[HN Gopher] How to get root access to your Sleep Number bed
       ___________________________________________________________________
        
       How to get root access to your Sleep Number bed
        
       Author : jandeboevrie
       Score  : 285 points
       Date   : 2024-06-30 16:38 UTC (1 days ago)
        
 (HTM) web link (dillan.org)
 (TXT) w3m dump (dillan.org)
        
       | dmitrygr wrote:
       | Why does a bed need to run Linux? Why?
       | 
       | Of all the possible timelines, we live in the dumbest. What was
       | wrong with a plain old bed without 1GB of RAM and a full OS
       | running on it?! It is the same everywhere. Finding a washing
       | machine that was not WiFi-connected was a chore and I dread doing
       | it again in ten years.
       | 
       | As a person who's broken into O(1000) "smart" devices (for fun
       | and for profit both), I do not want them in my house, and
       | avoiding them is getting harder due to insanity like this linux-
       | running bed! Please make it stop!
        
         | n8henrie wrote:
         | I feel the same way -- the silver lining is that it's helped
         | push me to buying older / used / more maintainable stuff for a
         | fraction of the price, all the while learning a little here and
         | there about minor repairs for older electronics. This is a big
         | win for the pocketbook and gratifying to keep something out of
         | the landfill.
         | 
         | Reduce / reuse / recycle -- in order of importance.
        
           | miah_ wrote:
           | I like: reduce, re-use, repair, recycle.
           | 
           | I agree with fixing older stuff. I buy used frequently.
           | Estate sales are my lifeblood. If you can't fix it you don't
           | own it.
        
         | reidjs wrote:
         | At least it doesn't run windows
        
           | dylan604 wrote:
           | "man, i tried going to bed last night, but it was a BSOD so I
           | had to reboot it, but then it needed 45 minutes of OS updates
           | before I could get in the bed."
           | 
           | seems like a pretty good torture on multiple levels
        
             | labster wrote:
             | And they wonder why so many people are sleeping on the
             | streets these days. It's just better UX.
        
             | p0w3n3d wrote:
             | "before you go to bed you must acknowledge our updated
             | terms of service. Please bear in mind, that our newly added
             | AI engine will process all the thoughts you have during
             | your sleep. Images you see will be stored in the cloud and
             | allowed for further processing by us"
        
               | miah_ wrote:
               | If this paragraph made you giggle, give "Feed" by MT
               | Anderson a read.
               | 
               | https://en.m.wikipedia.org/wiki/Feed_(Anderson_novel)
        
           | TheCraiggers wrote:
           | It wasn't that long ago I tried to use an ATM only to find a
           | WinCE error screen displayed on it. Scary stuff.
        
             | netsharc wrote:
             | I've heard the Windows 3.1 ding (1) on an ATM. This was
             | 2022. I hope it's just because the developers stole the
             | wave file from Windows 3.1...
             | 
             | https://www.youtube.com/watch?v=nXF_pmcDghI&t=4s
        
         | annoyingnoob wrote:
         | https://imgur.com/6wbgy2L
         | 
         | "The most recent piece of technology I own is a printer from
         | 2004 and I keep a loaded gun ready to shoot it if it ever makes
         | an unexpected noise."
        
           | blitzar wrote:
           | No way a printer in proximity to a shotgun (or window) last
           | more than a few months.
        
           | XorNot wrote:
           | And this is another lame "insightful" meme. I work with
           | plenty of cybersecurity people and they have plenty of smart
           | devices. They're the ones with Home Assistant setups and
           | ESPHome flashable hardware on they're own internet isolated
           | wifi.
           | 
           | Which is in fact a standard feature on many consumer routers
           | now.
           | 
           | What we're missing is a "local only" directive from the EU to
           | get manufacturers to play ball for the common man.
        
         | itake wrote:
         | what would be a better way to design this that is cheap and
         | updatable? Specialized hardware is riskier to build, b/c bugs
         | would require a complete reprint.
        
           | dmitrygr wrote:
           | NOTHING in a bed needs to be updatable. Nothing. It needs a
           | PIC12F509 to run a motor when you press a button and check
           | for a jam.
        
             | dylan604 wrote:
             | but but but, we need to see all of that data about your
             | sleeping patterns so we can adjust settings to make you
             | even more comfy. are you getting too hot? we'll cool down
             | the temp for you. getting too cold? we'll heat it up.
             | starting to snore, we'll automatically incline you to
             | change your positioning.
             | 
             | of course we'll also sell all of that data so we can send
             | you an ad for new bamboo sheets to keep you cool. or any
             | thing else from anyone else that offers us money for the
             | data
        
             | itake wrote:
             | How do you ensure the network traffic is encrypted with a
             | PIC12F509?
        
               | dmitrygr wrote:
               | Correct. Beds should have no network or traffic.
        
               | itake wrote:
               | how do you analyze your sleeping quality and habits over
               | time? a built in display?
               | 
               | This reminds of the 2005: "phones shouldn't support
               | texting. people should just call" vibes.
        
               | rangestransform wrote:
               | At most a BLE chip to send data to your phone in a way
               | that doesn't touch the internet
        
               | freedomben wrote:
               | I _despise_ the modern  "smart" device and actively look
               | for "dumb" things, but if it's going to have a BLE chip
               | in it, it needs to be updateable to fix vulnerabilities.
               | There are mountains of devices from earlier years that
               | are basically wide open radios now because of this.
               | 
               | Personally I'd much rather the damn thing just have a
               | built-in display with hardware controls.
        
               | jtriangle wrote:
               | How do I analyze my sleep quality? I gauge how tired I am
               | when I wake up... as man has done for eons.
        
               | danparsonson wrote:
               | We're not talking about different modes off
               | communication, we're talking about adding communication
               | to a "device" that doesn't need it.
        
               | bigstrat2003 wrote:
               | Bro are you serious? Those aren't things the average
               | person wants.
        
               | trallnag wrote:
               | You get to decide this? The average person is also not
               | homosexual.
        
             | fragmede wrote:
             | How does a PIC12F509 connect via bluetooth to talk to an
             | app for the consumer to configure things? How does it
             | connect to wifi to talk to a server to save data to? Like
             | it or not, an app to configure the device instead of the
             | device having a VCR remote control to program in schedules
             | is what consumers have gotten used to these days. If you
             | think there's room in the market for a sleep pad that
             | doesn't talk to the cloud, you're welcome to try, but mass
             | market consumers have come to expect more from products.
        
               | tjoff wrote:
               | No, manufacturers have come to expect monthly revenue on
               | top of getting paid for the hardware.
        
               | FactKnower69 wrote:
               | >Like it or not, an app to configure the device instead
               | of the device having a VCR remote control to program in
               | schedules is what consumers have gotten used to these
               | days.
               | 
               | No?? When was the last time you spoke to another human
               | being about this topic? Has any other person in your life
               | seriously told you that they _like_ having to download a
               | smartphone app to set up their soundbar? Have you managed
               | to fully insulate yourself from the broader world with a
               | circle of dead-eyed freaks that gleefully spend their
               | free nights registering their appliances online and
               | reading end-user license agreements?
        
               | archi42 wrote:
               | I hate the app+cloud garbage as much as you, but have you
               | considered how a VCR would be programmed today? Take your
               | universal touchscreen device out of your pocket, select
               | the VCR app, get a list of programms for the next weeks,
               | touch the one you want to record (or do a full text
               | search), select if you want to record this episode, all,
               | or a certain set.
               | 
               | In the past, you needed to first buy this weeks TV
               | magazine. Or if you got it by mail, find it between all
               | the other magazines. Then, skip all the ads and find the
               | schedule, in there find the program you're looking for.
               | Now you either need to figure out the exact time slot the
               | program airs, or some EPG code. This data now needs to be
               | entered into the VCR. Either find the remote, or knee in
               | front of the device. Enter the code using a rotary
               | encoder, digits 0-9 and a few buttons, or a mixture
               | thereof.
               | 
               | In both cases you need to set the receiver to the correct
               | program before leaving the house, else the SCART-
               | connected VCR wouldn't get the video signal. Also you'd
               | need to hope the EPG sent by the station is updated
               | properly - we often had some part of the recording
               | missing, or the recording started to soon/stopped to
               | late. I hope you did put in the correct tape and
               | remembered to rewind it. (I'm ignoring that a modern
               | "VCR" would store the video in the cloud and not need all
               | of this; or a hybrid would at least get the video stream
               | via IPTV and put it on a HDD).
               | 
               | Try speaking to other humans about this topic, they don't
               | want these "good old times" back.
               | 
               | Also, apps suck because they are mostly always horribly
               | made (they don't need be, but they often are, because the
               | product needs to be cheap); and I hate being forced to
               | use the cloud and have my hardware not work anymore after
               | 5 years because someone decided their Amazon bill is
               | becoming too expensive. Did I mention I don't want my
               | data to be sold to virtually everyone - errr, I mean
               | "shared with partners"? So I either buy things with local
               | control, or no smarts at all.
        
