Man discovers his parents' coffee machine used 1TB of data in 10 days

Yeah, sure, the terms of service probably say that they can do that. That's still in "unconscionable" territory. And courts do not like unconscionable contracts. If it's unconscionable, it's invalid (if I understand the law correctly).

Is this why everybody wants to make appliances with wireless?

its LGs glass in LG household, and now Keurigs kitchen

There’s no way Keurig is has the intention of paying the kind of costs required to collect a terabyte of data every two weeks for millions of people who own their coffee makers.

There must be some kind of bug here. I imagine if you unplugged it and plugged it in again the data usage would settle down.

But why do they need to collect 1 TB? Sounds like a lot of redundant/doublicated entries then for a small network?

WTF!! When did we land in the middle of a Black Mirror episode?

I'm half convinced the first run of the LHC split the timeline and we've landed in the evil one.

Because the article is also full of 238 advertisers.

Coffee machine scans network? Nope.

Coffee machine reports things about your network? Nope.

TV does ACR? Nope.

TV reports things it incidentally learns about your listening habits? Nope.

TV transmits any microphone data or things derived from mic data that aren't explicit user commands? Nope.

Companies who collect this data even though it's illegal want to sell it or use it for marketing or transfer it to anyone else? Nope.

Company A provides an SDK to company B that does this kind of thing and company B sells the product? A is liable, civilly and criminally, and B is also civilly liable to the extent that they should have and did not exercise due diligence to prevent it.

Company A, company B, and/or the end user have some contract shifting liability? Nope. The parties that the law said are liable are liable, cannot use the contract to avoid liability, cannot use the contract to recover money they have paid as a result of this liability, and cannot enforce arbitration provisions.

Anyone tries to use a contract that is considered illegal under this law? That party becomes responsible for their opposition's legal fees even if they are ultimately found not liable for some other reason.

Police wants to buy this data? Sure, they're welcome to buy what's legally available, except that they, like everyone else, will have a hard time getting the data because it's illegal for anyone to acquire it or sell it.

It's high time to get this done. We've got this and the recent evidence of LG doing all kinds of worse crap and it really should be possible to get some legislators on board.

The people that said LG isn’t the only company doing invasive data harvesting is sadly correct.

How did we as a society let it get to this point?

This is either outright false or at least highly misleading. Keurig says they may sell information about your coffee brewing habits to third parties (i.e. your usage of the coffee machine itself), but nowhere does "Keurig note" that they collect other data about your household through network scans and sell that to advertisers.

I'm not even sure which tweet you were referring to that implied that. In any case, there are tons of responses here that are interpreting your quote as saying Keurig admitted they do network scans to acquire info about your household to sell to third parties, and that (the idea that Keurig says they do this) is flat out false.

Off topic, but an odd and dubious upside to AI is that it provides an actually valid reason for this mass data collection. Before AI, as you note it was for advertisers, but what are they actually doing with it?

The promise was that with all this data, advertising would be perfected. I seem to remember fears back in the day that it could end up being a form of mind control, with this perfect understanding of you an advertiser could sell you anything, and you'd willingly consume adverts as entertainment they'd be so perfectly tailored to you. Not something any of us would want I'm sure, but that was the promise for advertisers. The opposite ended up happening. Nobody wants to use the internet without an ad-blocker, when you're forced to use Youtube or something without an ad-blocker you're counting down the seconds until you can skip it, and the rest of the time you don't even notice they're there, let alone any kind of mind control. Of course you do get thinly veiled advertisements as entertainment, but none of them use mass data collection, they're really not much different to how tv shows used to get made to sell toys in the 80s.

The reason I bring this up is for the question; what is this mass data collection for? We (really) don't want it, advertisers are either unwilling or unable to use it and it costs a tonne of money and effort. The obvious, and disappointing, reason is that we all need to pretend it works or the internet as we know it collapses, for better or worse. That plus AI being the new excuse I suppose.

Good lord.

Where is this shown? I see it repeated all through the HN comments but I don't see it in the X thread.

The person who discovered this says he didn't even open Wireshark and capture a few packets, which would have immediately revealed something about the situation.

