general purpose computer, and there is no way to trust their maker, or some equally capable programmer, not to turn them malevolent in some future update.
I don't view this as an issue of terms of service or of software or of your manufacturer. I view this as an existential and fundamental problem with dropping general purpose computers into your home and behind your DMZ.
Consumer operating systems like Windows and Apple have all kinds of countermeasures against this malicious use. But without the proper introspection and without the proper safeguards, a device that looks special purpose but is in fact general purpose is far more dangerous.
Getting technical - the way I see it, the problem arises from a combination of three things - sensors/access, Internet access, and source of software/authority.
Sensors/access is unavoidable, otherwise the device doesn't actually do anything useful. The point is it sets the scope for what the device is able to affect. When people say "set up a separate IoT VLAN" (that still has Internet access) this is basically what they're addressing - how a device can access other devices they may care about more.
Internet access is the catalyst that's created this whole dumpster fire - I don't care about the proprietary software on my keyboard/mouse/UPS/monitor/GPU/etc to nearly the same extent. I've got some TP-Link plugs that I control local network only. They don't get Internet access, so no updates, telemetry backhaul, etc.
The authority to update/configure/change that software is the crux. With proprietary software, there are no cuddly kittens period. Here we've got a case of a "legitimate" company choosing to be a bona fide attacker to increase their bottom line! The harm was exacerbated by a bug causing it to run amok, but even without the bug they are deliberately violating trust.
But even libre software can fall to security holes as well. Meaning you want to centralize the attack surface as much as possible, for administration's sake of keeping updated. "Internet" of things is basically the direct opposite of this - postulating many illegible fine-grained links between devices on different networks. Whereas really need more like the Home Assistant model, where peripheral devices may communicate over the network, but it's only ever over the local network. Think how ethernet is set up when used in industrial control networks (or at least how it should be set up, hehe).
How do you feel about thermostats? Are some things worth it? I've had a "smart" one for the past five years, part of a new furnace install, that I've stubbornly refused to connect to my wifi. Of course this means if we forget to turn the heat down while no one's home, there's nothing to be done about it.
That's obviously bad and I hate it, but how much value even is there is the data that a spyware coffee machine could collect about your home? What advertisers would buy such data and what would they advertise to me? What is the marginal value of that data?
You can also map a home out depending on signal strength. That gives you approximate size of home which gives you approximate income.
It can also correlate it with geolocation data. Google, for eg, sniffs all broadcasted SSIDs with their StreetView cars. If you can pick up on a SSID (or any of the MAC addresses of the other devices), you can buy the data set that includes it which further pinpoints demographics given the neighborhood AMI.
You can also build behavioral profiles patterns based on things like, for eg, if a baby monitor model is present or a robot vacuum, if certain devices only connect at certain times, etc.
I think the general rule for adtech is that profile guesstimates just need to be around 70%+ fidelity to determine if a sale can be made.
Lastly, you can also just sell the data on the gray market. The more datapoints, the higher the price. Most consumer product companies do that since we have little-to-no data privacy laws and the people who seem the most aware of it also are generally very apathetic and disinterested in advocating for them.
For example, your aged mother's phone will get pinged within X meters of an urgent-care facility, or she'll do some web-search about "hip pain", and then all the adult children start getting ads about elderly-parent-care.
Or perhaps the pervy-panopticon decides some phone-on-wifi events look like adultery, and both suppposed spouses start getting ads for divorce lawyers, private investigators, or track-covering products. (Bonus if certain specialized "adult" toys are detected on Wifi or Bluetooth...)
yeah, if n=1 then there's no distinguishing it from natural phenomena. regardless of its accuracy, the wanton hoovering up of data is still in full force - that was the whole motivation behind the 'big data' fad (ie when MBAs read a Nate Silver article en masse and believed stats could solve everything)
Yeah, it definitely makes sense to me if what adtech is often doing is just backing out from specific data to a general profile like income, location, etc, so that that level of targeting can work.
Knowing what TV you own, what phone models are used in your house, and what other devices you own tells advertisers about your spending patterns and income.
I wonder if you can identify the age of devices based just on network scans? Like if an advertiser can tell I've got a washing machine model that was last sold 7 years ago, it's time to spam me with washing machine ads.
Quite probably. nmap does (or certainly used to) have options to report the OS of a given machine had based on various quirks of the packets it got back from them. It was disturbingly accurate at times. You put that together with banner messages from running services, MAC addresses, responses to broadcast packets, deliberate probing, and the number of devices you _can't_ remotely identify on a network without actually logging into them is probably very small.
It's a lot easier to create an embedding with equivalent information than to reliably identify a particular device, and that embedding is more than sufficient to enable targeting.
