Hacker News Reader

Comment by Arnavion | Hacker News Reader

I don't have any interest in this product or sympathy for its manufacturer, but:

>On July 12th, I asked Rabbit Inc. if they had any comments to make on the content of this article [...] As of the end of July 15th, they have not responded.

That *was* between zero and two working days, depending on how early on Friday the author asked them for comments and how late on Monday they waited for a response. It might've been better to wait a few more days. I doubt they would've responded even then, but it would've made the case of their incompetence stronger, and given them less ammo for a rebuttal should they choose to make one.

View on HN

It was 1.5 working days, and there are other factors not mentioned in this article which meant they were lucky to get that (I could write a whole other article about how hostile and dismissive they've been to researchers). If they had requested an extension, I may have considered, but they didn't respond at all.

To elaborate, there are no new security disclosures made in this article. The logging issue has already received mainstream media coverage, after they resolved it and published an advisory, and people have been playing with flashing custom roms via mtkclient for months (as referenced in the article).

The only new "accusation" is that they are violating GPL. I informally asked them for GPL sources months ago via their community discord server, and I'm aware of others who have asked more formally.

Asking for their input on the article was a) giving them a courteous heads-up b) a formality c) an opportunity for them to correct me if they thought I said something untrue.

Sure, up to you. In any case I take it they still haven't responded?

Still no response.

> It was 1.5 working days, and there are other factors not mentioned in this article which meant they were lucky to get that

In your article you also wrote that you didn’t bother reporting it at all when you first discovered it. Why did you wait until the article was ready to be published to inform them?

Standard practice is to inform the vendor early and work with them as you write the article. Keeping the issue quiet and then demanding a rushed response when the article as done isn’t helpful to people who actually want the issue fixed before it goes public.

> If they had requested an extension, I may have considered, but they didn't respond at all.

Why would they request an extension when they fixed the issue a day before you tried to contact them? They should have written back and pointed you to the already-released security update, but I can also understand why they aren’t thrilled to engage with someone who is trying to make a mountain out of an issue they had already fixed.

> first discovered it

There's more than one issue here, and you're conflating them. IF the logging issue was non-public and non-resolved at the time I wanted to publish my article, I'd probably have given them longer.

> Why would they request an extension

If they thought 1.5 working days wasn't enough to provide GPL sources, for whatever reason. I don't see how you can argue that 1.5 days is simultaneously too short, and not in need of an extension.

Your outrage sounds disingenuous. 1.5 days is definitely not a reasonable timeframe for a response to a partially resolved issue. What is 1.5 days in this context? Friday afternoon and Monday? Do you and their security engineers even live in the same time zone?

>Your outrage sounds disingenuous.

I've read through these comment chains a few times, but I'm having a really hard time finding the "outrage", disingenuous or otherwise. Can you quote the part of the comment that displayed outrage?

>Do you and their security engineers even live in the same time zone?

Reading through this thread, you can find where the OP says that the time zones were accounted for.

This is a symptom of a broader narrative perpetuated the company itself, that any criticism is from "haters".

I know nothing about the product they are selling. As an engineer, I think writing a critical blog post after giving just a 1.5 day notice is bad behavior.

> Why did you wait until the article was ready to be published to inform them?

AFAIK the OP did not start writing his article until after they resolved it, which they did within 24 hours.

quoting the blogpost now, "firstly because I hadn't fully thought through the impacts at the time" The issue was overlooked by OP up until concerns were voiced by other community members which ultimately got the problem patched within 24h of it being noticed.

You claim "the amount of negative spin in the article left a bad taste in my mouth.", but you seem to be the only one spinning quotes out of context to fit your narrative

> AFAIK the OP did not start writing his article until after they resolved it, which they did within 24 hours.

No, the article says he did not report it (I don't know what you mean by "within 24 hours") and that he started writing before they fixed the issue. From the article -

> Fortunately for everyone else, the latest RabbitOS update (v0.8.112) addressed this issue while I was midway through writing this article.

From parent comment -

> You claim "the amount of negative spin in the article left a bad taste in my mouth.", but you seem to be the only one spinning quotes out of context to fit your narrative

The second sentence in the post begins with

> Critics unanimously agree that it sucks

And follows up with

> A week or so ago I bought an R1 on eBay for £122 (which is still way more than it's objectively worth). So why did I buy this garbage, in full knowledge of its garbage-ness?

The hostility toward the company is infused in the article.

