Hacking old hardware by renaming to .zip [video] (youtube.com)

by abadar 88 comments 122 points
Read article View on HN

88 comments

[−] morsch 49d ago
What a coincidence, I just got an email announcing that Breville intend to orphan my Joule sous vide stick: the existing app will stop working, the new app is only available the US and Canada and in parts of Europe.

Live in another country? You're s.o.l., it wasn't officially sold there. You need a new account as well, hope you like the TOS.

All of this for a device whose core functionality -- setting a target temperature, getting the current temperature and checking for error states -- is both trivial and has no inherent need for internet connectivity.

I suppose I should be grateful they're still supporting a device that's like 10 years old. Caveat emptor (I got it as a gift).

https://community.chefsteps.com/discussion/78615/joule-sous-...

[−] red_admiral 49d ago
"With Breville+ Cooking, you’ll get: ... The ability to cook with or without WiFi anywhere, anytime."

What has gone wrong with humanity, that we need to advertise that as a feature if you download a new app?

[−] sigbottle 49d ago
On the one hand, every time I read an article like this I'm vindicated against astroturfed bots claiming that nothing ever happens and this isn't where we're headed.

On the other hand, I don't want to be vindicated.

[−] duskdozer 49d ago
It reads like a sarcastic post from 10 years ago ending in "Stallman was right"
[−] greenavocado 48d ago
It is essential to purchase and configure Home Assistant (https://www.home-assistant.io/) compatible devices around the home whenever possible if you want a "smart home" that will last. Everything else is an Internet of Shit treadmill that lasts at most a few years before it falls off and is replaced by a new piece of e-waste.
[−] seany 48d ago
The caveat here is that it needs to be local. I have a few things that work with HA, but they basically highjack the apps cloud login tokens ..
[−] greenavocado 48d ago
That is terrifying
[−] Ekaros 49d ago
From get go I considered the whole design with no interface on device a bad idea... Apps can and will often go. Better to have also the local controls.
[−] compass_copium 48d ago
Don't want to remember how much money I spent on a Copengagen wheel for my wife when she was in school. At least some kind souls published a way to unbrick it.
[−] RajT88 48d ago
It's a plus from the manufacturer side - kitchen gadgets you keep more than 10 years.

With required smartphone app, it is almost assured to not work in 10 years, and you have to buy another one. Just another method of planned obsolesence.

[−] radicality 48d ago
That’s just sad ugh, just the other day I was using my pre-shitty-IoT era Sous Vide machine (Anova brand, I think it might have been chefsteps recommended too, got around 2014/2015), and I was thinking how glad I am that it has zero fancy connectivity - just a wheel to set the temperature and a start/stop button and simple led display. Still works great.
[−] nkrisc 49d ago
I have an Anova sous vide cooker that is also about 10 years old and has an app, but is fully functional without it.

When I bought it the app was free, but then later became a subscription addon. However they grandfathered all original owners into a free lifetime subscription. Pretty classy.

[−] WalterBright 48d ago
I've bought 4 internet radios over the last 25 years. They work for a few years, then are bricked because the remote server disappeared.
[−] EvanAnderson 48d ago
You rented the devices with a full up-front payment, but the manufacturer stuck you with the e-waste problem when they decided to be come an absentee landlord.

This needs to be fixed by regulation. If a device requires an online service to function it (a) needs to be clearly advertised as rental and not a purchase, and (b) the device manufacturer must take the devices back and deal with the e-waste if they discontinue the services or release the software stack (including complete and corresponding source code and build environment) to allow third-parties to host it.

[−] elwebmaster 48d ago
This! Absolutely needed regulation. Why is it that such a clearly beneficial and necessary piece of legislation is not making its way through the legislative bodies of the world while age checks somehow magically appeared universally?
[−] somat 48d ago
Needing an app for these things is stupid in the first place, but the real kick in the metaphorical nuts is that the needed app should be stored on the device. Want to use your phone to control the device load the program to do so off the device itself.

We really only have one tech stack where this actually works, the web. And I consider this to be either the great failure of the app ecosystem(why on earth do apps need a manual install step?) or amazement that the corporate overlords let the web slip through the gaps.

Is there a way to do web over bluetooth? or is that another missing piece?

[−] nkrisc 48d ago
For the one I have the app is completely optional. It doesn’t add any capability, it just lets you control it remotely. It will perform all its capabilities just fine without you ever taking your phone out.

For the subscription you also get additional content like recipes and such that I don’t care about. I wouldn’t pay for it.

[−] ThePowerOfFuet 49d ago

>a device whose core functionality [...] is both trivial and has no inherent need for internet connectivity.

For a while I've given a hard pass to anything which requires an app for such functionality, knowing full well that eventually I'll be locked out of it (not to mention the privacy implications of such designs).

I encourage others to follow suit.

[−] userbinator 49d ago
This reads like satire:

The ability to cook with or without WiFi anywhere, anytime.

[−] ErroneousBosh 49d ago
If you're not cooking with WiFi, you need more key-down transmit power.

I'm currently full QRO on the 13cm band with something around 1600W EIRP CW, and will be for several minutes until the curry base defrosts.

[−] ThePowerOfFuet 49d ago

>WiFi

>1600W EIRP

Your local regulatory authority would like a word with you.

[−] ErroneousBosh 49d ago
I hold a licence that allows me to transmit on pretty much whatever frequency I like with as much power as I like, wherever I like.

Someone has to test the transmitter before you hand it off to the customer.

Also, I'm in the UK, where it's hard enough to get the regulatory authorities to do anything about people causing interferenced to licensed chunks of band. You can wipe out the whole of 2.4GHz if you like, you literally could not pay them to take an interest.

