Locked out of 'God Mode', runners are hacking their treadmills

The first time I encountered this was when Sony advertised Linux-compatibility for the PS3, which I bought expressly for that purpose. I was shocked when a judge upheld Sony's post-sale removal of that capability.

I have been appalled at the way people bend over and open their wallet since I was a preteen. Nordic and all the other rent seeking shits count on people blindly using their product they way they are told to. I'm surprised Nordic isn't suing their customers yet.

Anec-data: I purchased a cooking device for my parents in December and it has a single button to turn it off. The only way to use it is with an app which requires a login to the company's service. The device even has local bluetooth capabilities. You may be wondering, "What is this device supposed to do?" and the obvious answer is: "It's supposed to boil water." The real answer seems to be, "it collects usage data about customers boiling water."

I tried several alternatives in terms of smart TV (Apple TV, Google/Android TV, Fire TV), and I could not find any platform that let me use all of the apps that I needed without resorting to casting from my phone. And in some cases there was a long process to follow in order to get the device to do what I needed[1], which involved activating developer mode, sideloading apps etc.

In the end, I bought a wireless keyboard/touchpad combo and built a HTPC, reusing old components that I removed from my gaming PC after upgrading it over the years. I installed Ubuntu on it and never looked back.

[1] For example not having the home screen being made of mostly ads, or having a simple web browser installed on the device

Welcome to the Right to Repair movement!

Overreacting aside, control schemes can be customized again in 1.4.

On the one hand you're purchasing hardware, which you expect to own and control.

On the other, there is software that runs on a subscription model which 'coincidentally' restricts the functionality of the hardware, because they want to stop people from bypassing the sub.

The hardware effectively becomes useless if the subscription service becomes unavailable or is taken down (e.g. if the company is acquired and the new company doesn't want to support that stuff any more). It might still function mechanically, but it now has a broken appendage through no fault of your own.

I just don't think I could justify a purchase like that nos unless I could square that circle. I'm not going to pay 2k for a Peloton bike that holds itself hostage unless I pay another 40 a month.

That's about any electric car manufactured after 2020.

I think this is a problem which should have a mostly technical solution: If most software was updated as today and users could rollback at will, most problems would be solved. That's a better way than making updates illegal.

What about your other devices?

This is much more a question of relying on "off-label" feature / bugs in a product, which will always be an issue. The problem here is that the advertised experience was "you can only use our content" and that should have been enough to scare off potential buyers from considering it as an option.

Of course, some tech bro will say that their spoon2.0 is specially engineered for the best soup flavor …

Not great for security though…

That is why I call those devices 'dumb' devices (reminds me of a SciFi book where the AI helpers are called "artifically stupids"). Smart devices are local, no auto-updates, working with no issue in the event of an outage.

I have many smart devices, all that would stop working in the event of an internet outage, would be the voice interface.

I’ve often thought about starting a hardware company that provides all the source code, schematics, bill of materials with the sale of a product. This is a dream and a desire I have for the things that I do buy.

For example, I have several digital cinema film cameras that I do not plan to upgrade or sell. Unfortunately they are showing their age and have some fixable faults. I have spent the last two years to reverse engineering these cameras to identify the fault. If only I had a schematic.

I don’t expect the industry or politics to change any time soon. If only a hardware company could change the status quo by enabling their customers to be enabled to have full ownership and access.

- here

- John Deer self-fix stories

- Apple store stories (and Android/Google variations)

- Several flavors of techs at places like best buy quivering in their boots at an Apple fix. Techs keep blabbering on about Apple repair policy and what they cannot do. I finally had to tell the guy: Start telling me what you can do, or I'll talk to somebody else. All I asked for was if they have a screw driver to take the bottom plate off, which I later got off Amazon.

- General issues of privacy

We gotta get back to customer satisfaction. Eventually --- not as quick as we might prefer --- customers will realize they have the stronger position and use it. Indeed, if I plunk down money for an object, my assessment counts. I do not accept some paper pusher a large-corp-America gainsaying that.

