I got one of those indoor gardening systems. We thought we had an issue with them. Contacted support.

Support checked and it was fine. Just needed time to adjust. They mentioned they checked the cameras (!).

Later on I got a second used one and while cleaning it, noticed that the internals are just a raspberry pi. Took my micro HDMI and keyboard, and... this thing just runs Raspberry Pi OS.

No updates. And ... VNC. People from that company can just remote into my device, look at what the cameras are seeing, and do stuff on my network. These things are a security nightmare.

> For someone who suffers from insomnia this seemed worth a shot.

I can relate, having suffered the same for most of my life. One thing that really helped me was a simple white noise machine, typically used to help babies sleep. Good: I sleep great with it. Also, it's not connected to the internet and doesn't require an app. Bad: I basically can't sleep without it. I have to travel with it (camping!). I even purchased a backup in case the primary fails, which has happened.

The other major sleep improvement was putting effort into accepting that life is pretty great; all of my worries that kept me awake at night were overblown. This took actual work, but it paid off.

Anyway, just thought I'd pass that along, hoping it might help someone else that struggles with sleep.

https://www.amazon.com/Yogasleep-Portable-Soothing-Rechargea...

Total aside: it’s illegal for any company to provide goods or services for free to the government, so the Pod CEO would be breaking the law sending DOGE employees bed pods. It’s basically seen as a bribe - which is true! These beds are $2000 each but it’s pretty cheap for favorable regulatory treatment after a small donation. :/

"When I say backdoor, what am I referring to? Sure, Eight Sleep needs a way to push updates, provide service, and offer support. That’s expected.

What goes too far in my opinion, is allowing all of Eight Sleep’s engineers to remotely SSH into every customer’s bed and run arbitrary code that bypasses all forms of formal code review process.

And yes, I found evidence that this is exactly what’s happening."

^ wow, this is pretty wild. <insert joke about being careful about who you share a bed with>

The state of the product's security wasn't unexpected. I was, however, shocked by this part:

  > I was willing to overlook:
  >   The bed costs $2,000
  >   It won’t function if the internet goes down
  >   Basic features are behind an additional $19/mo subscription
  >   The bed’s only controls are via mobile app

The market is clearly too stupid to vote against the rent seeking tech industry. It makes me so sad.

> In the end, I got enough of the cyber ick, I decided to seek a simpler, less internet-connected solution to my temperature-controlled bed needs.

Great line. And my eyes bugged out a little at this part as I also realized what the implications were:

> - They can know when you sleep

> - They can detect when there are 2 people sleeping in the bed instead of 1

> - They can know when it’s night, and no people are in the bed

I have a more pragmatic question. Do any consumer publications do security reviews for products? I'm thinking like consumer reports and how they should probably publish if a product is a security nightmare or not. At the end of the day you still need people publish this stuff out and for social media to spread to consumers to beware, but maybe a magazine type of publication could take on part of that responsibility.

Love the part about the CEO being a Musk sycophant. Right down to the similar language in tweets: "Some of SF got poor sleep. We must fix this."

Cat food dispensers are an interesting product where this trend hasn't quite landed - it's still easy to get a new model without WiFi for roughly the same price. I wonder if the possibility of your pet not getting fed is a line consumers won't cross for convenience features.

A $20/month bed subscription is objectively hilarious. I cant imagine how this company attracts a non-zero number of clients.

My wife uses a Bedjet which has both a remote and app. Thankfully it works without an active Internet connection.

It uses a bag-like sheet that it blows air into, to adjust temperature. For women suffering* through menopause, being able to adjust around hot/cold flushes is sanity-preserving!

* Some women don't suffer much during perimenopause or menopause, but it's a process that seriously fucks with one's hormones. A word of advice to any partner of a woman going through perimenopause: believe them when they tell you what they're going through! So many partners don't realize just how much this can mess up someone, they deserve every sympathy possible.

> but the eight sleep sure does harvest people’s bed data, and occasionally tweet about how they’re watching you sleep

[Followed by a screenshot of the EightSleep CEO publicly tweeting about SF sleep data in Nov 2023.]

This is reason enough to not patronize this business. What a creep.

I’m missing a step here. I see a var called ssh, and an authorized key, but I don’t see where they’re seeing any method for the device to expose itself outside the NAT that’s in place on basically every consumer LAN.

This looks a lot more like the device fetches updates via SSH to a remote update server, and the authorized_keys entry is vestigial.

> While the Eight Sleep CEO Matteo seems focused on providing DOGE with great sleep

More sycophants coming out of the woodwork.

If you suffer from insomnia, there are so many other things you can do. Check your Vitamin D and B levels. Meditate. Don't get a bed that emits more EMF. That definitely won't help you.

before anyone tries to mock me for mentioning EMF: https://pmc.ncbi.nlm.nih.gov/articles/PMC5247706/

Can't but think of

  He knows when you are sleeping,
  He knows when you're awake,
  He knows when you've been bad or good...

Interesting article; clickbait title. There's very little about Amazon in here, never mind its chairman.