               | MissTake wrote:
               | For those not brought up in the Era of Video Cassette
               | Recorders...
               | 
               | SCART: https://en.m.wikipedia.org/wiki/SCART
               | 
               | EPG:
               | https://en.m.wikipedia.org/wiki/Electronic_program_guide
        
               | icehawk wrote:
               | I remember it being far less complicated.
               | 
               | I just had to pick the start time, the end time, and the
               | channel the VCR need to be on to record. If i wanted to
               | be fancy, I could pick the tape speed as well. VCR did
               | the rest, as long as the time was correct (but really I
               | just recorded for a minute or two on either side.)
               | 
               | Program guide was always in the sunday newspaper as its
               | own booklet or in the daily newspaper.
        
               | danparsonson wrote:
               | I conjecture that mass market consumers have come to
               | expect this because it's been pushed down their throats
               | for the last ten years by rampant rent-seeking. Who is
               | really asking for an internet-connected _bed_ for
               | goodness ' sake??
        
           | thfuran wrote:
           | Why would I want so much software in my bed that even makes
           | sense to discuss updating it?
        
             | Moldoteck wrote:
             | Smart temperature and softness adaptation for different
             | regions? Sleep stats of your positions, maybe combined with
             | some deep sleep stats? I mean, there are options
        
             | itake wrote:
             | Updating the domain name the server talks to, updating the
             | security system (like supporting new versions of TLS,
             | updating certificates, etc).
             | 
             | TBH, I wouldn't trust a custom hardware chip that can
             | decrypt the traffic and have it last for the life of the
             | product.
        
               | thfuran wrote:
               | I wouldn't trust a bed that sends traffic to a remote
               | server.
        
             | miah_ wrote:
             | The old Sleep Number beds were not smart, they worked fine.
             | I think people want to drown in useless data these days
             | trying to "fix" their sleep when the reality is its their
             | job or high stress causing sleep issues.
        
         | sodality2 wrote:
         | Sounds like the problem isn't Linux, it's insecure development
         | practices. As mentioned in sibling comment, Linux development
         | is far easier to hire for, iterate on, develop updating
         | mechanisms for, etc - specialized embedded development is less
         | popular.
        
           | PontifexMinimus wrote:
           | > Sounds like the problem isn't Linux, it's insecure
           | development practices.
           | 
           | No, it's making devices "smart". There doesn't need to be a
           | wifi-connected computer inside a washing machine, cooker, or
           | fridge. In fact all these things can run without a computer
           | in them at all, and they're arguably better for it.
        
             | sodality2 wrote:
             | The reason is demand. There's nothing wrong with a smart
             | device (even one you find to be useless) _if_ it 's secure.
             | Just.. don't use its smart features.
             | 
             | I of course agree with you principally, I don't want smart
             | devices, but it's not very malicious to have a sleep number
             | bed sitting unconnected...
        
               | labster wrote:
               | It's not always demand. Lots of people don't want smart
               | TVs, but that's too bad. The smart TVs are subsidized to
               | manufacture because the software can put more advertising
               | on, which makes it a supply-side issue.
        
               | danparsonson wrote:
               | > The reason is demand
               | 
               |  _Induced_ demand.
        
         | dTal wrote:
         | A bed doesn't have to be complicated. Why in my day, we got
         | shit done on beds with only a Z80 and 32K of RAM. I remember
         | when I bought my first bed with cooperative multitasking - a
         | red letter day! And double density duvets were a game changer.
         | But I don't miss traipsing down to the public library with a
         | blank vinyl record to get the soft wear updates - and if you
         | forgot, you got bed bugs!
        
           | skrebbel wrote:
           | Bonus points for "double density duvet"
        
           | elzbardico wrote:
           | Me and my wife manufactured our kids in a bed that only had
           | relays as logical devices.
        
         | chasd00 wrote:
         | > Why does a bed need to run Linux? Why?
         | 
         | the bed got envious of the toaster and refused inference until
         | Linux was installed.
        
         | colechristensen wrote:
         | >Why does a bed need to run Linux? Why?
         | 
         | We're in the era of measuring yourself for better outcomes. A
         | century ago we figured out antibiotics. Big gains. Then we
         | figured out a lot of other pretty obvious diseases with pretty
         | obvious cures.
         | 
         | Now we're down to the complicated subtle things. This bed is
         | running Linux so it can tell you how you slept. If you're
         | sleeping poorly it has all sorts of mostly mild negative
         | effects. If you know about them you can do things to fix them.
         | It's doing a low-grade sleep study on you every night. That can
         | be valuable information.
         | 
         | >avoiding them is getting harder due to insanity like this
         | linux-running bed
         | 
         | Sleep Number beds cost several thousand dollars, I think you'll
         | be able to avoid them just fine.
        
           | AlexandrB wrote:
           | > Now we're down to the complicated subtle things.
           | 
           | Totally false. Any gains from micro optimizing people's sleep
           | are wiped out by the constant mind pollution of social media.
           | We are in an era of constant distraction.
        
       | teddyh wrote:
       | Buried lede: "What I did find was a "convenient" backdoor that
       | Sleep Number can use to SSH back into the hub (and my internal
       | home network as a result)."
        
         | op00to wrote:
         | This was the most interesting point for me, and I assume most
         | of my IOT type shit has this functionality.
        
           | repler wrote:
           | some of the newer WiFi setups have an IoT subnet that works
           | like a guest network.
           | 
           | Worth using if your gear has it.
        
             | loufe wrote:
             | For those who know their stuff, setting up a dedicated VLAN
             | for IoT and putting devices in it based on MAC addresses
             | (allow or disallow lists) is a solid option as well and fun
             | to learn.
        
               | op00to wrote:
               | I have a separate IOT vlan, but ensuring things like
               | AirPlay work correctly is really, really, really
               | annoying.
        
             | fragmede wrote:
             | if my iot bed can talk to my iot camera, that's still not
             | great. better than it talking to my NAS or laptop I suppose
             | though
        
               | alwa wrote:
               | Sometimes this type of guest network can provide device
               | isolation: devices can talk to the open internet, but not
               | to anything else on the LAN.
        
             | philsnow wrote:
             | I don't even want these devices making outgoing connections
             | to the internet. I have my router drop all outgoing
             | connection attempts from my IOT vlan. I can connect to the
             | cameras etc on there from other VLANs but that's the only
             | way packets get out.
        
             | fargle wrote:
             | you absolutely need to do this. we call it the "internet of
             | shit VLAN".
        
               | shiroiushi wrote:
               | This takes on extra meaning when you consider my
               | internet-connected automatic cat litter box.
        
         | NewsaHackO wrote:
         | Yea, that part is insane. At this point it is safe to say that
         | any non open source device that has access to you home network
         | and the Internet can function as a backdoor. Not to be a
         | conspiracy theorist, but I guarantee the CIA has a list of
         | common devices with this feature that they can use to get local
         | access in most houses.
        
           | BadHumans wrote:
           | Why are you assuming that only non open source devices are
           | vulnerable? We've seen enough open source vulnerabilities in
           | broad daylight to know that open source does not mean secure.
        
             | hiddencost wrote:
             | Open source is auditable, and tends to get fixed.
        
               | BadHumans wrote:
               | I don't think you can say it tends to get fixed because
               | you don't know the ratio between the number of
               | vulnerabilities and the ones that get fixed. Closed
               | source can also be audited. Auditing code for companies
               | is an entire business model.
        