For example, windows updating. There was an updating when professor gave the talk in class. Windows updating popped out. There is no way for professor to stop the updating. He missed the chance and windows already went into blue updating screen. So, We had a break, and professor went to his office to find another computer.

Another problem is that automatically updating almost always runs silently. When I played online game and the game went laggy, I always tabbed out to see what happened with resource monitor. It is easy to find out there is whatever updating using CPU or bandwidth.

I feel updating just like legally raping my device. Oh. It is OUR device.

No refunds, no apologies, just a game I'd paid 50 dollars for suddenly didn't work any more. Ultimately, still value for money given how many hours I'd ploughed into it before they broke it, but yeah, I think twice now about that kind of purchase.

Maaaybe.

The public statement from them sounds like it was legal whining about liability issues, and if that's actually true (which, well) then if it has to be sufficiently intentional on your part that may be sufficient for them to leave well alone.

Certainly worth preparing for that not being the case though.

Thanks for the idea. I might get some kind of tablet so I can watch things without moving my (cheap) stationary bike in front of the living room TV.

The accessory part is also pretty neat though. I use a low end exercise bike that came with a snap-on plastic tablet holder. It works pretty well but it got me thinking about hacking the thing. I was finally able to mount a scanner radio, a ham radio, exercise bands, and my phone along with the tablet. Then my kids decided to take it off my hands for a while...I think Dad looked a little too motivated.

I actually don't get the point of getting a 4000 treadmill rather than one that's half the price and an ipad

My smart rower consists of a C2 Model D sitting in front of an old-school panasonic plasma TV in a spare/theater room. Both components are over 10 years old by now and neither show the slightest signs of giving up the ghost. That TV doesn't even know how to talk to the internet, and I lost the USB cable for the PM4, so everything is effectively off-grid.

If you're into running on a treadmill, this looks like a very sweet setup. It has a huge touch screen that's just in the right spot, you can easily reach it while running, and it has gimmicks like automatic adjustment of inclination.

It's not cheap, but it looks like really nice hardware. I totally understand why some people would want something like that, especially if you can install generic Android apps on it!

If it's the former, then they should keep god mode for treadmill service operations inaccessible but also allow loading apps like Netflix and Hulu. I'd wager that streaming apps are what most of the people using god mode want.

However, we still need to tackle the subscription issue, I.e. That manufacturers can hide behind "you didn't renew the subscription for this printer/treadmill so now we brick it". Any ideas?

For example suppose the UI of a treadmill has a "Last 5 workout programs used" section on the front page of the UI to allow the user to select with one tap a recent program. An update replace that with a "recents..." button which takes you to a new screen that shows the last 10 programs used.

Is no longer providing one tap access to the most recent 5 programs removal of functionality? Or is the feature just that it has a way to recall recent programs so as long as there still is a way to do that, even if more convoluted, it does not count as a feature removal?

How about functionality that was not in the device when it was purchased but was added by an update? If the law does apply to that, then in effect the manufacturer will be locked into only ever adding functionality. After a few updates the UI is probably going to be a total mess.

If the law only applies to features present at purchase, then manufactures will just ship bare bones devices that only implement what is necessary to make the claims on the box and in their advertisements not false. Then the first update will add a ton of stuff to make it more than bare bones.

Like most of things in life, the answer is very rarely a new myopic and ill-conceived law added to the thick stack of existing incomprehensible legislation.

The way class action is done in the US it only makes sense for the law firms.

I have stacks of class action letters and in almost every case I get exactly zero...

https://imgur.com/a/HDE0939

[0] https://www.concept2.com/service/software/software-developme...

It's amazing to me just how (relatively) cheap the Concept2 is. Solid, well made, and reliable.

It is almost inconceivable that they would know enough to use good cryptography but not know that they needed long keys, so a lot of people believe they intended for it to be easy to hack.