Interesting article but have to raise the issue of calling just any dog a doge. While I can understand the difficulty of resisting a joke, doges deserve better.

(Not talking about DOGE btw).

I've bought several internet radio streaming devices over the years, and they all eventually brick when the server goes out of business.

I have a chilipad - https://sleep.me/

It's good for temperature control, you can set a profile that changes over night. The cooling is a complete fix for night sweats. It heats too, but I don't use it. I don't use the sleep tracking features.

My only semi-major complaint is that the pump is kind of loud. Only annoyance is that you need to have it connected to wifi w/ internet to set the temperature profile w/ the app, but it keeps working afterwards w/o internet.

I have one of these bed covers. I bought it before the subscription crap started and I am very satisfied with the product. The dual-zone cooling/heating is super good and has been a big improvement to my quality of life/sleep. Especially considering that my wife has different ideas than me about temperature and what constitutes hot/cold. Yes, it would be nice if I had local control but I am willing to ignore that as long as I don't have to pay more.

But I wouldn't recommend anyone buy it now because of the subscription.

It is good to know that there is an option to continue using it if the company decided to no longer grandfather in people who bought before the subscription crap started.

I have an esp32 next to my bed. I log the rssi strength and with that i know when i was in the bed and when i changed position. It also has a pir which detects movement, but tracking the rssi is good enough. A phone would be just as good, and I wouldn't be surprised if some sdk tracks the rssi of the phone to check if something changes around the phone. It's very telling.

While we're all here, what are some good alternatives to Eight Sleep? The idea seems to have merit but the required IoT subscription is a dealbraker.

Great article, two typos:

1. Kenises should be Kinesis

2. The URL template contains {anynumber}, the text refers to anynumbers (plural)

If I'm reading this correctly, the product is just a temperature-controlled mattress?

Well, each bed contains a full Linux-based computer. If my estimations above are correct, all of Eight Sleep engineering can take full control of that computer any time they want.

I think that was already a given once you agree to silent automatic updates.

I looked really hard at buying an 8 Sleep. I have techie friends who swear by them. But one of the big reasons I didn't go forward I don't see mentioned here and that is noise. I need a dark and quiet room to sleep.

Someone told me they returned their 8 sleep because of the constant fan noise of the computer running the thing. He told me it was like having a server in your bedroom.

I am also not keen at all needing to have my phone in my bedroom either. At the end of his life my father had some health challenges and it wasn't uncommon for a nurse to call me in the middle of the night. It was all the other calls, people tweeting or slacking at me that made it really challenging to get any sleep.

Still looking for something where I can collect sleep data if any entrepreneurs can solve these problems.

After skimming most comments here I still wonder what people want from a temperature-controlled mattress? Is it to have a warmer bed or a cooler one? Or does it depend on each person, some like it hot and some don't?

And for those who prefer a warm bed, isn't it simpler and cheaper to warm the room?

Title is bad, but the piece is good

    - They can know when you sleep
    - They can detect when there are 2 people sleeping in the bed instead of 1
    - They can know when it’s night, and no people are in the bed

    [...]that bypasses all forms of formal code review process.

It's not a bad article, but it does seem to make a lot of assumptions, and you already agreed to let arbitrary code run on your network when you added an IoT device to it.

A night mare I have is that alot of these products like 8 Sleep are actually scams.

Not scams in the sense of swindling money, but that they are appendages of a private or government intelligence network.

If you genuinely care about your customers, can't you simply feel guilty of doxing such sensitive data about them?

Some evil entities what to know when you sleep, wake up or if there is someone else in the bed.

I am not against technology, this can be done responsibly via offline support, self hosting options, E2E Encryption, Homomorphic computing, differential privacy etc.

But I guess implementing those would interfere with the scam i.e the main objective, which is spying on you.

In case anyone is wondering why someone would pay so much to control their bed temp - I have a similar product the "Chillipad". Essentially I'm a furnace when I sleep and wake up covered in sweet. This thing keeping my bed cool was the biggest single thing I've done to improve sleep quality. Its not quite as stupid as Eight Sleep in terms of initial cost and there's no ongoing subscription but it was still expensive. I've also had to open it up and replace a faulty check valve, and it occasionally floods so I have it sitting in a tray. But damn... it works.

However now I want to try this aquarium chiller...

I have an EightSleep from before their enshittification into a subscription model. It is a good piece of hardware, but I can no longer recommend it because the software is so crappy. I checked the logs on my router and found that it was streaming tons of data to servers even when I wasn't using it. I have no idea why it would stream that much data since the trivial sensors it has shouldn't be producing that much data even if it had multi Hz sampling. I can't tell if this is incompetence or some sort of malfeasance where they are secretly recording audio data via motion sensors and streaming that.

Using the aquarium chillers is really smart! Just need someone to mfg the mattress membrane covers.