> Tech worker / Software engineer:"The only piece of technology in my house is a printer from 2004, and I keep a loaded gun next to it in case it makes a noise I don't recognize."

You forgot an additional well-known punchline (source: https://old.reddit.com/r/NonPoliticalTwitter/comments/1e8do2...):

> I wouldn't keep the gun next to the printer; it may be able to use it against you

  My wife asked me why I was carrying a gun in the kitchen
  I said "Rogue AI"
  My wife laughed
  I laughed
  The toaster laughed
  I shot the toaster

I have been a software developer for 30 years, and I am always wanting to automate and ‘smartify’ everything in my house.

It is true that I want to self host everything, too, and use open source as much as I can, but I am not avoiding technology.

I got into computers because I love technology, and want to play with as much of it as I can.

Now that you have said that I am hoping (just a little bit) it is actual data and we learn what it is. What is life like for a toaster.

But ... I kinda feel the sentiment, I routinely joke (and feels like less of a joke every year) that when I retire in a few years, I'm removing every last computer from my life.

So, yeahh, the 1 TB of data is bad, but that seems more like a bug. The bigger issue is that people are buying "IoT" products without even realizing it. They're looking for a simple, decent coffee maker, and what they get is a coffee maker bundled with an even shittier app that can be insecure, become outdated, be full of bugs, turn into a paid service, or eventually stop working and prevent you from using a product you legally bought. And who knows what other issues it'll introduce along the way.

I fucking hate how apps and connectivity have become the default for practically everything you buy, even when there's absolutely no clear need for them. They usually offer very little additional convenience while introducing all the issues mentioned above. More things to break, more security and privacy risks, more dependencies on services you don't control, and potentially a perfectly functional product turned into e-waste because some company decided to stop supporting its shitty app.

To me, the trade-off is almost never worth it. If I was naive I would think for other people the trade-off is just OK for them but actually they're not aware they're doing this trade-off at all.

Maybe things have changed in the past few years but prior to covid a decent chunk of my $dayJob was poking about the internals of the unifi controller to support an API.

They used MongoDB for stats. If they still do, that might explain the bug :)

But I sincerely hope things like muse will force public and unethical programmers to change.

Yes, they can trivially build systems to filter this out, but your favorite coding agent can probably make it more stochastic / clever ;)

In my experience, this has basically 'neutered' personalised advertising for me (I get all kinds of ads, in all kinds of languages, when using my Google account or network w/o an adblocker); so it definitely has an effect.

What we need is to ban this sort of thing outright.

None, without people like us in their families who are able and willing to help.

We as computer people need to internalize and accept the idea that helping our immediate and even extended family with technology is now part of defending human freedom. And we need to form ourselves into the best helpers we can be by learning how to teach and communicate well.

- have a short window to get to the train in the morning - want coffee on the train - don't particularly like drip machine coffee - want the water boiling when I wake up so that I can make coffee and get out of the house as quickly as possible - am more morally opposed to waking up five minutes earlier (pushing my wake time into the 4 o'clock hour) than I am to having a smart device.

I couldn't find a kettle that runs on a timer, and just taping the switch in the "on" position and hooking it up to a plug timer felt unsafe, so getting a stupid wifi kettle and using their stupid app to set it to auto-start was the best option. It's on its own network, though.

In other words, these product decisions aren't really made on the rationale that internet connected coffee makers make sense from the standpoint of a consumer who simply wants coffee made...

It's more: "let's make smart coffee makers so that we can sell to 2 markets:

    1) a coffee maker to consumers who want coffee made

    2) consumers data/eyeballs to advertisers who want their info/eyes

FWIW preventing the harm that happened here would seem to require a second set of APs (radios) on a different channel.

I default to adding IoT devices to a 2.4g "Guest" network where they can't see each other. Exceptions are IoT devices that need to see their friends to do what I bought them for, or devices I want to integrate with HomeAssistant. In those cases I create a separate IoT device per IoT brand. Excessive but necessary.

I'm ammused people call these "smart speakers".