             | prettyStandard wrote:
             | You have it backwards. They're assuming non-open source is
             | backdoor'ed. Not that open source isn't backdoor'ed.
        
               | BadHumans wrote:
               | I don't have it backwards. That is what I said. They are
               | assuming non open source is backdoored. That does not
               | mean open source is not also backdoored.
        
               | thfuran wrote:
               | No, you you said
               | 
               | >Why are you assuming that only non open source devices
               | are vulnerable?
        
               | stanleydrew wrote:
               | Yes, the word "only" is causing the confusion.
        
           | hackernewds wrote:
           | This is what makes me suspicious about Chinese home products
           | like govee and how cheap they are.
           | 
           | You're required to hard code in your SSID and Wi-Fi password.
           | And they consistently beg for your location, despite having
           | no need for it.
        
             | daniel_reetz wrote:
             | Now think about 3D printers like the Bambu. A machine tool
             | that can self-combust.
        
               | e40 wrote:
               | Shades of Iranian centrifuges.
        
               | dylan604 wrote:
               | Really really light shades. Destroying a country's
               | ability to produce weapons grade nuclear fuel vs
               | potentially burning down a hacker's/tinkerer's house; I
               | don't think these are any where near the same level
        
               | akira2501 wrote:
               | It's very similar. It's a nation state using exploits to
               | target individuals. It doesn't really matter why they're
               | doing it, they're promulgating an unsafe environment,
               | simply to create convenience for intelligence agencies.
               | 
               | As if they're at a lack of options when it comes to
               | addressing problems on the world stage like this. Stuxnet
               | was both an exceptionally morally lazy and destructive
               | act.
               | 
               | As an American citizen, I genuinely wish my government
               | did NOT do that.
        
               | dylan604 wrote:
               | Stuxnet was written to target a very specific bit of
               | equipment for a nefarious purpose. This is just lazy
               | development with no security or as a total after thought
               | or worse deliberate weakening. This is just the state of
               | software development/management we live in now. I really
               | feel one of us have misreading of the situation.
        
               | akira2501 wrote:
               | > Stuxnet was written to target a very specific bit of
               | equipment for a nefarious purpose
               | 
               | Except it didn't do that. It was found in dozens of
               | networks in multiple countries. The vulnerabilities were
               | discovered by other actors and used for other purposes.
               | 
               | The amount of collateral damage done here was far greater
               | than the value of the initial operation. Importantly
               | there were multiple different ways to achieve this
               | particular outcome none of which required us to abuse
               | vulnerabilities or release dangerous software to exploit
               | them.
               | 
               | > This is just the state of software
               | development/management we live in now.
               | 
               | Yes, and I think it's morally backwards, and I regret it.
               | 
               | > I really feel one of us have misreading of the
               | situation.
               | 
               | I simply refuse to accept the intelligence agency
               | marketing view of this action. It was incorrect. There
               | were other less morally conflicted ways to solve this
               | "problem."
        
               | Aurornis wrote:
               | Citation needed. Even at 100% duty cycle the heated bed
               | tops out at a stable, safe temperature. I know because
               | I've struggled to keep it hot enough for certain
               | materials.
               | 
               | Maybe you could argue that the hot end could be set to
               | melt down, ignoring the built-in safety mechanisms, but
               | thats a stretch for doing much more than breaking the
               | printer due to the way it's designed.
               | 
               | Regardless, if all of this still scares someone they can
               | run it in local-only mode without internet access.
               | 
               | The Bambu printer fear mongering is ridiculous.
        
               | dekhn wrote:
               | Actual citation:
               | https://forum.prusa3d.com/forum/original-
               | prusa-i3-mk3s-mk3-g... (read the whole thread and note
               | the picture) https://www.thissmarthouse.net/dont-burn-
               | your-house-down-3d-... some academic paper: https://www.r
               | esearchgate.net/publication/313025688_CONSUMER_...
               | 
               | I suspect the biggest problems happen when users make
               | their own mods and/or store their IPA or acetone next to
               | the printer.
               | 
               | Simply noting that you have trouble getting a heated bed
               | to stay hot does not mean that people's printers are not
               | catching on fire.
        
               | fragmede wrote:
               | But if you have to go out of your way to create a fire
               | hazard, that's a different situation than the Chinese
               | government having the ability to remotely cause fires in
               | homes in towns across America.
        
             | gcr wrote:
             | oh believe me, american manufacturers are absolutely no
             | better
        
             | fragmede wrote:
             | They need it. Because of design choices by everyone
             | involved, it's all gathered under the name "location
             | Services", and they are necessary to get the product to
             | work. I'm not sure if it's a bad name or not. Your phone's
             | bluetooth and wifi can be used to locate where you are, so
             | the backwards framing is that it's location services, which
             | isn't a lie, but it's misleading. Because the operating
             | system manufacturers are trying to simplify things for us,
             | it's "location services", not GPS, wifi, bluetooth. An app
             | with location services enabled could take your gps
             | coordinates and beam them home to a foreign government, and
             | it's entirely possible they do, but because of how
             | manufacturers have decided to name things so as to not
             | confuse consumers, apps need "location services" to use
             | bluetooth/change wifi.
        
             | Larrikin wrote:
             | Up until very recently all products wanting to use
             | Bluetooth LE required the location permission because BLE
             | beacons and similar can and we're used for location
             | triangulation. It was a marketed feature of beacons that
             | they could track your position down to the aisle in a store
             | and potentially advertise to you if you walked past
             | specific stores. There's finally a separate permission for
             | it but it can still be used to determine your location.
        
           | l33t7332273 wrote:
           | I wouldn't consider that a conspiracy theory, I would
           | consider it common sense that an intelligence agency has a
           | list of common potential sources of intelligence.
           | 
           | In fact it would be extremely surprising if they didn't have
           | that list.
        
         | therein wrote:
         | I created 3 new firewall rules after reading this comment.
        
         | binwiederhier wrote:
         | Devil's advocate. As someone who has developed a Linux based
         | appliance with over 100k live units across the globe, it seems
         | insane to NOT have access to the thing you're selling and that
         | you have to maintain. If your thing breaks or gets bricked by
         | an update, you will call support and expect them to fix it. You
         | don't want to send in your device or have a support technician
         | come to your house to fix it.
         | 
         | So yes, to the conspiracy theorists it may look like a secret
         | backdoor -- it sorta is. But in many cases I bet it's just a
         | safety net for developers and support to fix things.
         | 
         | I speak for myself and my own experience working for $oldjob.
         | Other companies or countries may of course use this
         | differently. And of course companies get sold and such so
         | you'll never know.
        
           | 01HNNWZ0MV43FF wrote:
           | The problem is it's gonna be a golden key system where
           | everyone who's worked there for the last ten years has a copy
        
             | binwiederhier wrote:
             | That is correct. But it is possible to design a system with
             | short lived auth tokens/keys and frequent key rotation. I
             | designed such a system at $oldjob for remote access (see
             | [1]). Obviously there is always a risk, and there are
             | always syseng/ops people with access. That is correct.
             | 
             | [1] https://blog.heckel.io/2019/11/19/providing-remote-
             | access-to...
        
               | number6 wrote:
               | Nice write up and a lot of gotchas you encountered
        
           | flaminHotSpeedo wrote:
           | That's a fair argument, but it doesn't appear that that
           | updates are high on sleep number's priority list:
           | 
           | > The hub includes Python 2.7.18. While extremely old (keep
           | in mind the Hub appears to have been last updated in 2018)
           | 
           | If we give them the benefit of the doubt, perhaps they
           | intended to to keep it up to date but ultimately compaines
           | need to either be transparent about their remote access and
           | manage it responsibly, which includes keeping the system
           | patched, or give up access
        
             | binwiederhier wrote:
             | > Python 2.7.18
             | 
             | I am not defending them for not keeping their stuff up-to-
             | date, but it is very common practice for embedded systems
             | to be hopelessly outdated. I've done what OP describes with
             | IPMI/BMC systems for $mainboardmanufacturer1 and
             | $mainboardmanufacturer2 (both really big name brands), and
             | their BMC systems were equally outdated. It was almost
             | comical, but really sad at the same time.
             | 
             | Moral of the story is to firewall things off really well, I
             | suppose.
             | 
             | At $oldjob, I designed an upgrade mechanism to do A/B image
             | updates so things were always up to date, or at 2-3 weeks
             | out of date. See [1].
             | 
             | For small embedded systems that do not have enough
             | space/bandwidth, this may not be feasible though.
             | 
             | [1] https://blog.heckel.io/2019/09/18/image-based-upgrades-
             | upgra...
        
