- Rabbit R1 AI box is actually an Android app in a limited $200 box, running on AOSP without Google Play.
- Rabbit Inc. is unhappy about details of its tech stack being public, threatening action against unauthorized emulators.
- AOSP is a logical choice for mobile hardware as it provides essential functionalities without the need for Google Play.
It’s so weird how they’re just insisting it isn’t an android app even though people have proven it is. Who do they expect to believe them?
The same question was asked a million times during the crypto boom. “They’re insisting that [some-crypto-project] is a safe passive income when people have proven that it’s a ponzi scheme. Who do they expect to believe them?” And the answer is, zealots who made crypto (or in this case, AI) the basis of their entire personality.
In this case the same people made both, so they are already practiced
Their target audience are the most gullible tech evangelists in the world that think AI is magic. If there was a limit to the lies those people are willing to believe, they wouldn’t be buying the thing to begin with.
This will flop though. So will the stupid Humane pin.
Either there are very few people that gullible or that group isn’t quite as gullible as you think.
Oh 🦆, I was thinking this was humane and wondering why people were saying it is only $200.
They are technically not wrong when they say that the whole experience isn’t made up of just an App
They are intentionally dodging the ACTUAL question.
Anyways here is a leak of their “LAM”, which is just playwright for the most part. https://web.archive.org/web/20240424133441if_/https://pixeldrain.com/api/file/vYHXbUwP?download
With that, we have both components, yay?
You know, pairing an LLM with Playright is actually a pretty great idea. But that’s something I can totally roll on my own.
It’s the Juicero strategy.
“You can’t squeeze our juice packs! Only our special machine can properly squeeze our juice packs for optimal taste!”
Ahh, the good ol’ days, before we knew how batshit AvE was.
I’m assuming you’re talking about the YouTuber; It’s been since before the pandemic that I’ve watched AvE, what did he do?
Leaned hard into anti-vax and sympathizing with the Canadian trucker protests, and made it a fairly prominent part of his videos. Not entirely surprising that he held some of the views, but he got high on his own LIBERTARIAN!!! supply and started thinking that if he thought it, his audience must want to hear it.
Ah, what a shame, he had some good stuff.
Reviewer proceeds to squeeze more juice out with their hands than the machine managed.
Investors who don’t bother reading past the letters A and I in the prospectus.
They have thought of a specific design for the device using its own interaction modality and created a product that is more than just software.
Therefore don’t get why people refer to it being just an app? Does it make it worth less, because it runs on Android? Many devices, e.g. e-readers are just Android Apps as well. If it works it works.
In this case it doesn’t, so why not focus on that?
The point being, they are charging 200 bucks for hardware that is superfluous and low end for an incomplete software experience that could be delivered without that on an app. The question is, are you going to give up your smartphone for this new device? Are you going to carry both? Probably not.
“It can do 10% of the shit your phone can do, only slower, on a smaller screen, with its own data connection, and inaccurately because you have to hope that our “AI” is sufficiently advanced to understand a command, take action on that command, and respond in a short amount of time. And that’s not to even speak about the horrible privacy concerns or that it’s a brick without connection!”
Everything about this project seems lackluster at best, other than maybe the aesthetic design from teenage engineering, but even then, their design work seems a bit repetitive. But that may be due to how the company is asking for the work. “We wanna be like Nothing and Playdate!!” “I gotchu fam!”
To address your point about e-readers, they have specific use cases. Long battery lives, large, efficient e-ink displays, and the convenience of having all your books, or a large subset, available to you offline! But when those things aren’t a concern, yea, an app will do.
Like with most contemporary product launches, I simply find myself asking, “Who is this for?”
They’ve said they are working on integration with other apps, and have said the ultimate goal is the AI could create its own interface for any app. I dunno if that’s gonna happen but if it did it would be closer to an actual assistant, imagine “rabbit, log onto my work schedule app and check my vacation hours” or “rabbit, compare prices for a SanDisk 256 gig memory card on Amazon, eBay, and Newegg”.