Nothing here is particularly surprising. The worries about engineers ssh'ing into the machine to see if anyone is sleeping seems rather overblown though. The product itself doubles as a sleep tracker and all data goes through their servers (as is sadly the norm for smart home appliances these days) so they have that data anyway. I have to take it on faith that they anonymize and aggregate the data before doing any analysis on it, but the very nature of the product means they have the data.

If the OP sees this, I'd be very curious if they used the 70 watt or the 100 watt aquarium chiller.

This is so cringe, i am getting motivated to only use dumb devices.

I no longer can trust that someone is looking at my TV data, Oven data, thermostat data, etc and tweeting about it.

Yuggh. There is also a bed chilling thing from sleep.me that is around $600. I haven't looked into it enough to tell whether it is internet connected. But I've been aware of it because my mom is very fussy about her sleeping temperature and it might be something I should look into when it gets warmer.

I knew there was some shady shit going on with eight sleep! Back last year I posted a comment on Veritasium's YouTube channel because he had eight sleep as a sponsor. I commented that eight sleep is a privacy nightmare.

Anyways, feels good to be vindicated.

Happens when you buy expensive garbage with a subscription attached.

Bed as a service? Hell no. What an awful idea.

I bought an Eight Sleep Pod 3, as I'm light sleeper who wakes up often at 3 or 4am, and struggles to get the final hours of sleep.

I have to say it made my sleep significantly worse - I was shocked at how bad the temperature setting was - shifting 1 degree warmer or colder was often too much. I also noticed quite a bit of manipulation of reviews & comments on Reddit / subtle sponsorship on YouTube. (=> fake comments, upvoting/downvoting, and unofficial sponsorship).

Maybe it really does improve some people's sleep, but just the noise itself from the Pod meant I needed earplugs to not be disturbed by it. My suggestion is to avoid buying at all costs...

here a related discussion about a guy who did a similar thing with an aquarium cooler to cool his bed https://news.ycombinator.com/item?id=41824138

Are there any consumer products offered that provide similar functions (heating, controlling with an app etc.), but which never try to connect to a remote server, other than looking for the control app in the local LAN?

I'm not sure about the latest models, but my early-revision BedJet has no smart features at all: it was all bluetooth. It solves much the same problem as the product here: warm/cool the bed, not the house.

Anyone here tried those aquarium chillers? Sounds like a great alternative, I would love to read more about using them in practice.

Actual title: "Removing Jeff Bezos from my bed"

> exceeding $300 million dollars in annual revenue

I would be interested in knowing who the buyers for this stuff are ..

Can recommend hot water bottles and a hairdryer for occasional on demand bed warming.

> (the bed...) won’t function if the internet goes down

Who in the sane mind buys that.

How did the author find the backdoor URL in the first place?

honey, that is only for special occasions

I always knew that internet-connected thermostat was a bad idea.

isn't it safe if your home network is not exposing port 22?

re: the kinesis key - curious, what is the right way to configure log delivery for remotely deployed appliances?

> There’s some zip ties securing the tubes you have to cut, but other than that, it’s a totally reversible, non-destructive process that takes 30 seconds.

Wait until Eight Sleep "upgrades" the connectors to be "incompatible" with Aquarium chillers.

Clickbait title.

> the Eight Sleep cover, which is available on eBay for a few hundred

Uh, I don't think I want to buy a used mattress cover on eBay, thanks.

Um, is that Bezos or the AWS account of the company?

Alas, our hope to recover whatever social benefit was in SpaceX and Tesla is with Bezos's companies, although at least the EV space is more diverse. SpaceX cannot be wrested from Musk and TSLA and its board is preferred-stock controlled by Musk.

We give these companies hard earned fucking cash and they want _more_. Rapacious neoliberal capitalists will be the end of capitalism itself.

[dead]

That CEO tweet to Elon is peak cringe.

[dead]

[dead]

You would have to be insane to buy a computer that remains someone else's computer...

[flagged]

I'm a two-time Eight Sleep customer and the CEO could post my sleep history specifically with my full name and I'd still use it. It's really comfortable. I think most of the detractors were never remotely in the market for such a product. Everything negative said about the product and the company is true, and they should do better, but it's not enough to scare me away thanks to how good the base product is.

This is a bunch of nonsense, assumption and leaping to conclusions without evidence.

"In the second screenshot, we have the public key that’s authorized to access the device. The email address attached to the public key, eng@eightsleep.com, to me suggests the private key is likely accessible to the entire engineering team."

He has no evidence for this whatsoever and not really any good reason to assume it either.

"In the first image, we see evidence SSH is being exposed remotely, to a far away host, remote-connectivity-api.8slp.net. Typically SSH would only be accessible to the local area network, but the variables in production.json would seem to imply this access was opened up to a remote host."

This isn't how SSH works and he doesn't seem to have enough information, or enough knowledge of SSH, to understand what's being done with the "far away" hostname.

This article is just clickbait nonsense, which should have been obvious from the title. It is clearly intended to draw traffic to their company website, which is some kind of venture-backed security startup. Based on the fact that the founders seem to have a superficial understanding of technology but a well-developed understanding of hype and bullshit, I am not interested in exploring their business further.