               | flaminHotSpeedo wrote:
               | I know I'm preaching to the choir, but I do prefer not
               | having to treat my bed as a hostile device on my network
        
               | bitmasher9 wrote:
               | Either treat your devices as potentially hostile or
               | simply don't connect your bed to a network.
        
               | hughesjj wrote:
               | I mean it's not like sleep number can tell when you're
               | having sex or sleeping or anything....
               | 
               | Er, I mean okay, well at least they're budget
               | friendly....
               | 
               | Well at least they don't have an ssh server constantly
               | running in the background or something
        
               | nucleardog wrote:
               | Even if it didn't have the intentional backdoor... you
               | probably should be treating it as hostile anyway.
               | 
               | Even where not intentionally hostile, not intentionally
               | privacy invading, not trying to fetch updates so it can
               | show you more ads, not... most of this stuff is so
               | hopelessly out-of-date and full of security
               | vulnerabilities it's only not hostile out of luck.
               | 
               | I don't connect anything to WiFi unless absolutely
               | necessary. And by that I don't mean "the device demands
               | it" (I just won't buy the damn thing) but "it's a core
               | part of the functionality I'm asking of it". I'll prefer
               | zwave/zigbee, Bluetooth, or something else wherever
               | possible when communication is required. (If I were
               | forced to use this bed and it had no manual controls I
               | would definitely have used Bluetooth, avoiding this whole
               | issue.)
               | 
               | And even for the devices that do get a WiFi connection...
               | they run entirely isolated, on a separate SSID and VLAN
               | from my normal devices and traffic, and with a whitelist
               | for what traffic is allowed.
               | 
               | As far as I'm concerned the only difference between this
               | bed and the other devices is that we know about the
               | issues with this bed. We have no reason to believe that
               | the other devices are any better, and in fact a pretty
               | large body of evidence suggesting that they're probably
               | not.
        
               | TheCraiggers wrote:
               | > And even for the devices that do get a WiFi
               | connection... they run entirely isolated, on a separate
               | SSID and VLAN from my normal devices and traffic, and
               | with a whitelist for what traffic is allowed.
               | 
               | This is what I do today, and honestly I'm about to give
               | up. We lost. Trying to get stuff like airplay / DLNA to
               | work via mDNS is already impossible across subnets, and
               | telling family to switch networks if they want to control
               | X with their phones is just a shit solution. I have to
               | disable 90% of my vehicle's "infotainment" screen to not
               | feel spied upon, and which breaks the app I can use for
               | remote starts, etc.
               | 
               | Maybe when the "Mega-Hack of 2025" happens and all IoT
               | devices go nuclear something will change. But for now, if
               | you buy a device it expects to be on one giant /24 and
               | anything different creates problems. I'm starting to
               | spend way more time than I want maintaining all the
               | various pieces of networking glue that keeps my devices
               | and home automation functioning. It's no longer fun, and
               | I'm tired of fighting it.
               | 
               | I still have an ancient sleep number bed, with no
               | connectivity. It's leaking, and old enough to drink. I'd
               | like to replace it, but still can't bring myself to do it
               | because of articles like this.
               | 
               | I've never felt more like Abe Simpson yelling at a cloud.
        
             | CJefferson wrote:
             | While 2.7.18 hasn't been updated since 2018, it's also the
             | last version of Python 2.
             | 
             | I've got several programs stuck in 2.7.18, as they have
             | sizable dependancies that never got updated to Python 3 --
             | unless I'm willing to rewrite several large Python
             | packages, I'm stuck here forever. As long as the program
             | isn't network connected, I don't see a problem with fixing
             | a Python version, and set of packages, and leaving the
             | software running forever.
        
               | flaminHotSpeedo wrote:
               | Oh good catch, I thought python 2's depreciation was more
               | recent, time flies I guess!
        
           | Aurornis wrote:
           | > As someone who has developed a Linux based appliance with
           | over 100k live units across the globe, it seems insane to NOT
           | have access to the thing you're selling and that you have to
           | maintain.
           | 
           | I've developed Linux devices selling that many units (and
           | more) and I'm baffled that anyone would think this is a
           | viable way to handle things at this scale.
           | 
           | Units like this should have a firmly read-only Linux firmware
           | that can only be changed by signed updates. The only data you
           | would actually get or modify is the diagnostic data or the
           | contents of the settings. Both of those can be sent through
           | mechanisms that shouldn't require SSH access.
           | 
           | The correct way to handle this is with a debug info feature.
           | Put something in the app that will zip up logs and
           | configuration files and send them in for support, with the
           | user's explicit permission obviously. If you can't figure it
           | out from logs, you can use their config files to clone the
           | situation on a device in the office.
           | 
           | The bigger issue is: Who are you going to task with SSHing
           | into customer devices? With 100K or more people filing
           | support requests, it would be insane to have engineers
           | handling those requests with anything having to do with SSH.
           | It would be equally insane to hand off access to customer
           | support people and give them the keys to SSH into customer
           | devices.
        
             | binwiederhier wrote:
             | I agree that that is the gold standard. Having an immutable
             | Linux that is well tested on your own hardware and upgraded
             | like that.
             | 
             | At the time I inherited a system that had 30-50k units
             | deployed and was updated via Debian/APT. Older units were
             | running Ubuntu 10.04 (it was 2016) and were hopelessly
             | outdated. We managed to pull every single device to Ubuntu
             | 16.04 and designed a fully automated image based update
             | mechanism for them (I've linked it in other posts). We
             | tried for read only base systems, but it was too tricky, so
             | images stayed read-write, with migration of configs across
             | upgrades.
             | 
             | At the time, customers even had access via SSH (similar to
             | NAS devices these days).
             | 
             | I think what you are describing works for well defined
             | hardware with a medium complexity software stack, or at
             | least something that is limited in terms of epipheral
             | device usage.
             | 
             | The appliance I was managing was heavily using raided disk,
             | ZFS, loops, dmsetup, and many other Linux tools that we
             | have all seen fail in horrible ways.
             | 
             | Not having SSH access, and not being able to diagnose
             | lockups or hanging progress (D state issues) in a live
             | system would have severely crippled us in being able to fix
             | these issues. Many of them I'm sure we would not have been
             | able to. We had failing disks, slow disks, failing RAM,
             | hanging loop devices, corrupt loop devices, hanging ZFS,
             | hanging ZFS, hanging ZFS, many of its bugs we fixed
             | upstream, and and and...
             | 
             | On top of that, we had a "bring your own device" product
             | that literally allowed people to use whatever hardware they
             | want. That makes the read only firmware thing ever
             | trickier.
             | 
             | As said in the beginning, I agree with you in principle,
             | but there are many cases in which it's not as black and
             | white. And I can fully understand the rationale of
             | providing remote access.
             | 
             | Side note: I would have never expected to be down voted on
             | HN for expressing an opinion in a respectful manner about a
             | subject that I have knowledge about, just because it is the
             | "unpopular" opinion. On Reddit, I'd expect to be downvoted
             | for something folks don't like, but on HN in thought the
             | button is just for use against trolling and such.
        
               | A4ET8a8uTh0 wrote:
               | I personally disagree with you, but I absolutely
               | appreciate the perspective presented along with
               | reasonable rationale.
        
               | freedomben wrote:
               | Re your side note, yes this is the new HN. People use the
               | downvote as a lazy "I disagree". On the plus side, that's
               | mainly the people who tend to read and react within the
               | first 30 to 60 minutes of a comment being posted. After
               | that the votes usually right themselves.
        