More than likely it’ll just fuck it all up but that’s the dream I think.
I mean I have an eReader but most of the time I’m too lazy to go find it and my Kindle app works just fine. I am eyeing those eink phones though…
It’s an experimental device and by buying it you invest into r&d. It’s not meant to replace a smartphone as of now, but similar ones eventually will.
My point stands, because they are offering a completely new (but obv lacking) experience with novel design solutions. What they made is a toy, which is not really unusual for teenage engineering. But if they do as they did with other devices in the past this thing might actually rock in the future. They are not inexperienced and usually over super long support for their devices.
TE is way older than Nothing and Playdate btw…
It’s an experimental device and by buying it you invest into r&d.
This is laughably untrue. By buying this you’ve proven to them that their marketing oriented approach to product development is correct, and that customers will throw away good money on half-designed, disposable shit.
By the looks of this shitty project, they spent most of their money on design idiots that think they’re the next coming of Steve Jobs, and blathering marketing morons that think if they say AI and “the future” enough that it doesn’t matter that the products they actually deliver are half-done, also-ran, clout-chasing garbage with hardware from the clearance section of Alibaba.
No, they won’t. Because it’s just a shitty downgraded smartphone controlled by a super shady company with massive security and privacy concerns.
Why even try to sell me another device though?
Anything and everything this square does, my phone can do better already and has the added benefit of already being in my pocket and not a pain in the ass to use.
Because, you know, technological development? Someone has to fund R&D, because it’s not cheap. And in 10 years everyone will have similar ai-enhanced devices. No one thought smartphones will make it back in the days as well. And I’m already looking forward to the time when I don’t have to look down anymore to get information
And in 10 years everyone will have similar ai-enhanced devices.
In 10 years (or actually 0 years because it’s already kinda true) people will have an AI enhanced device… And it’ll be their phone.
Also, you’re arguing something I’m going to name the inevitability fallacy (for my own amusement). It’s not inevitable that everyone will have one of these particular type of devices in the same way it wasn’t inevitable that everyone would start watching 3d TV in their houses.
This is just another in a long line of things that supply side economics driven companies are trying to sell us. There’s next to no need or demand for this thing, and there’s no guarantee that there will be.
No, they’re not.
An ereader is a piece of hardware that has a distinct purpose that cannot be matched by other hardware (high quality, high contrast, low power draw static content). Some of them do run Android, and that’s a huge value add. But the actual hardware is the reason it exists.
This is just a dogshit Android phone. There is no unique hardware niche it’s filling. It’s an extremely obvious scam that is very obviously massively downgraded in all of value, utility, and performance by being forced onto separate hardware.
my honda is just android software, if thats the only part you look at too.
This is more like someone offering a “brand new method of personal travel” to replace your car, but it turns out that it’s just an old Honda with only one seat, a fuel tank that only holds 10L, and a custom navigation app. There’s nothing it does that your Honda can’t do better, and you won’t want to replace your Honda with this.
true but we all have tons of successful devices that are secretly like this, smart doorbells and flood lights and watches etc. we also have all seen terrible ones. its the implementation that isn’t magical.
Removed by mod
What’s your problem with smart dildos?
Removed by mod
No it’s not. Your Honda has several different computers in it, only on of which is likely to be running Android.
‘Android’ is a certification with requirements in installed Google apps and homscreen links, so there’s that.
The AI boom in a nutshell. Repackaged software and content with a shiny AI coat of paint. Even the AI itself is often just repackaged chatgpt.
Removed by mod
What’s interesting about this device is that it (supposedly) learns how apps work and how people use them, so if you ask it something that requires using an app it could do it.
So while it might be “just an android app”, if it does what’s advertised that would be impressive.
Apps are designed to be easy to use. If this device works as advertised (and that’s a huge if), then it wouldn’t offer much in the way of convenience anyway. From what I’ve been reading, it doesn’t work well at all.