Edit: also you have probably done the same a couple of times today too.

[−] Infernal 49d ago
So I thought your initial comment was a (pretty good) joke about using a microwave oven, but now I’m not sure. Is this testing license you reference a continuation of the joke or a real thing?
[−] ErroneousBosh 48d ago
The testing licence is real but the comment was a joke about microwaving some sauce base :-)
[−] toxik 49d ago
And in a bold face font:

> You've always needed an account to operate your Joule Sous Vide with the Joule app. This is not a new requirement.

Absolute comedy.

[−] esquivalience 49d ago
I'd pay to cook with WiFi. Just imagine the signal strength!
[−] toast0 49d ago
Isn't that just a microwave oven, more or less?
[−] firtoz 49d ago
Just need to amplify it 10000 times
[−] RajT88 48d ago
So - I know folks who have mulled over attaching the emitter of a microwave oven to a parabolic 2.4ghz antenna (indeed, same spectrum).

It would be cool... For anyone who does not want children one day.

[−] userbinator 48d ago
Or 40dB. This is why those working with RF use dB --- power varies by orders of magnitude between the transmitter and receiver.
[−] duskdozer 49d ago
If you can cook with it, just imagine what it's doing to your brain! Forget about 5G...
[−] jgalt212 49d ago
Jack Donaghy would ride this pitch right up to the C Suite.

“Ambition is the willingness to kill the things you love and eat them to survive”

[−] OptionOfT 47d ago
Makes me glad I got the Anova one. They don't _need_ an app per-se, however they recently did do a rug-pull by making the app a subscription.

They grandfathered me in, of-course, but it still is absolutely disgusting.

It should be mandatory to build systems with local connections in mind. mDNS is a thing.

[−] sulplisetalk 49d ago
[flagged]
[−] charcircuit 49d ago
I've found that Claude Code works well at reversing java applications. Even if it is fully obfuscated claude can restore sensible names for everything and understand how it all works and answer questions about what it is doing.
[−] 26d0 49d ago
+1. While vibe-coding (natural language to code) is not such a great idea, we can always check the source, so vibe-reverse-engineering (code to natural language) may actually be quite useful.
[−] evilduck 47d ago
Super useful. I have a no-name USB microscope that only supported iOS and Android (just look up "USB microscope" on Amazon, there's like 500 versions of the same device). The device doesn't work like a normal webcam so you can't just plug it into a PC, and their mobile software is shady and low quality so I would only ever connected it to a GrapheneOS phone where I could prohibit their app having network access entirely because it gave me a bad feeling. As a result I underused the device since it was annoying.

I recently took their .apk and dropped it in a new empty project folder, instructed Claude Code w/ GLM 5 to reverse engineer the app, assess it for security and privacy concerns out of curiosity and then to probe the USB device to figure out why it doesn't work like a normal UVC webcam. After the investigation and planning I then instructed it to write a new app to use it on my desktop. I pretty much yolo'd it from that point and let AI drive the bus (I did the visual checks of the video stream in the app to provide feedback... while I watching a movie). I wound up with a working Electron app using libusb two hours later. With a Typescipt/C POC in hand as reference in another hour I had functioning Rust + egui application. Visually, both apps are rough around the edges but have complete functional parity with the mobile apps. It took 68 million tokens.

[−] RobMurray 48d ago
I got codex to vibe reverse engineer two devices from rom dumps recently - a talking timer that uses an 8051 cpu and a custom 5 bit audio format, and an ice cream van chime box that used a z80 and a ym2149 sound chip. Quite simple devices, but it did a great job. also made a web-based emulator for both. apparently WASM is hard, but I didn't notice.
[−] egeozcan 49d ago
Interesting, I'd have assumed the guardrails would disallow them from doing anything like that, regardless of legality. Do you need to "convince" it to do it or no questions asked?
[−] userbinator 49d ago
Naming is an area where LLMs are useful; but I'd still use a regular Java decompiler (there are quite a few of these around) for the actual decompilation part.
[−] fendy3002 49d ago
huh, iirc this already exists long before LLM
[−] geon 49d ago
I experimented with disassembling 6502 from the c64 California Games. Claude was very prone to bullshit.
[−] elwebmaster 49d ago
Why would you say "semi-legally"? Nothing "semi" here. What is "semi-legal" is making hardware e-waste by deciding it is "no longer supported". It is "semi" legal because it is legal under the corrupt political systems in most of the world but is criminal against humanity and the planet we all call home. In that sense if you can prevent e-waste trough any means you are a hero.
[−] userbinator 49d ago
Warning: Very rambly and somewhat incoherent video; tried to pay attention due to the topic being of interest, but very quickly gave up.

EULAs be damned, even the DMCA has exceptions for RE in the name of interoperability and repair.

[−] kelvinjps10 48d ago
I really liked the video. I didn't realize you could build programs for no longer supported hardware like this. I had a similar epifany with SVG, there was an image that I needed to keep editing and then one day I opened the SVG file and realized it's a very readable file and then just built a python script that would modify the SVG file.
[−] albert_e 49d ago
Has anyone does this for VIZIO app that controls among other things their soundbars (circa 2019)

I moved to a different country and the app is not on google play store in the new geography.

Even when it is installed somehow it is absolutely unreliable in pairing or controlling the device.

Wish I had time to go on a quest and reverse engineer and build my own better controller.

[−] JimDabell 49d ago
The same is true for iPhone apps (.ipa files). You can just unzip them.
[−] tosti 49d ago
Makes sense for an apk to be a zip file. Apps were supposed to be written in Java and that has always shipped binaries in zip files (jar or war).