           | toast0 wrote:
           | If you sold it, you should not have remote access to it.
           | 
           | Auto-update is de facto isomorphic with remote access
           | capability but that doesn't mean you should have a remote
           | shell. At most, maaaaybe a way for the customer to enable a
           | shell for developer support.
           | 
           | Otherwise, a/b setup to avoid remote bricking, DFU or
           | whatever current standard for customer driven unbricking in
           | exceptional cases. But really, test all the forward and
           | reverse update cases and keep a handful of samples of all
           | shipped hardware so you can make sure everything actually
           | works, and you can figure out how to fix it when you mess it
           | up. Always test upgrades starting from factory fresh with all
           | the versions you ever shipped from the factory. (I've run
           | into products where several updates in, version X would work
           | or not based on the original version from the factory forever
           | ago because of original config or something that didn't get
           | migrated properly but never caused problems until recently).
        
             | TheCraiggers wrote:
             | If you have the ability to update firmware, you have the
             | ability to _add_ remote access whenever you like. You 're
             | already trusting the vendor either way.
             | 
             | That said, this current situation of an always-on SSH
             | connection/backdoor is just begging to be exploited by an
             | irate employee, curious intern, or worms. It's impossible
             | to know what sort of safeguards the vendor has in place, if
             | any.
             | 
             | Putting a lock on a nuke is good, but not building the nuke
             | at all is better.
        
           | jtriangle wrote:
           | And I'm sure every one of those 100k devices has a unique ssh
           | key right?
           | 
           | Surely you can see the problem.
        
             | binwiederhier wrote:
             | Not just that's they have
             | 
             | - per session ssh keys that are valid for only 6 hours
             | 
             | - all ssh sessions are audit logged and have to go through
             | jump servers tied to tech roles
             | 
             | - all sessions fully monitored via "script" and can be
             | replayed
             | 
             | You can also see a write-up here:
             | https://news.ycombinator.com/item?id=40840040
        
           | protocolture wrote:
           | It does seem insane. But the support engineer having local
           | network access after remoting in without the customers
           | willing consent also seems insane. Its obviously there so
           | they can fix these devices, but shortcuts made for engineers
           | are such a common security risk.
           | 
           | Ideally you would have a backdoor on the device thats open
           | only to the local network. User runs an app on their PC,
           | provides willing consent for someone to complete a support
           | task by providing an OTC to the engineer. App goes and
           | discovers the device, and hosts the session for the engineer.
           | If the user cant perform such a task they can probably buy a
           | device with one button on it that will, or pay for a callout
           | or return.
        
         | lmm wrote:
         | In my book if your setup grants access to anyone on your
         | network then it was already insecure. Your wifi is too big a
         | perimeter to defend; lock down the stuff you care about
         | instead.
        
       | cs702 wrote:
       | Wait, this is about _an actual bed_ -- you know, the kind that
       | you sleep on -- that _runs an SSH server on Linux_?
       | 
       | W. T. F. !?
        
         | itake wrote:
         | how else would you record and transmit measurements to a
         | server? lower-level hardware and software is expensive to
         | develop on and potentially be difficult to update.
        
           | hpen wrote:
           | How about just don't run SSH?
        
           | AnimalMuppet wrote:
           | _I don 't need my bed to transmit measurements to a server_.
           | I need my bed to be comfortable to sleep on. I need exactly
           | zero interactions with a server for that.
           | 
           | So, yeah, back to the question. Why does my bed have an SSH
           | server? Because it needs to be able to talk to some machine
           | on the internet. And why does my bed need that? _It 's a
           | bed._
           | 
           | [Edit: Wait a minute. Even if I do want to transmit
           | measurements, why is _my bed_ running a server? My bed should
           | be running a _client_.]
        
             | Aurornis wrote:
             | > I don't need my bed to transmit measurements to a server.
             | I need my bed to be comfortable to sleep on. I need exactly
             | zero interactions with a server for that.
             | 
             | Then don't buy this specific bed?
             | 
             | These features are part of why people buy this product.
             | Nobody is accidentally purchasing this as "just a bed" and
             | then discovering that it has an app and smart controls as a
             | surprise later.
             | 
             | > And why does my bed need that? It's a bed.
             | 
             | This is a very dishonest take. If you don't understand or
             | don't want the product, then don't buy it. But the smart
             | controls exist because people (other than you) want them.
        
             | fragmede wrote:
             | If you sleep alone, live in a comfortable climate, and
             | don't have any sleep problems, or back pain problems, I'm
             | happy for you. Your experience isn't universal though and
             | sleep is the most important thing you can do for your body
             | so getting good sleep is paramount. Furthermore, having
             | data on how well you slept is very useful for figuring out
             | your own body. We wear devices to log how many steps we
             | take, a device to log how you sleep is just an extension of
             | that.
             | 
             | Are you even taking care of yourself if you don't have one?
             | 
             | Okay no but seriously, a smart bed that helps you get
             | really good sleep at night so you wake up rested and ready
             | to face the whole world may not be your cup of tea, but
             | that's what they're selling. You could get that without all
             | the technology, but what's the sleep company going to do
             | with the data? Know that you sleep at night? What's the
             | privacy danger in that?
        
               | ungreased0675 wrote:
               | The bed doesn't need a cloud connection to do any of
               | those advanced features. A phone app and BLE connection
               | (like a smart watch) could easily handle it.
        
         | Aurornis wrote:
         | Is this your first exposure to Linux-based embedded devices?
         | It's very common to run Linux on embedded devices. There are
         | even variants of Linux designed for microcontrollers.
        
         | dekhn wrote:
         | There never was a Year of Linux on the Desktop, but there's
         | been a year of linux on the phone, linux on the car, linux on
         | the submarine, linux on the fridge, and so it's no surprise
         | there's a year of linux in the bed.
         | 
         | Anything sufficiently complex (this bed:
         | https://en.wikipedia.org/wiki/Sleep_Number#Sleep_Number_Bed) is
         | going to have a microprocessor, and it makes sense to have an
         | OS that lets you interact with it via a serial console, with
         | Linux being the cheapest and most commonly supported OS in that
         | context.
        
           | userbinator wrote:
           | It's an inflatable mattress with an adjustable pressure
           | regulator. That's pre-computer-age technology. The only thing
           | that requires a computer is to make the adjustment remote.
           | Why would you want to adjust your bed remotely?
        
             | defrost wrote:
             | The only 'why' that springs to mind is messing with
             | friends, relatives, AirBnB guests remotely while filming it
             | on the webcam .. all very problematic.
             | 
             | Still, imagine an uninflated mattress half under the actual
             | mattress, inflated at midnight to tip someone out of bed.
             | 
             | Juvenile college humour, yes. Market size low but likely
             | non zero.
        
           | metadat wrote:
           | That is one crazy stock graph (zoom out to max):
           | 
           | https://www.nasdaq.com/market-activity/stocks/snbr
           | 
           | Bedco went up 10x during the pando.
        
         | Youden wrote:
         | You think that's bad, you should see Eight Sleep.
         | 
         | Not only do they run an SSH server on their embedded Linux
         | device but the entire Linux component is unnecessary. All it
         | really does as far as I can tell is act as a bridge between an
         | STM32 and a process long-polling AWS for commands. They could
         | have achieved the same thing with less cost and complexity with
         | an ESP32.
         | 
         | Also bad: they engineered it maliciously, making it completely
         | and unnecessarily dependent on the cloud. All the sensor data
         | is streaming in real time to the cloud and the only way to send
         | it commands is through AWS.
         | 
         | If a Chinese company did this, the company would be cancelled.
         | 
         | In fact I'll be shocked if their product isn't blown out of the
         | water in a couple of years by a Chinese copy that can function
         | entirely offline and despite that massive disadvantage, can
         | implement advanced features that Eight Sleep charges $200/yr
         | for, like an alarm clock.
         | 
         | Thankfully their nonsense resulted in it being pretty easy to
         | hack. There's a GitHub project to replace parts of the
         | firmware.
        
           | bitmasher9 wrote:
           | > Also bad: they engineered it maliciously, making it
           | completely and unnecessarily dependent on the cloud. All the
           | sensor data is streaming in real time to the cloud and the
           | only way to send it commands is through AWS.
           | 
           | Why would they unnecessarily add local processing
           | capabilities to their data collection tool? The entire point
           | was collecting the data.
        
           | kedean wrote:
           | > If a Chinese company did this, the company would be
           | cancelled.
           | 
           | It's worth noting that this is the first time I've ever heard
           | of this company in my life. Something can't be "cancelled" if
           | it has no mind share.
        