Reviewers are saying it is not able to do this, along with several other promised features.
perplexity for this device. still, excited to get my pre-order if only to add to my teenage engineering collection
It certainly looks sleek. Too bad that’s all it has in its favor.
must be a cool device to jailbreak and mess around with just for the sake of it tho
it has a very unique form factor after all
Unless you have tons of money, why preorder? Just wait for the company to inevitably go under and people start reselling their now-useless devices, and then scoop as many as you want from Ebay. Even if the company survives for a while, the functionality is so underwhelming they might start getting rid of them way sooner.
The company makes other things I don’t think they will go under of this fails
I heard someone even leaked the apk LMAO that’s hilarious that your 200 dollar product can be literally pirated
You wouldn’t download a bunny…
I would stew a bunny…
Does the apk have unlimited access to Perplexity AI?
deleted by creator
Didn’t the bunny don’t have any subscription?
Why are there AI boxes popping up everywhere? They are useless. How many times do we need to repeat that LLMs are trained to give convincing answers but not correct ones. I’ve gained nothing from asking this glorified e-waste something, pulling out my phone and verifying it.
What I don’t get is why anyone would like to buy a new gadget for some AI features. Just develop a nice app and let people run it on their phones.
That’s why though. Because they can monetize hardware. They can’t monetize something a free app does.
Plenty of free apps get monetized just fine. They just have to offer something people want to use that they can slather ads all over. The AI doo-dads haven’t shown they’re useful. I’m guessing the dedicated hardware strategy got them more upfront funding from stupid venture capital than an app would have, but they still haven’t answered why anybody should buy these. Just postponing the inevitable.
The answer is “marketing”
They have pushed AI so hard in the last couple of years they have convinced many that we are 1 year away from Terminator travelling back in time to prevent the apocalypse
- Incredible levels of hype
- Tons of power consumption
- Questionable utility
- Small but very vocal fanbase
s/Crypto/AI/
Because money, both from tech hungry but not very savvy consumers, and the inevitable advertisers that will pay for the opportunity for their names to be ejected from these boxes as part of a perfectly natural conversation.
deleted by creator
It’s not black or white.
Of couse AI hallucinates, but not all that an LLM produces is garbage.
Don’t expect a “living” Wikipedia or Google, but, it sure can help with things like coding or translating.
I don’t necessarily disagree. You can certainly use LLMs and achieve something in less time than without it. Numerous people here are speaking about coding and while I had no success with them, it can work with more popular languages. The thing is, these people use LLMs as a tool in their process. They verify the results (or the compiler does it for them). That’s not what this product is. It’s a standalone device which you talk to. It’s supposed to replace pulling out your phone to answer a question.
I quite like kagis universal summarizer, for example. It let’s me know if a long ass YouTube video is worth watching
I use LLMs as a starting point to research new subjects.
The google/ddg search quality is hot garbage, so LLM at least gives me the terminology to be more precise in my searchs.
There is s fuck ton on money laundering coming from China nowadays and they invest millions in any tech-bro stupid idea to dump their illegal cash.
I just started diving into the space from a localized point yesterday. And I can say that there are definitely problems with garbage spewing, but some of these models are getting really really good at really specific things.
A biomedical model I saw seemed lauded for it’s consistency in pulling relevant data from medical notes for the sake of patient care instructions, important risk factors, fall risk level etc.
So although I agree they’re still giving well phrased garbage for big general cases (and GPT4 seems to be much more ‘savvy’), the specific use cases are getting much better and I’m stoked to see how that continues.
I think it’s a delayed development reaction to Amazon Alexa from 4 years ago. Alexa came out, voice assistants were everywhere. Someone wanted to cash in on the hype but consumer product development takes a really long time.
So product is finally finished (mobile Alexa) and they label it AI to hype it as well as make it work without the hard work of parsing wikipedia for good answers.
