Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to get root access to your Sleep Number bed

dillan.org

Post reply on HN
Print view View original

91–100 of 254 posts

Re: How to get root access to your Sleep Number bed

#91

Post by fragmede »

dmitrygr wrote: post #11
itake wrote: post #10

Earlier quoted context omitted.

what would be a better way to design this that is cheap and updatable? Specialized hardware is riskier to build, b/c bugs would require a complete reprint.

NOTHING in a bed needs to be updatable. Nothing. It needs a PIC12F509 to run a motor when you press a button and check for a jam.

How does a PIC12F509 connect via bluetooth to talk to an app for the consumer to configure things? How does it connect to wifi to talk to a server to save data to? Like it or not, an app to configure the device instead of the device having a VCR remote control to program in schedules is what consumers have gotten used to these days. If you think there's room in the market for a sleep pad that doesn't talk to the cloud, you're welcome to try, but mass market consumers have come to expect more from products.

Re: How to get root access to your Sleep Number bed

#92

Post by bitmasher9 »

flaminHotSpeedo wrote: post #86
binwiederhier wrote: post #68

Earlier quoted context omitted.

> Python 2.7.18 I am not defending them for not keeping their stuff up-to-date, but it is very common practice for embedded systems to be hopelessly outdated. I've done what OP describes with IPMI/BMC systems for $mainboardmanufacturer1 and $mainboardmanufacturer2 (both really big name brands), and their BMC systems were equally outdated. It was almost comical, but really sad at the same time. Moral of the story is t…

I know I'm preaching to the choir, but I do prefer not having to treat my bed as a hostile device on my network

Either treat your devices as potentially hostile or simply don’t connect your bed to a network.

Re: How to get root access to your Sleep Number bed

#93

Post by yellowapple »

hpen wrote: post #15
itake wrote: post #9

Earlier quoted context omitted.

how else would you record and transmit measurements to a server? lower-level hardware and software is expensive to develop on and potentially be difficult to update.

[flagged]

That's uncalled for.

Re: How to get root access to your Sleep Number bed

#94

Post by bitmasher9 »

Youden wrote: post #82
cs702 wrote: post #5

Wait, this is about an actual bed -- you know, the kind that you sleep on -- that runs an SSH server on Linux ? W. T. F. !?

You think that's bad, you should see Eight Sleep. Not only do they run an SSH server on their embedded Linux device but the entire Linux component is unnecessary. All it really does as far as I can tell is act as a bridge between an STM32 and a process long-polling AWS for commands. They could have achieved the same thing with less cost and complexity with an ESP32. Also bad: they engineered it maliciously, making it…

> Also bad: they engineered it maliciously, making it completely and unnecessarily dependent on the cloud. All the sensor data is streaming in real time to the cloud and the only way to send it commands is through AWS.

Why would they unnecessarily add local processing capabilities to their data collection tool? The entire point was collecting the data.

Re: How to get root access to your Sleep Number bed

#95

Post by CJefferson »

flaminHotSpeedo wrote: post #66
binwiederhier wrote: post #53

Earlier quoted context omitted.

Devil's advocate. As someone who has developed a Linux based appliance with over 100k live units across the globe, it seems insane to NOT have access to the thing you're selling and that you have to maintain. If your thing breaks or gets bricked by an update, you will call support and expect them to fix it. You don't want to send in your device or have a support technician come to your house to fix it. So yes, to the…

That's a fair argument, but it doesn't appear that that updates are high on sleep number's priority list: > The hub includes Python 2.7.18. While extremely old (keep in mind the Hub appears to have been last updated in 2018) If we give them the benefit of the doubt, perhaps they intended to to keep it up to date but ultimately compaines need to either be transparent about their remote access and manage it responsibly…

While 2.7.18 hasn't been updated since 2018, it's also the last version of Python 2.

I've got several programs stuck in 2.7.18, as they have sizable dependancies that never got updated to Python 3 -- unless I'm willing to rewrite several large Python packages, I'm stuck here forever. As long as the program isn't network connected, I don't see a problem with fixing a Python version, and set of packages, and leaving the software running forever.

Re: How to get root access to your Sleep Number bed

#96

Post by Aurornis »

binwiederhier wrote: post #53
teddyh wrote: post #4

Buried lede: “What I did find was a "convenient" backdoor that Sleep Number can use to SSH back into the hub (and my internal home network as a result).”