       | Animats wrote:
       | OK, not buying Sleep Number.
       | 
       | I slept on inflatable mattresses for years, until the company
       | making them started outsourcing to China and the seams on the
       | internal baffles broke on two mattresses.
        
       | peteforde wrote:
       | Funny part to me is that I fully assumed that this was a post
       | about hacking Eight Sleep beds by someone who didn't want to
       | explicitly name the company, presumably for vague legal reasons.
       | 
       | Then I got to a picture of an apparently real "Number Sleep Hub"
       | and my mind was blown. WTF are we in a timeline so weird that
       | there are two companies making water cooled beds, one is called
       | Eight Sleep and the other is Sleep Number? It's like the RNG for
       | this instance had a bad seed.
        
         | fragmede wrote:
         | It turns out naming things is an unsolved problem outside of
         | computer science as well.
        
           | v101 wrote:
           | Also in computer science, if one looks at all stupid product
           | / framework / language names.
        
         | yencabulator wrote:
         | You assume it's a funny coincidence, I'd say Eight Sleep picked
         | a name that as a easy to confuse with Sleep Number as they
         | could without getting immediately sued.
        
         | Aardwolf wrote:
         | I had never heard of either so thought the title was a metaphor
         | for "how to get root access to your brain to improve sleep
         | quality"
         | 
         | I sure hope these beds have tactile controls you can feel and
         | use in the dark, and don't require pulling out a smartphone in
         | front of your face while trying to sleep to adjust them,
         | because bed/matress manufacturers for sure must know what is
         | good and bad for sleep quality
        
           | miah_ wrote:
           | The older models had a corded control with a red led display
           | that didn't destroy your eyes at 3am.
        
           | tiltowait wrote:
           | I agree the interface should be simple to operate in the dark
           | without being blinding, but I'm left wondering how common
           | late-night adjustments are. I imagine it tends to be pretty
           | "set it and forget it" for most people.
        
         | RandallBrown wrote:
         | Sleep Number gets its name from the firmness controls on their
         | mattress. You pick your "sleep number" and your partner picks
         | theirs on the other side of the bed.
        
         | Thorrez wrote:
         | > two companies making water cooled beds
         | 
         | Sleep Number aren't water cooled I don't think.
        
         | eragone wrote:
         | There's actually another company called SleepMe (or maybe
         | that's the product...?) that makes a mattress cover that's
         | water cooled (or warmed)
         | 
         | As a night shifter it's completely life changing in allowing me
         | to sleep comfortably during the day. 100% worth the price to me
        
           | kotaKat wrote:
           | There's also BedJet, who makes a fancy-pants bed blower for
           | between your sheets. It's running on an esp32 inside of
           | itself to control the heater and the blower and the remote
           | control, but they didn't quite make it as smart as I'd like.
           | 
           | Fortunately I can just use the ESPHome Bedjet module
           | (https://esphome.io/components/climate/bedjet.html) and just
           | yell out in the middle of the night if I'm too cold.
        
         | rsynnott wrote:
         | People are beginning to forget about waterbeds, thus allowing
         | space for doing something weird with beds again, I assume.
        
         | kotaKat wrote:
         | Nah, Sleep Number beds are basically just an "air bladder" (aka
         | a giant vaguely mattress-shaped rectangular bag) that sit in a
         | tomb of foam.
         | 
         | https://i.ytimg.com/vi/pMiTq6YkJ2c/maxresdefault.jpg
         | 
         | People are literally paying a couple grand for a fancy
         | adjustable airbed with some foam on top of it.
        
           | josefresco wrote:
           | I get your point but is there a significantly cheaper
           | alternative? As far as DIY goes, I don't think I'd be able to
           | replicate a "Sleep Number" bed with my air mattress and foam.
        
             | sadops wrote:
             | The cheaper alternative is a regular mattress.
        
           | kevin_thibedeau wrote:
           | I was forced to buy one against my will. The new models are
           | significantly better than they once were and it feels like a
           | regular bed now rather then two air mattresses with some
           | loosely arranged foam dividers. They've dumbed down the app
           | and made the data reporting worse but it used to give decent
           | stats on breath and heart rates.
        
         | infecto wrote:
         | Sleep Number the brand has been around I think since the 80s?
         | Never had one personally but definitely an old brand though
         | maybe if you are not in the US you would never have heard of
         | them.
        
         | sadops wrote:
         | I didn't read the article, so I too thought the title was
         | something unrelated and ridiculous.
        
       | KennyBlanken wrote:
       | > r: Following this guide will require modifying internal files
       | on your Sleep Number hub. This will void your warranty
       | 
       | People, stop spreading this BS.
       | 
       | Just like those stickers that say "warranty void if removed" are
       | not legally enforceable, nothing "automatically" invalidates your
       | product's warranty except misuse or poor maintenance.
       | 
       | If your Smart Bed stops working, you having poked around in the
       | controller does not relieve the manufacturer from their warranty
       | obligations (including implied warranty.) The onus is on them to
       | prove that you damaged it, subjected it to "unreasonable" use, or
       | did not properly maintain it.
       | 
       | You fry the bed's brain trying to hook up a JTAG when you
       | accidentally bridge 5V to a 3.3V logic circuit? That's on you.
       | 
       | The controller fails because the power supply blows? The fact
       | that you installed a JTAG header, googly eyes, and painted it
       | pink is irrelevant. They need to fix your shit.
       | 
       | Even if you modify the firmware, _it 's on them to prove your
       | modifications caused the failure_.
       | 
       | Would you expect to have your laptop's warranty invalidated
       | because you use it to game (which generates lot of heat)? Of
       | course not. How about if you install Firefox? Or install Linux?
       | Again, of course not. So why do you think the rules change just
       | because a device is "dumber"?
        
         | gcr wrote:
         | There's a difference between law on paper and law in practice.
         | If the manufacturer refuses to honor the warranty, there's very
         | little customers can do.
        
           | userbinator wrote:
           | https://en.wikipedia.org/wiki/Magnuson%E2%80%93Moss_Warranty.
           | ..
        
             | lacksconfidence wrote:
             | That's wonderful, but it doesn't change the lived
             | experience of warranty's.
        
           | lmm wrote:
           | Small claims court is cheap and easy, and often the only way
           | to get them to honour the warranty even if you haven't messed
           | with anything.
        
       | surfingdino wrote:
       | Cool, but I liked this bed-related hack better
       | https://techcrunch.com/2009/12/12/newlywed-sex-tweets/
        
       | whatsakandr wrote:
       | I'm interested if anyone has pulled the same thing with eight
       | sleep. Not having access to control my bed's temperature because
       | my internet is out bothers me deeply.
        
         | dyauspitr wrote:
         | What fresh hell is that. Why does it need to reach out to the
         | internet?
        
           | pfych wrote:
           | To ensure you've paid your monthly subscription fee (Not
           | joking - the mattress cover has a subscription)
        
             | dailykoder wrote:
             | What. The. Fuck. Why would anyone buy such thing then? I
             | really don't get it.
        
               | blitzar wrote:
               | The intersection of _lots of money_ and _moron_ is where
               | most product-market fit exists. It also happens to be a
               | large addressable market.
        
             | dyauspitr wrote:
             | What sort of person is buying this? Do they give away the
             | mattress for some really cheap price initially?
        
               | gimmeThaBeet wrote:
               | No it's actually 2-3k+ usd. I had done some cursory
               | considering of it over the past few months because it
               | seems like a potentially reasonable solution to a real
               | problem I struggle with.
               | 
               | But yeah part of it is like, it's really weird. If you
               | asked me how much consistently better sleep would be
               | worth, the answer is how much do you want?
               | 
               | But phrase that as "Bed as a service" and my reflex is
               | "you're kidding, righr?"
        
               | dyauspitr wrote:
               | What problem are you trying to solve if you don't mind
               | sharing. It sounds like you're paying for sleep tracking
               | but couldn't you just do that with something else like an
               | Apple Watch?
        
               | snickell wrote:
               | They run cooled/heated water through them, the idea being
               | that temperature can trigger / lengthen certain phases of
               | sleep. Think getting into a warm bed that gets colder as
               | you go into deep sleep, and then when the night is done
               | warms up again for wakeup. In my case, it seems to work
               | really well, but I have the same resistance/frustration
               | with the ongoing subscription.
        