Agreeing with the reviewer consensus that the product is mediocre is not "hostility". My blog post, on my personal blog, delivers objective technical analysis along with my personal opinions.

I don't owe anyone an emotionless regurgitation of facts, it would be incredibly boring.

The issue was first overlooked up OP, see quote from my previous comment.

Vuln was first mentioned in the community server on the 10th of July at 22:21 GMT+2 Rabbit then right on cue, on the 11th of July at 22:00 GMT+2 release the new OTA and patch notes, quickly followed by their security announcement 31 minutes later.

OP was the one who found the existence of these logs which were overlooked at first, until community members realized the contents of these logs and inability to remove them could be harmful

> Standard practice is to inform the vendor early and work with them as you write the article

This isn’t even remotely standard practice.

A fair number of people and companies will give the vendor a chance by doing coordinated disclosures this way - but it’s in no way standard practice.

Also when a company has a history of being openly hostile to disclosure attempts and downplaying stuff, the only way to force improvement tends to be “short warning, or even full disclosure”.

I’ve done everything from coordinated to “no warning” disclosures in my career, and at this point I tend to lean more towards “no warning” in situations where a vendor has a history of dismissing concerns or openly being hostile to external researchers.

For security issues, this is true. For finding that the company is lying, evil and obviously engaging in malicious practices... why ask them for a comment at all, except for a better blog post? Fuck them

> why ask them for a comment at all

Journalist integrity, but the author has expressed in several comments that he doesn't care about that. Which is fine I suppose, but it's weird to pretend to be a journalist or security researcher and not adopt any of their ethical standards.

It appears Rabbit had already released an update to address the issue on July 11th, the day before the author asked them for comment. They posted it here https://www.rabbit.tech/security-advisory-071124

> As of 11 July, we’ve made the following changes:

> Pairing data can no longer be used to read from rabbithole. It can only trigger actions.

> Pairing data is no longer logged to the device.

> We have reduced the amount of log data that gets stored on the device.

> The Factory Reset option is now available via the settings menu. Customers should use this option to erase ALL data from their r1 prior to transferring ownership.

How did you find this page? I tried to navigate all visible links from the main page and don't see any security advisory pages.

I believe it was buried in their "community forums", which only recently became publicly viewable.

"Only recently" will have a date.

Would you like to share that date with us?

Yeah, that’s an incredibly short timeframe, done on a Friday with what looks like an 8-hour time difference.

Back before bug bounties, the industry mostly coalesced around RFPolicy[0] in terms of security notification and response timelines. Upon establishing initial contact, five business days were given for a response before public disclosure if no response was received.

To me five business days seems appropriate if you’re acting in good faith and truly interested in hearing a response. It doesn’t feel like that was the intent; it feels more like a weak attempt to use the lack of response to pile on further.

https://packetstormsecurity.com/files/23364/rfpolicy-2.0.txt...

Timezone differences were accounted for (see my other reply), and this wasn't the first time they were hearing any of it. It was just the first time I put it into an article.

RFPolicy was well intentioned but in no way was ever a standard the community at large adhered to in my experience.

They should have used an LLM to write responses when nobody's at the office

Nobody's defending Rabbit here, but that's chickenshit journalism, and it happens too often.

Since when is an individual's personal blog "journalism", and therefore expected to live up to that standard?

I take it as a compliment!

It might not be "journalism", but I think it's pretty reasonable to wait a week for responses before dropping serious accusations It's not exactly a onerous requirement to meet.

Reasonable? Sure.

Expected and therefore commented that it's chickenshit when it doesn't happen? Yeah, no. If this were a reputable news outlet, that expectation would be reasonable.

I think it's entirely reasonable to report what you find when you find it, and update later with responses received.

Most of what's mentioned in the article is not any new allegations. Rabbit has been berated for their GPL violations for over a month now and the excessive logging was rectified before he even sent in a request for comment.

Requesting comments were only a formality to address already voiced concerns

It’s also pretty reasonable to respect the GPL when you financially benefit from it, yet here we are.

No no no, Rabbits mistakes are honest small mistakes from a great company! But this author, man of pure evil, hasn't waited long enough for my favourite bunny company to cover up their lies :(

>Since when is an individual's personal blog "journalism", and therefore expected to live up to that standard?

If the author is going to pretend to be a journalist of a security researcher, I see no problem holding their work to the ethical standards expected from those sorts of people.

>I could write a whole other article about how hostile and dismissive they've been to researchers

Please do.

Reply on news.ycombinator.com