I love that a poor, stupid man like me is being targeted by teams of the smartest data analytics professionals on the planet.
Makes me think of DraftKings. You take your average 20 something sports fan - drinking beer, watching the game. And, on the other end of that smartphone display exist some of the most complex algorithms ever designed by teams of mathematics / statistics PhDs and it's deliberately built around targeting... this one guy from Florida who is pretty sure his team will be up by 7 at halftime.
Maybe it's more of a morbid joke, but it makes me laugh to think about.
They can get a profile of when you're in which room, how many people are in the house, etc. That's useful for targeting (e.g., up at 5am, leaves, comes back in an hour or two will have you profiled (more complicated than this since it's usually a fuzzy vector thing, but for the sake of argument) as somebody who goes to the gym, maybe leading to creatine advertising or other whatever), and also for attribution (e.g., a TV ad is shown, somebody gets up, and a purchase is made from a device known to exist at that household, regardless of whether it's behind a VPN).
If you have even very crude data from somewhere else for the targeting, improvements in attribution tech are actually the more important factor. The adtech company mostly doesn't even care who you are, just whether the ad turned into a purchase or not, and that's where a lot of the invasive tracking comes from. They'd be perfectly happy with a quickly changing "identity" if they knew it was reliable and stable between ad and purchase.
If it scans the network and sees a smart dishwasher, smart washer/drier, and smart lights, but no smart fridge, I imagine its worth something to a company like Samsung to start targeting that customer with ads for a smart fridge.
That new Amazon page that shows you what it has inferred about you told my friend that he “clips [his] fingernails approximately every two months.” He makes extensive and enthusiastic use of Echo products in his household, but I have no idea how it could've possibly reached that conclusion (and neither does he!).
It’s not so hard to get root shell on some routers via the admin panel, which usually has the same password as the wifi network or a default password. From there the device can capture dns logs.
This does seem to be true in the age of throwing all data in to training the next iteration of the God Machine, but also, some data is a lot more valuable than other data and I want to know what the incentives are of people who are collecting data in our homes and what the actual data / derived data that they're after.
big thing is to be able to serve ads more effectively
so if you know that a user is having an affair, you might want to serve divorce lawyer ads (I'd imagine those are very expensive) or something.
this kind of data though is just like a cog in the machine, but it can e.g. give enough info to know how many people likely are in that household, and so on. useful when combined with other signals
I can understand a buggy device flooding the network. What's harder to justify is why a coffee maker needs to know anything about the other devices in your house in the first place
> 2. It does so because, as Keurig notes, it’s collecting data about your household in order to let Keurig sell it to advertisers
Where is this shown? I see it repeated all through the HN comments but I don't see it in the X thread.
The person who discovered this says he didn't even open Wireshark and capture a few packets, which would have immediately revealed something about the situation.
That’s where they want to be. Your laptop isn’t interesting. You own two thermostats, an EV charger, two Samsung TVs, an LG, etc etc. The LG is watching Netflix. That’s the good stuff.
>You own two thermostats, an EV charger, two Samsung TVs, an LG, etc etc. The LG is watching Netflix. That’s the good stuff.
That still doesn't make any sense. If they want to collaborate to build an advertising profile, your public IP is all you need. Otherwise if they're not collaborating, what's the plan, find 0days in random IOT devices and hack them? I might be concerned about random chinese IOT devices doing that, but not devices from western companies.
They don't want to collaborate, they want to sell.
Data brokers are buying from multiple sources because maybe a home has a keurig but not an LG tv. Or an LG tv and not a keurig.
The plan for the likes of Keurig is "These data brokers will give us free money for data from our coffee machines? Where can we sign up!". It doesn't even matter if the money translates to $0.01 per unit sold. That's probably the most disgusting part.
>Data brokers are buying from multiple sources because maybe a home has a keurig but not an LG tv. Or an LG tv and not a keurig.
Right, but OP's premise is that putting everything on the same LAN is somehow even better for the manufacturers/data brokers/ad networks/whatever, which doesn't make any sense. The only thing that actually matters is a device with internet connection.
I’m not following how the public IP address provides value without collaboration. I can listen to mDNS and gather a ton of info about devices you own. But how would knowing your public IP address inform me about which devices you own?
I recently figured out how to do a vlan and set it so IoT devices can't see each other, just access the Internet (AP isolation). It hasn't broken anything so far (Matter devices excluded).
It doesn't sound plausible to me that the main buyers of this information would be advertisers. It sounds more likely that the buyers are black-hat hackers, or intelligence agencies. The main reason someone would want a map of all of the devices behind your home router is so they know what to target first for exploitation, if they want access.