Alexa and Google home came out nearly a decade ago
Alexa is a fundamentally different architecture from the LLMs of today. There is no way that anyone with even a basic understanding of modern computing would say something like this.
Alexa is a fundamentally different architecture from the LLMs of today.
Which is why I explicitly said they used AI (LLM) instead of the harder to implement but more accurate Alexa method.
Maybe actually read the entire post before being an ass.
The best convincing answer is the correct one. The correlation of AI answers with correct answers is fairly high. Numerous test show that. The models also significantly improved (especially paid versions) since introduction just 2 years ago.
Of course it does not mean that it could be trusted as much as Wikipedia, but it is probably better source than Facebook.“Fairly high” is still useless (and doesn’t actually quantify anything, depending on context both 1% and 99% could be ‘fairly high’). As long as these models just hallucinate things, I need to double-check. Which is what I would have done without one of these things anyway.
Hallucinations are largely dealt with if you use agents. It won’t be long until it gets packaged well enough that anyone can just use it. For now, it takes a little bit of effort to get a decent setup.
I think Meta hates your answer
I just used ChatGPT to write a 500-line Python application that syncs IP addresses from asset management tools to our vulnerability management stack. This took about 4 hours using AutoGen Studio. The code just passed QA and is moving into production next week.
https://github.com/blainemartin/R7_Shodan_Cloudflare_IP_Sync_Tool
Tell me again how LLMs are useless?
To be honest… that doesn’t sound like a heavy lift at all.
Dream of tech bosses everywhere. Pay an intermediate dev for average level senior output.
Intermediate? Nah, junior. They’re cheaper after all.
But senior devs do a lot more than output code. Sometimes - like Bill Atkinson’s famous -2000 line change to Quickdraw - their jobs involve a lot of complex logic and very little actual code output.
It’s a shortcut for experience, but you lose a lot of the tools you get with experience. If I were early in my career I’d be very hesitant relying on it as its a fragile ecosystem right now that might disappear, in the same way that you want to avoid tying your skills to a single companies product. In my workflow it slows me down because the answers I get are often average or wrong, it’s never “I’d never thought of doing it that way!” levels of amazing.
You used the right tool for the job, saved you from hours of work. General AI is still a very long ways off and people expecting the current models to behave like one are foolish.
Are they useless? For writing code, no. Most other tasks yes, or worse as they will be confiently wrong about what you ask them.
I think the reason they’re useful for writing code is that there’s a third party - the parser or compiler - that checks their work. I’ve used LLMs to write code as well, and it didn’t always get me something that worked but I was easily able to catch the error.
Removed by mod
I don’t think LLMs are useless, but I do think little SoC boxes running a single application that will vaguely improve your life with loosely defined AI features are useless.
Who’s going to tell them that “QA” just ran the code through the same AI model and it came back “Looks Good”.
:-)
The code is bad and I would not approve this. I don’t know how you think it’s a good example for LLMs.
The code looks like any other Python code out there.
We’re doomed then because I would reject that in a MR for being unprofessional and full of bugs.
Removed by mod
In one of those weird return None combination. Also I don’t get why it insists on using try catch all the time. Last but not least, it should have been one script only with sub commands using argparse, that way you could refactor most of the code.
Also weird license, overly complicated code, not handling HTTPS properly, passwords in ENV variables, not handling errors, a strange retry mechanism (copy pasted I guess).
It’s like a bad hack written in a hurry, or something a junior would write. Something that should never be used in production. My other gripe is that OP didn’t learn anything and wasted his time. Next time he’ll do that again and won’t improve. It’s good if he’s doing that alone, but in a company I would have to fix all this and it’s really annoying.
It’s no sense trying to explain to people like this. Their eyes glaze over when they hear Autogen, agents, Crew ai, RAG, Opus… To them, generative AI is nothing more than the free version of chatgpt from a year ago, they’ve not kept up with the advancements, so they argue from a point in the distant past. The future will be hitting them upside the head soon enough and they will be the ones complaining that nobody told them what was comming.