               | elzbardico wrote:
               | It shouldn't be too complicated for a motivated
               | hobbyist/hacker to retrofit it to run it with some custom
               | DIY hardware eschewing the subscription need completely.
               | 
               | After all, it is just a couple of pumps, a heat pump
               | and/or a resistance and some sensors.
        
               | v101 wrote:
               | > If you asked me how much consistently better sleep
               | would be worth, the answer is how much do you want?
               | 
               | Get to bed early, sleep cool, don't use an alarm? (also
               | don't work shifts)
        
               | namaria wrote:
               | > don't use an alarm? (also don't work shifts)
               | 
               | You forgot 'don't be poor'
        
               | pilchard123 wrote:
               | Shouldn't "bed as a service" be a hotel?
        
             | indoordin0saur wrote:
             | It's no doubt also collecting data on you.
        
         | gumby wrote:
         | I use a blanket which handles 95% of my cases; in my ski cabin
         | I have a cheap electric mattress pad that handles the other 5%
        
         | indoordin0saur wrote:
         | I was going to buy an Eight Sleep and then I immediately lost
         | interest when I realized they pull this shit. If I'm paying you
         | over $1000 for a mattress cover, I'm not paying you "rent"
         | money just so the thing will work.
        
       | grotorea wrote:
       | Anyone else getting cloudfare blocked on TFA?
        
         | grishka wrote:
         | I am getting blocked. What is "TFA"?
        
           | MissTake wrote:
           | https://www.urbandictionary.com/define.php?term=TFA
        
           | jcla1 wrote:
           | https://news.ycombinator.com/item?id=19781756
        
         | alister wrote:
         | I tried 2 different IP addresses from Brazil and they got
         | blocked.
         | 
         | I tried an IP address from the USA and another from Canada, and
         | both worked correctly.
         | 
         | The message you get when you're blocked is:
         | Sorry, you have been blocked       You are unable to access
         | dillan.org       Performance & security by Cloudflare
         | Why have I been blocked?       This website is using a security
         | service       to protect itself from online attacks.       The
         | action you just performed triggered       the security
         | solution. There are several       actions that could trigger
         | this block       including submitting a certain word or
         | phrase, a SQL command or malformed data.
         | 
         | which is false since I wasn't doing any of the things they
         | list.
         | 
         | I wonder why they think that Brazil and other countries
         | shouldn't be reading this site? Is the owner of the site able
         | to geo-target which countries he wants his site to be shown in
         | via Cloudflare?
        
           | grotorea wrote:
           | Blocking countries seems to be possible. No idea why do that
           | on a personal blog, maybe a DDoS?
        
       | blopker wrote:
       | There's a similar method to get into an Eight Sleep Pod 3 [0].
       | This requires less extra hardware though since some models come
       | with a MicroSD card that you can modify. The method used in TFA
       | might be a good way to get root on Pods without the card. That
       | being said, I just learned that while Eight Sleep does sign their
       | firmware updates, they also send you the private key used to sign
       | the update in the same package.
       | 
       | [0]: https://github.com/bobobo1618/ninesleep
        
         | ShakataGaNai wrote:
         | Ironically this makes me more likely to buy one. If I can make
         | the smart thing local and/or home assistant controlled, and
         | kill their internet connectivity... I'm thinking that isn't so
         | bad.
         | 
         | Don't get me wrong $2-4k is _steep_ , but if it's a one-time
         | for a decade or so, that's reasonable. But $4k plus you want
         | $25/mo? Just fluff right off.
        
       | Animats wrote:
       | Next, ransomware. "Pay us $1000 or you won't be able to sleep in
       | your bed for the next month".
        
         | m463 wrote:
         | Wouldn't subscriptions be next?
        
           | zdragnar wrote:
           | Same thing, really
        
           | wil421 wrote:
           | Pay us $50 a month and we'll keep the other hackers at bay.
           | 
           | Is there a ransomware protection racket yet?
        
             | mattigames wrote:
             | Yeah, they have existed for a long time, the are called
             | anti-viruses.
        
       | dailykoder wrote:
       | I don't have to do any hacks to use my Lidl mattress. It just
       | works. Am I doing something wrong here?
        
         | blitzar wrote:
         | Have you considered a mattress topper?
        
       | protocolture wrote:
       | >The hub communicates with the Sleep Number servers by opening an
       | SSH tunnel and providing a reverse tunnel back to the hub that
       | their developers can use to connect to the hub and do maintenance
       | when needed.
       | 
       | Kinda interested just to see what the parameters of this are
       | like. Is it using PubkeyAuth or just password? Is it tunnelling
       | home via ip or dns?
       | 
       | If everything is just right, I can imagine the setup for the most
       | hilarious DNS hijack in human history.
       | 
       | In the immortal words of Homer Simpson. Bed goes up. Bed goes
       | down.
        
         | kotaKat wrote:
         | Tired: SIM swapping attacks against cryptobros.
         | 
         | Wired: Since Sleep Number beds get tied to orders, break into
         | Sleep Number, find your target, SSH into their bed, and pivot
         | into their home network to steal their crypto wallets.
         | 
         | After all, everyone always hides their money under their
         | mattress ;)
        
           | internet101010 wrote:
           | I am not a crypto bro but was the victim of a sim swap attack
           | recently. It was really annoying but at the same time kind of
           | funny because they literally only went after the 2FA app
           | (Authy) once they stole my number, which thankfully didn't
           | have anything meaningful attached to it.
        
         | prmoustache wrote:
         | >The hub communicates with the Sleep Number servers by opening
         | an SSH tunnel and providing a reverse tunnel back to the hub
         | that their developers can use to connect to the hub and do
         | maintenance when needed.
         | 
         | Shouldn't bed owners sue them if they haven't been warned of
         | that fact prior to purchase? Getting illegitimate access to
         | your network and backdooring it is criminal offense right?
        
           | mtoner23 wrote:
           | I'm sure there was a T&C that included all this and you waive
           | rights to complain about this or join a class action about
           | it.
        
             | flyingpenguin wrote:
             | T&C being enforceable and acknowledged by court systems is
             | a true failure of modern society. There should be a hard
             | character limit on any enforceable T&C agreed to by
             | individuals.
        
       | alduin32 wrote:
       | With climate change and our general impact on environment
       | worsening each year, our relationship with technology is starting
       | to be like a big elephant in the room. Do people really think a
       | sustainable and equitable society is possible while having
       | microprocessors and telecommunication devices in beds ?
       | 
       | This kind of luxury will always be reserved to the wealthiest in
       | society, and its availability dependent on the relentless
       | exploitation of land and human beings.
        
         | pavel_lishin wrote:
         | Why does it sound like you're proposing that nobody should have
         | fancy things, instead of proposing that everyone should have
         | access to fancy things?
        
           | ikr678 wrote:
           | If everyone has fancy things then there will be even less
           | environment to go around.
        
         | coldpie wrote:
         | I empathize with what you're saying, but "we shouldn't have
         | things people want" is a solution to climate change in the same
         | way that "we shouldn't have gravity" is a solution to air
         | travel. It's not gonna work. Find another approach.
        
         | CyberDildonics wrote:
         | > Do people really think a sustainable and equitable society is
         | possible while having microprocessors and telecommunication
         | devices in beds ?
         | 
         | You realize the cost of the chips in the bed are a lot less
         | than the cost to even ship a mattress right?
        
           | XorNot wrote:
           | Puritan morality is so deeply embedded in our culture people
           | don't even realise they're repeating it.
           | 
           | If I told them they couldn't have a coal-fired home
           | blacksmithing setup "for the environment" then this would
           | seem unfair.
           | 
           | But a 10c microchip? Suddenly this must be evidence of
           | excess! (Even though the price represents that fact that it's
           | a staggeringly efficient use of resources that also has
           | supply-swappable carbon impact).
        
         | colechristensen wrote:
         | It's an overpriced bed with a tiny computer in it. It uses the
         | same resources as a cheap bed + a tiny computer and lots of
         | people have those. There's no extra exploitation going on here,
         | these beds are just expensive because they're paying a bunch of
         | engineers to do questionably necessary things.
         | 
         | The problem with activists is so many of them are foolish and
         | just like complaining about things. Go find an actual problem
         | to solve.
        
