posted in Technology
Smart devices can testify against you: How home robot data is being used in court
www.the-independent.com/tech/robot-vacuum-fitbit-smart-device-data-trial-b3052060.html
Replying to @Mustachius_Grumpius@thelemmy.club
Thats why my robovac runs valetudo valetudo.cloud
Valetudo runs alongside the existing software on the robot vacuum though, does it not?
From what I gather, valetudo sits between the firmware and the cloud, co-opting cloud functionality and serving that from the vacuum. Since nothing is going to the cloud, only the information stored on the robot, or that you’ve stored yourself, can be used against you. So while your vacuum may have a microphone or camera, it shouldn’t be recording what you say or do anywhere. I have yet to start my valetudo journey and have barely started my robot vacuum journey precisely because of scenarios like this.
I’m not convinced this actually holds. To be able to use Valetudo at all, you at minimum do need to connect it to a wifi network which you are connected to as well on some kind of device. Unless you happen to be setting up some kind of firewalling on the robot vacuum, it is at that point free to start logging whatever information it deems appropriate.
The code is open source. Like any open source software, unless it’s been vetted, you’re relying on trust. The premise is that the software is running on the vacuum, so there is no cloud or remote storage. So, just like anything else self-hosted, unless your network is compromised or you configure it to allow it, nothing external is accessing it. If you don’t trust it, vet it. Read the code or check your network logs.
I’m not talking about the code in Valetudo - I’m talking about the code that’s already running on the robot vacuum before installing Valetudo. It remains on the device after you install Valetudo.
Basically, any concerns about privacy stemming from the original software on the robot vacuum do not get eliminated by installing Valetudo
Replying to @VibeSurgeon@piefed.social
Valetudo actively blocks the cloud connections. Also, only firmware versions specifically installed with Valetudo is supported (so no chance an update to the original device firmware happens, and does new things).
I think there’s a very low chance something escapes to the vendor cloud.
None the less, I personally run these on a separate VLAN without internet access.
Valetudo actively blocks the cloud connections.
Are you sure about that? It’d be a pretty big feature to implement, and surely it would be something that the Valetudo author would mention in the docs for the project.
Replying to @VibeSurgeon@piefed.social
It’d be a pretty big feature to implement, and surely it would be something that the Valetudo author would mention in the docs for the project.
Dude. What?
It is literally the only feature of Valetudo.
Wat.
What else would Valetudo possibly be doing other than disconnecting from the cloud?
Given that you are the author of the project, I do consider you the higher authority on what it can and cannot do.
But to me, there’s a slight distinction to be made here - Valetudo allows you to directly control the robot from a server running locally on the robot, giving you the option to not interact with a cloud service in order to remotely control the robot vacuum.
This doesn’t immediately imply that the robot is directly prevented from passing information to a cloud service - just that the cloud service does not have to be involved as a command proxy.
The larger feature I was thinking of was not only serving a local server to allow commands to come in directly, but also actively prevent any outgoing connections from the robot vacuum to its manufacturers cloud.
Again, you are the author - you know far better what Valetudo does and does not do, so your information weighs heavier here.
I guess I can also mention that I will be pleasantly surprised if my Chinese robot vacuum has actually been prevented from logging any information back home as a part of me having run Valetudo for the past years.
Replying to @VibeSurgeon@piefed.social
I wouldn’t recommend “taking my word for it” tbh.
This is something not decided by authority of a person but authority of the code - and, in turn, authority of a pcap file.
Fair enough. I searched for pcap files in all the repositories for Hypfer on GitHub but found nothing - do they live somewhere else, or is this just GitHubs search being generally lacking?