Use their real name: Smart Microphones.

Alexa = Amazons microphone.

It's great having them on WiFi - you can turn on the AC before getting home to pre-cool, without having to leave it on all day.

And I wonder how I would even tell if it was trying to associate with my WiFi.

I seen a heavy duty (office) top notch and top brand coffee maker breaking down in every two weeks before the IoT frenzy and killing people's privacy by collecting all their data covertly. The mechanics may be good, may be bad, and for a grinder+brewer unit connected to the water pipes so you don't have to fill it up, except beans, can also be 'improved' (if not for the benefit of the user, but for the benefit of the manufacturer, making it cheaper to produce but selling at the same premium price people got used to before the PE bought it from the founders). It can have sensitive parts without software.

Now, when marketing and technology-fandom dominates over common sense it is even more difficult telling beforehand if a particular make of a particular brand will be a good buy or a disaster. More goes into the second category as time goes by.

To me, a french-press and buying ground coffee from a reliable brand (I am not a coffee evangelist, I only drink it, not worshipping it), or alternatively a moka pot are the reliable choice.

Keurig is really convenient and cheap.

A Keurig machine, regardless of model, doesn't take much space. You can almost certainly put it somewhere in the kitchen or an office and just leave it there. By contrast, a machine that can grind beans is much larger, and you need to carefully plan for its presence.

The machine is obviously cheap -- most models are under $100, and only "high end" models with questionable features but not necessarily better taste are over that number. The pods are cheap -- you can easily get them for less than $0.5/pod, sometimes $0.4/pod. By comparison, Nespresso capsules are generally around $0.8-1/capsule. Note that I didn't say it's cheap per "unit coffee" -- there is usually less than 10g coffee in each pod (and that varies) and can be really weak for the amount of water used. This is why people suggest that if you have to use Keurig, use the least amount of water allowed.

Of course Keurig coffee doesn't taste the best. But most people aren't aware (even though they are likely able to tell the difference), and at the end of the day, the machine gets the job done. What makes them popular is cost and convenience. Like so many other products on the market.

One ISP here was recently caught scanning the local network on their modem/router-combo and uploading all the MAC addresses to... an analytics company.

If you have any chance to replace the ISP-provided router (in some countries ISPs are required to offer this option), do so. You can also replace it by something that has a traffic flow monitor, proper firewall (e.g. to block outgoing connections to trackers), etc.

I've ended up with numerous VLANs, one for entertainment devices, one for security system(s), one for guests, one for IoT trash, etc.

If the devices are this level of untrusted, there's a lot of separation necessary.

Then I disabled my ad blocker to see how much data comes down. So far it's at 31 MB, but it increases without bound by a few KB per second.

Think of all that sweet sweet food data that a fridge could on sell.

Advertising is a lottery, they all try to show you an ad knowing very well it will most likely be ignored.

Where do they get the money to buy your details in the first place ?

Considering the computing power of these kinds of devices, it is most likely stuck inside an infinite loop sending garbage at full speed, there is not enough power to process that much volume in any maliciously useful way.

I like Hanlon's Razor, but I think sometimes people will use it to fully dismiss the idea of someone being evil because they're stupid, when in reality plenty of people are capable of being both.

No, fuck this lazy line of thinking. If the outcome is the same then it doesn't matter.

It would be like finding out ring cameras are taking pictures of your keys and calculating the pin set to producing duplicates and sending that pin set data off somewhere and when caught them being like "Uh, we are uhhh... doing it to make sure your key isn't too worn down or to detect if someone made a crude hand filed key. Yeah that's it!"

Some more consumer-oriented router/APs like Fritz!Box support a guest network that uses WiFi client isolation and internally uses a VLAN that is separate from the main network (though due to being non-pro end-user focus, you cannot set up your own VLANs or additional SSIDs).

The vast majority of consumers don't understand that purchasing hardware with cloud integration essentially means they're renting their own products. I don't think it's a very logical conclusion to make either, unless you spend some time thinking about it. Therefore I don't think it's fair at all to say that they deserve this. Lawmakers need to push back on this, but that I think we agree on.