       | miah_ wrote:
       | Pretty wild. I used to have one of these beds, but it was before
       | everything got "smart". It had two corded controller's hooked up
       | to the pump. The controller displays the number and had up/down
       | arrow buttons to adjust.
       | 
       | No internet required. No Linux powered microcontroller required.
       | My bed couldn't get hacked. I slept in comfort.
        
         | asciii wrote:
         | This is the kind of bed I would buy. Imagine having to buy a
         | bed with access for Wi-Fi. That's crazy because that's more
         | hardware needed than just plugging the freaking thing in the
         | wall.
        
         | robin_reala wrote:
         | What I'm trying to teach myself to do whenever I think "this is
         | ridiculous overcomplexity" is to imagine whose life it might
         | make simpler.
         | 
         | Let's assume I have some sort of motor disability: it could be
         | anything from Parkinsons to quadraplegia. Having a bridge out
         | to a common controller that maybe works on speech or some other
         | standardised input method that works for your disability is a
         | massive benefit. And avoids having to deal with the
         | complexities of each individual products' inability to meet
         | your own accessibility needs in different ways.
         | 
         | So much smart home stuff is basically pointless to those of us
         | fortunate enough to have currently able bodies, and a lifesaver
         | to the rest.
        
           | sadops wrote:
           | Have you considered talking to people instead of imagining
           | their response? Because regular people seem kind of fed up,
           | and we're still over here cramming insecure computers into
           | everything.
        
             | shepherdjerred wrote:
             | Those outside of tech could not care less about anything
             | discussed on this forum.
             | 
             | They may care in a passive sense -- the same way that most
             | people care about social causes. They (myself included)
             | agree that some situation is bad, but they don't
             | inconvenience themselves improve the situation.
             | 
             | As an example, many people have some story about creepily
             | being shown ads after talking about something with a
             | friend. It's concerning to them, but no action is taken.
        
           | scottLobster wrote:
           | I'm currently recovering from some foot and knee injuries
           | that seriously limited my mobility for the past few weeks,
           | the fact that I can adjust my thermostat from my phone has
           | been a Godsend.
        
           | oooyay wrote:
           | You certainly don't need a cloud defaulted device in order to
           | do what you describe. There are plenty of assistants, Google
           | and Alexa being two, that can talk to things on your local
           | network with a REST API. That controller also has a gig of
           | memory, plenty enough to run a little API.
           | 
           | What manufacturers like about cloud enabled devices is that
           | they can automatically upgrade the firmware and they can get
           | semi-accurate counts for usage.
        
             | nanidin wrote:
             | They also like the possibility of future MRR.
        
             | ufmace wrote:
             | I think this goes right back to the parent's point.
             | 
             | I presume you personally could set that up. I probably
             | could too. But 99% of the world isn't tech experts and
             | can't do that. Or fix it if something goes wrong. Even if
             | you can, you might just want to go to bed and not have to
             | debug a broken assistant integration first.
             | 
             | The benefit of cloud integration, for that 99%, is that
             | there is a professional out there to keep it working.
        
               | oooyay wrote:
               | Maybe. My point is that there wasn't really an attempt at
               | solving those things locally first. They just went
               | straight to cloud with the reasoning you mentioned.
        
               | beardedmoose wrote:
               | Until they just decide to stop supporting it one day
               | until you buy a new $4k bed.
        
               | mgkimsal wrote:
               | A friend of mine spent $10k on a sleep number bed a
               | couple years ago. I'm not sure I could ever get a restful
               | night sleep again on a $10k bed, thinking about the cost!
               | ;)
               | 
               | I got a fancy new one a bit later with an adjustable
               | frame and remote control and all that... $2200, and even
               | _that_ felt crazy expensive!
        
               | ufmace wrote:
               | Well yeah. But:
               | 
               | 1. That's exactly why I prefer a plain old analog
               | mattress that needs zero tech or support from anyone ever
               | 
               | 2. Even with that being the case, for the average
               | consumer who wants an electronic/controllable bed, it's
               | still a better deal than anything that requires a custom
               | home automation setup. Check out the prices for hiring
               | somebody who can actually troubleshoot that.
        
             | nox101 wrote:
             | > What manufacturers like about cloud enabled devices is
             | that they can automatically upgrade the firmware and they
             | can get semi-accurate counts for usage.
             | 
             | What they like is that they can charge you a recurring
             | subscription for "service"
        
           | ics wrote:
           | This is a nice point that is often missed in the cacophony of
           | complaints about complexity. If companies are not simply
           | _leveraging_ complexity for the sake of profit, restricted
           | use or repair, etc. then these complaints, as feedback,
           | should still be worthwhile in order to _employ_ complexity.
           | 
           | Extending this idea to how devices operate or are maintained
           | it seems like we're still in a nascent stage. I benefit from
           | a few smart devices but even in a very simple setup, things
           | fail sometimes and then I have to fix it. My mom might
           | benefit from some of these things but she feels better off
           | foregoing the benefits because resolving any issue would be
           | far more costly or impractical.
        
           | Forbo wrote:
           | That's all well and good until it's smothered in surveillance
           | capitalist garbage. There's a thin veneer of helping the
           | disadvantaged/vulnerable group du jour that is used to
           | justify abusing everyone that interacts with it. You see the
           | same crap with "think of the children" panic.
           | 
           | Unless these devices respect their users, they're simply
           | profiteering off of the disadvantaged, which in my mind
           | should be just as rage inducing.
        
           | autoexec wrote:
           | > What I'm trying to teach myself to do whenever I think
           | "this is ridiculous overcomplexity" is to imagine whose life
           | it might make simpler.
           | 
           | I prefer to think "How can this be used against someone"
           | because while there are a lot of "smart" devices that can
           | help people, they are often also being used to exploit those
           | same people by collecting massive amounts of data and using
           | that data against them or selling/leaking it to those who
           | will use it against them, or allowing hackers to gain access
           | to their data/network.
           | 
           | People with a disability or those with accessibility needs
           | shouldn't need to give up their right to privacy or security
           | to take advantage of every technological advance that might
           | make their lives easier. Even people without a disability
           | don't need some company collecting a detailed record of
           | when/how often/how long they have sex, or how many nights
           | they sleep alone, or what days/hours they spend in bed, or
           | what times they go to sleep or how much sleep they get.
           | 
           | Devices should be designed to protect users and not to
           | collect as much data as possible, or push ads, or expose them
           | to hackers.
        
           | MisterTea wrote:
           | This line of thinking is similar to "wont someone think of
           | the children!" where harmful things are done in the name of
           | good and designed so fighting them puts one in a precarious
           | position.
           | 
           | A bridge to a common controller doesn't need an applications
           | processor with millions of bytes of memory to run millions of
           | lines of code to change the firmness of a stupid mattress.
           | Stop using hammers to solve all your problems, other tools
           | exist.
        
       | linker3000 wrote:
       | Best add 'solder' to your shopping list unless you already have
       | some, or the new iron you buy comes with a starter amount.
        
         | fckgw wrote:
         | If you click the actual link in the article you can see it's a
         | kit that comes with solder and a bunch of other stuff
        
       | classified wrote:
       | I have an analog bed. No root access necessary for sleeping.
        
       | colechristensen wrote:
       | Here are some facts for you
       | 
       | * sleep number beds have sensors in them that detect heart rate
       | 
       | * they do this by detecting pressure differences in the air
       | mattress
       | 
       | * these are effectively microphones, right? and quite sensitive
        
         | emilamlom wrote:
         | Do they really detect heart rate through pressure sensors? That
         | seems like it'd have so much noise the data would be unusable.
         | Edit: Looks like they couple it with some fancy statistical
         | analysis to get accurate enough data. Interesting
        
           | colechristensen wrote:
           | They acquired Bam Labs' tech to do this.
           | 
           | https://www.crunchbase.com/organization/bam-labs
        
       | thunkshift1 wrote:
       | Thats a brand new sentence
        
       ___________________________________________________________________
       (page generated 2024-07-01 23:02 UTC)