There are companies that sell people's home ip address as a VPN/Proxy for anyone who wants to use it for anything. They call it "residential ip's". People use them for web scraping, but probably tons of illegal stuff too. AI companies use them to not get blocked.
I've heard that they put it in IoT devices, free Android apps that people use on their TVs, free phone apps, games, prob lots more.. The companies advertise it like its super safe only legit normal people borrow the internet from these people but then in fine print it'll say its not our responsibility etc.
What I have been wondering is - since they don't seem to care or check what people are using the "residential ip's" for, what happens when someone does a bunch of illegal stuff on some random person's home IP and ends up raided by cops?
I feel like the world is going in these directions.. the excuse is always "well, they clicked Yes on the Terms of Service! They agreed to it!"
How are they defining "metadata"? 1TB of text in 10 days is........A LOT. Metadata about what exactly? What time you brew your coffee every morning, how many cups you drink per day, whether you like regular coffee or cappuccino? I'm having a hard time understanding how all that can add up to 1TB of data. If it's recording audio or packet sniffing, it becomes a lot easier to understand.
More than likely nmap type scanning across all devices on a segment. I had one customer that saturated our AAAA server with requests because they though sending in data on every even was just dandy. For one device in a test lap it was ok. For 10k+ of the things out in restuant across the country was a DDOS. That was all text. it was gigs of data per hour. We sat them down and showed them how to do bundling and better data management.
It is a question many devs miss. what happens when I put this in the wild and I now have hundreds of them.
In this case it is probably scanning aggressively. Just incase you plugged in a new devices in the past 100ms. Then some sort of filter with data compression (hopefully) and then sending its exfiltrated data back home. Honestly, not a cool thing to do and makes your customers NOT trust you. I had an old LG TV that was doing this 15 years ago where it would send every button press back to LG. I unplugged it. It agressivly scan its empty socket.
> It does so because, as Keurig notes, it’s collecting data about your household in order to let Keurig sell it to advertisers.
This is either outright false or at least highly misleading. Keurig says they may sell information about your coffee brewing habits to third parties (i.e. your usage of the coffee machine itself), but nowhere does "Keurig note" that they collect other data about your household through network scans and sell that to advertisers.
I'm not even sure which tweet you were referring to that implied that. In any case, there are tons of responses here that are interpreting your quote as saying Keurig admitted they do network scans to acquire info about your household to sell to third parties, and that (the idea that Keurig says they do this) is flat out false.
I tend to face the problem of too many choices with products. I'm actually thankful that manufacturers like Keurig are voluntarily taking themselves out of the pool of consideration. It makes my decisions easier. I can only see things getting even easier as time goes on.
> It does so because, as Keurig notes, it’s collecting data about your household in order to let Keurig sell it to advertisers.
Off topic, but an odd and dubious upside to AI is that it provides an actually valid reason for this mass data collection. Before AI, as you note it was for advertisers, but what are they actually doing with it?
The promise was that with all this data, advertising would be perfected. I seem to remember fears back in the day that it could end up being a form of mind control, with this perfect understanding of you an advertiser could sell you anything, and you'd willingly consume adverts as entertainment they'd be so perfectly tailored to you. Not something any of us would want I'm sure, but that was the promise for advertisers.
The opposite ended up happening. Nobody wants to use the internet without an ad-blocker, when you're forced to use Youtube or something without an ad-blocker you're counting down the seconds until you can skip it, and the rest of the time you don't even notice they're there, let alone any kind of mind control.
Of course you do get thinly veiled advertisements as entertainment, but none of them use mass data collection, they're really not much different to how tv shows used to get made to sell toys in the 80s.
The reason I bring this up is for the question; what is this mass data collection for? We (really) don't want it, advertisers are either unwilling or unable to use it and it costs a tonne of money and effort.
The obvious, and disappointing, reason is that we all need to pretend it works or the internet as we know it collapses, for better or worse. That plus AI being the new excuse I suppose.
How do I exhaustively check for whether devices in my household are doing this? Is it enough that I don't see them on my desktop's list of available networks?
In college they have a docking station for calculators that used the two metal tabs on any “permitted for use on tests” model that locks them into secure testing mode for the duration, which would inhibit access to the program menu. Unsure if lower ed schools have these but TI’s been in the monopoly long enough to have propagated them, and this exact thing is 100% of why they’re so hostile about patching the OS to disallow usermods and machine code: their monopoly’s benefit to customers is that they fight modders. I suspect those school docks also force a firmware update, but haven’t verified as it’s quite expensive an object to brick and risky to my education to find out.
reply