Devil's advocate. As someone who has developed a Linux based appliance with over 100k live units across the globe, it seems insane to NOT have access to the thing you're selling and that you have to maintain. If your thing breaks or gets bricked by an update, you will call support and expect them to fix it. You don't want to send in your device or have a support technician come to your house to fix it. So yes, to the…

> As someone who has developed a Linux based appliance with over 100k live units across the globe, it seems insane to NOT have access to the thing you're selling and that you have to maintain.

I’ve developed Linux devices selling that many units (and more) and I’m baffled that anyone would think this is a viable way to handle things at this scale.

Units like this should have a firmly read-only Linux firmware that can only be changed by signed updates. The only data you would actually get or modify is the diagnostic data or the contents of the settings. Both of those can be sent through mechanisms that shouldn’t require SSH access.

The correct way to handle this is with a debug info feature. Put something in the app that will zip up logs and configuration files and send them in for support, with the user’s explicit permission obviously. If you can’t figure it out from logs, you can use their config files to clone the situation on a device in the office.

The bigger issue is: Who are you going to task with SSHing into customer devices? With 100K or more people filing support requests, it would be insane to have engineers handling those requests with anything having to do with SSH. It would be equally insane to hand off access to customer support people and give them the keys to SSH into customer devices.

Re: How to get root access to your Sleep Number bed

#97

Post by number6 »

binwiederhier wrote: post #70
01HNNWZ0MV43FF wrote: post #65

Earlier quoted context omitted.

The problem is it's gonna be a golden key system where everyone who's worked there for the last ten years has a copy

That is correct. But it is possible to design a system with short lived auth tokens/keys and frequent key rotation. I designed such a system at $oldjob for remote access (see [1]). Obviously there is always a risk, and there are always syseng/ops people with access. That is correct. [1] https://blog.heckel.io/2019/11/19/providing-remote-access-to...

Nice write up and a lot of gotchas you encountered

Re: How to get root access to your Sleep Number bed

#98

Post by kedean »

Youden wrote: post #82
cs702 wrote: post #5

Wait, this is about an actual bed -- you know, the kind that you sleep on -- that runs an SSH server on Linux ? W. T. F. !?

You think that's bad, you should see Eight Sleep. Not only do they run an SSH server on their embedded Linux device but the entire Linux component is unnecessary. All it really does as far as I can tell is act as a bridge between an STM32 and a process long-polling AWS for commands. They could have achieved the same thing with less cost and complexity with an ESP32. Also bad: they engineered it maliciously, making it…

> If a Chinese company did this, the company would be cancelled.

It's worth noting that this is the first time I've ever heard of this company in my life. Something can't be "cancelled" if it has no mind share.

Re: How to get root access to your Sleep Number bed

#99

Post by userbinator »

gcr wrote: post #48
KennyBlanken wrote: post #42

> r: Following this guide will require modifying internal files on your Sleep Number hub. This will void your warranty People, stop spreading this BS. Just like those stickers that say "warranty void if removed" are not legally enforceable, nothing "automatically" invalidates your product's warranty except misuse or poor maintenance. If your Smart Bed stops working, you having poked around in the controller does not…

There's a difference between law on paper and law in practice. If the manufacturer refuses to honor the warranty, there's very little customers can do.

https://en.wikipedia.org/wiki/Magnuson%E2%80%93Moss_Warranty...

Re: How to get root access to your Sleep Number bed

#100

Post by userbinator »

dekhn wrote: post #58
cs702 wrote: post #5

Wait, this is about an actual bed -- you know, the kind that you sleep on -- that runs an SSH server on Linux ? W. T. F. !?

There never was a Year of Linux on the Desktop, but there's been a year of linux on the phone, linux on the car, linux on the submarine, linux on the fridge, and so it's no surprise there's a year of linux in the bed. Anything sufficiently complex (this bed: https://en.wikipedia.org/wiki/Sleep_Number#Sleep_Number_Bed ) is going to have a microprocessor, and it makes sense to have an OS that lets you interact with it…

It's an inflatable mattress with an adjustable pressure regulator. That's pre-computer-age technology. The only thing that requires a computer is to make the adjustment remote. Why would you want to adjust your bed remotely?
Post reply on HN