Removed by mod
Downvotes by a few uneducated people mean nothing. The tools are already there. You are free to use them and think about this for yourself. I’m not even talking about what will be here in the future. There is some really great stuff right now. Even if doing some very simple setup is too daunting for you, you can just watch people on youtube doing it to see what is available. People in this thread have literally already told you what to type into your search box.
In the early 90s, people exactly like you would go on and on about how stupid the computerbros were for thinking anyone would ever use this new stupid “intertnet” thing. You do you, it is totally fine if you think because a handful of uneducated, vocal people on the internet agree with you that technology has mysteriously frozen for the first time in history, then you must all be right.
Removed by mod
They aren’t trying to have a conversation, they’re trying to convince themselves that the things they don’t understand are bad and they’re making the right choice by not using it. They’ll be the boomers that needed millennials to send emails for them. Been through that so I just pretend I don’t understand AI. I feel bad for the zoomers and genas that will be running AI and futilely trying to explain how easy it is. Its been a solid 150 years of extremely rapid invention and innovation of disruptive technology. But THIS is the one that actually won’t be disruptive.
Removed by mod
Tell me about how when you used Llama 3 with Autogen locally, and how in the world you managed to pay a large company to use disproportionate amounts of energy for it. You clearly have no idea what is going on on the edge of this tech. You think that because you made an openai account that now you know everything that’s going on. You sound like an AOL user in the 90 that thinks the internet has no real use.
Removed by mod
You’re just saying that you will only taste free garbage wine, and nobody can convince you that expensive wine could ever taste good. That’s fine, you’ll just be surprised when the good wine gets cheap enough for you to afford or free. Your unwillingness to taste it has nothing to do with what already exists. In this case, it’s especially naive since you could just go watch videos of people using actually good wine.
Please show me good code done with AI. I’m waiting.
Wonderfully said, this is a very good point.
I’m confused by this revelation. What did everybody think the box was?
Magic
In all reality, it is a ChatGPTitty "fine"tune on some datasets they hobbled together for VQA and Android app UI driving. They did the initial test finetune, then apparently the CEO or whatever was drooling over it and said “lEt’S mAkE aN iOt DeViCe GuYs!!1!” after their paltry attempt to racketeer an NFT metaverse game.
Neither this nor Humane do any AI computation on device. It would be a stretch to say there’s even a possibility that the speech recognition could be client-side, as they are always-connected devices that are even more useless without Internet than they already are with.
Make no mistake: these money-hungry fucks are only selling you food cans labelled as magic beans. You have been warned and if you expect anything less from them then you only have your own dumbass to blame for trusting Silicon Valley.
If the Humane could recognise speech on-device, and didn’t require its own data plan, I’d be reasonably interested, since I don’t really like using my phone for structuring my day.
I’d like a wearable that I can brain dump to, quickly check things without needing to unlock my phone, and keep on top of schedule. Sadly for me it looks like I’ll need to go the DIY route with an esp32 board and an e-ink display, and drop any kind of stt + tts plans
Sadly for me it looks like I’ll need to go the DIY route with an esp32 board and an e-ink display, and drop any kind of stt + tts plans
Latte Panda 2 or just wait a couple years. It’ll happen eventually because it’s so obvious it’s literally unpatentable.
I think the issue is that people were expecting a custom (enough) OS, software, and firmware to justify asking $200 for a device that’s worse than a $150 phone in most every way.
The Rabbit OS is running server side.
I didn’t know how much work they put into customizing it, but being derived from Android does not mean it isn’t custom. Ubuntu is derived from Debian, that doesn’t mean that it isn’t a custom OS. The fact that you can run the apk on other Android devices isn’t a gotcha. You can run Ubuntu .deb files on other Debian distros too. An OS is more of a curated collection of tools, you should not be going out of your way to make applications for a derivative os incompatible with other OSes derived from the same base distro.
I would expect bespoke software and OS in a $200 device to be way less impressive than what a multi billion dollar company develops.
Without thinking into it I would have expected some more custom hardware, some on device AI acceleration happening. For one to go and purchase the device it should have been more than just an android app
The best way to do on-device AI would still be a standard SoC. We tend to forget that these mass produced mobile SoCs are modern miracles for the price, despite the crapy software and firmware support from the vendors.
No small startup is going to revolutionize this space unless some kind of new physics is discovered.
I think the plausibility comes from the fact that a specialized AI chip could theoretically outperform a general purpose chip by several orders of magnitude, at least for inference. And I don’t even think it would be difficult to convert a NN design into a chip or that it would need to be made on a bleeding edge node to get that much more performance. The trade off would be that it can only do a single NN (or any NNs that single one could be adjusted to behave identically to, eg to remove a node you could just adjust the weights so that it never triggers).
So I’d say it’s more accurate to put it as “the easiest/cheapest way to do an AI device is to use a standard SoC”, but the best way would be to design a custom chip for it.
They’re not a chip
manufacturerdesigner though, and modern phone processors are already fast enough to do near real time text generation and fast image generation (20 tokens/second llama 2, ~1 second for a distilled SD 1.5, on Snapdragon 8 Gen 3)Unfortunately, the cheapest phones with that processor seem about $650, and the Rabbit R1 costs $200 and uses a MediaTek Helio P35 from late 2018.
Neither AMD nor nVidia are chip manufacturers. They just design them and send them off to TSMC or Samsung to get made.
The hardware seems very custom to me. The problem is that the device everyone carries is a massive superset of their custom hardware making it completely wasteful.
Custom hardware and software I guess?
Qualcomm is listed as having $10 billion in yearly profits (Intel has ~20B, Nvidia has ~80B), the news articles I can find about Rabbit say its raised around $20 million in funding ($0.02 billion). It takes a lot of money to make decent custom chips.
Running the Spotify app and dozens of others on a custom software stack?
Same. As soon as I saw the list of apps they support, it was clear to me that they’re running Android. That’s the only way to provide that feature.
Most of the processing is done server side though.
Isn’t Lemmy supposed to be tech savvy? What do people think the vast majority of Linux OSs are? They’re derivatives of a base distribution. Often they’re even derivatives of a derivative.
Did people think a startup was going to build an entire OS from scratch? What would even be the benefit of that? Deriving Android is the right choice here. This R1 is dumb, but this is not why.
It could have been a local AI and some special AI chip not found in all android phones, but since it is run in cloud, the privacy is really a problem
Removed by mod
Yes, but it’s also unauthenticated (it doesn’t verify it comes from the real device, or even run an account belonging to a device owner)
You just need the app
Until they inevitably shut it down
Spoiler: when they let you know about the better device, your phone will already be much better at the same client-side processing anyway.
What, you aren’t excited about a future where everything is cloud computing spyware that sends all your activity to an AI to be analyzed and picked apart by strangers?
So it’s just a single app running on a minimal Android implementation, the AI is done on remote servers and it still gets lousy battery life? Sounds like they dropped the ball on design. Nevertheless, no one is going to carry this that doesn’t already have a phone that can do everything the Rabbit does. It has no reason to exist.
Yes, they have came out since this discovery saying that there is no ‘app’ and that the AI computed requests in the cloud.
These people basically found the connection to the cloud.
But yeah, stupid product that does practically nothing [that a phone cant].
I don’t even understand what the point is of this product. Seems like e-waste at first glance.
It’s just marketing to be like “look at how capable our AI is with just one button”. I mean if you want to be charitable it’s an interesting design exercise, but wasteful and frivolous when everyone is already carrying devices that are far more capable supersets of this.
It’s just a hype app and the hardware is a fancy licence key
humane ai pin that actually is usable with 4 apps
lol at calling running Android an “emulator”.
Also don’t they have to distribute the actual code for the OS if it’s lightly altered Android?
My understanding is that if you only add modules on top, those can stay closed source. It’s possible the AOSP portion of the stack is still stock and untouched.
I don’t know, one of the reasons they’re decrying everyone running the APK is they claim they’ve made a bunch of “bespoke alterations” to the AOSP version they’re using
Which may or may not be BS intended to save their reputation. I hear you though.
AOSP is fully Apache-2.0 licensed except for the Linux kernel, so only their kernel changes would have to be. It’s also an important reason why Android was/is so successful.
Depends on which part is altered. Lots of Linux distros are just curated collections of software, drivers, and configuration. You can easily achieve your OS goals without touching the code of the base distro at all. If they didn’t need to modify the base code then there’s nothing to distribute back. That would be like distributing your personal OS power user config settings. If you’re not touching source there’s nothing to contribute.
Having seen what this device does, they may not even have had to alter anything to the base AOSP image. Just set your app as the launcher and you’re good to go.
This is why I cringe at cell phone manufacturers selling cloud and AI features based on phone models because wtf you’re not running that cloud on that handset so why do you gatekeep the product behind that model? It can’t require that many resources, it’s a cloud app!
It is to make you spend more to buy the better model. If you really want that AI you won’t mind spending a bit more
I know what you’re getting at and this isn’t directed at you and I know this is why it’s done, but the capabilities of the phone don’t have any bearing on the use of the AI so why gatekeep it? It’s a dumb way to make a profit.
It’s a dumb way to make a profit.
If it works, is it dumb?
When VHS was still around, DVDs were priced higher even though they were much cheaper to produce. If people are willing to pay more, producers/distributors will charge more. Yay capitalism.
I know. It’s dumb as hell. Just like everything being priced at 4.99 instead of 5.00. people are just stupid and it seems to wprk out for the companies.
it has the same cpu as my budget 100$ phone from 2018 lol
It does not need much to upload data and play audio. They could probably have gone even lower.
Bravo. I need to watch this show again…
deleted by creator
yeah but it’s also a power hog, power usage never dropped below 1200ma on idle on my phone
I defend a lot of misunderstood ai but this doesn’t have any good qualities even if it wasn’t a scam
deleted by creator
Should’ve named the company Snake Oil Inc.
their page to link accounts to it was not a real webapp, it was a novnc page that would connect to an ubuntu vm that runs chrome with no sandboxing and basic password store under fluxbox wm
someone dumped the home directory from it
Holy shit, that’s actually hilarious, I imagine someone would have noticed when their paste/auto type password managers didn’t work
For those confused, this sounds like instead of making a real website, they spin up a vm, embed a remote desktop tool into their website and have you login through chrome running on their VM, this is sooooo sketch it, its unreal anyone would use this in a public product.
Imagine if to sign into facebook from an app, you had to go to someone else’s computer, login and save your credentials on their PC, would that be a good idea?
What I don’t understand is why. This sounds like way more work than spinning up some out-of-the-box framework with oAuth or a Google login and hosting it on Lambda or Azure. What is logging in on a VM box even going to do for the device?
I’ve looked it up and it’s even uglier and I can kinda understand why they did it this way Basically, for their “integrations” they aren’t using any official APIs. Instead they just use the websites and automate them via the Playwright framework. So for each user they have a VM running with a Chrome browser to access the services. So now they have the problem that they need to get their users session cookies into the browser. And the easiest solution for that is having the users access their VM via VNC and just log into the automated browser.
This is such a hacky solution that I’m actually in awe of it’s shittiness. That’s something you throw together in an all-nighter during a Hackathon, not a production ready solution
Well that’s horrific.
I wish I knew what any of this meant…
It basically implies that they cobbled together some standard technology but they didn’t even put it together very well.
It’s like a solution that’s held in place with chewing gum and Band-Aids.
The “login” was actually a browser based remote access tool. You were signing in on a machine on there network running Chrome.
Someone dumped the contents of that machine.