One theory I've heard that makes sense is that this is for price discrimination. Your hobbyist user, buying a scope to figure out what is going wrong when they try to talk to their humidity sensor with their Arduino, is not going to pay an extra couple hundred dollars to get the protocol decoding add-on. Paying $400 for the basic scope is already near their limit. So let them have all the features--it makes the Rigol scope more attractive to those users without really costing Rigol anything.

So why not just include all the features without requiring keys to enable them?

Because people using the scope for business will pay more for them. That's because if they use a keygen program to enable them and use the scope to design or test some product, and later something goes wrong with that product and someone gets hurt and they find themselves being sued, they don't want to have to deal with how a plaintiff's attorney would try to spin that in front of jury.

Sure, it would probably not be hard for the defense to respond and explain that the scope behaves exactly the same regardless of whether the key was purchased from Rigol or came from a third party keygen program, so you might think no harm would be done by plaintiff bringing this up.

However, civil trials have time limits on how much total time each side gets to present their case and to rebut the other side's case. If defense has to take time to educate the jury on the whole Rigol key system and how keygen programs are safe, that's time they don't have for other things.

I've seen that kind of thing happen. I was a witness for a plaintiff in a suit. Early on, defense was able to find something totally minor but that looked bad if you didn't know the details of state tax and corporations bureaucracy [2]. It took them 2 minutes to use that to make us look dishonest. It took much longer the next day to explain all the details to counter that. For the rest of the trial, we were short on time and had to drop some things.

Later, when I was on the stand defense asked some questions about a particular piece of software the plaintiffs developed. They asked detailed technical questions and I answered them. Then they said "play the video of tzs's deposition from <date several months earlier>". On that video I was asked the same questions I had just been asked in court, and answered that I had not worked on that software and didn't know the answers. Defense then said "no further questions" and walked away.

I expected our lawyers to then ask about this, so we could explain why I apparently was either lying my ass off in the deposition or lying my ass off a few moments ago, but they didn't. They later told me they were short on time, and decided that having the jury think I was a liar was less of a problem than dropping the other stuff they would have to drop to deal with that.

So why the apparent discrepancy between my deposition and my later in court testimony? The deposition was 100% correct. I had not worked and that software and didn't have any deep technical knowledge of how it worked.

Later however, I was designated as the person on our side who would be answering all technical questions about our software. This would cover all our software that might come up in the case, not just what I had worked on. So I spent a considerable amount of time after that deposition studying the source for such software, and by the time of the trial I was able to answer deep technical questions concerning it. (Which defendant was fully aware of, by the way, since between my first deposition and the trial, there was a deposition where I appeared in the role of expert on all our software).

[1] Besides doubling the bandwidth, there are keys for expanding the amount of memory, adding advanced trigger options, adding protocol decoding for various useful protocols like I2C and RS-232, and I think some other features that I'm forgetting.

[2] Briefly, when you paid your taxes you got a receipt from the state revenue department. You were supposed to file a copy of that receipt with the state corporations office. Someone failed to do that. If one then queried the corporations office we were listed as having not paid our taxes.

The safety argument isn't so much an argument as it is a trigger word to elicit a response in people.

I actually walked down to the basement to test this - even when closing the iFit app while in God Mode, the physical controls on the treadmill including speed, incline, the stop button and the magnetic safety key, continue to work as designed. If you close the app then you can't see your current speed, but you can still stop the machine.

That being said, I haven't dug into how the iFit app sends commands or retrieve data from the treadmill's controller. It seems possible that a "rogue" app could somehow interfere with this communication or send its own set of commands to throw you off the machine, but feels very unlikely. Plus, the tablet on my treadmill is running Android 7. I'd be much more afraid of remote exploits on the embedded browser on this ancient OS than someone with physical access loading a malicious app.

> TO GET AROUND THIS SCAM, hold down the iFit logo on the treadmill for 30 seconds and your treadmill will work.

Admittedly, it sucks if you need to do this every time. But it's Amazon, so return?

As a total aside, I bought a treadmill last year and turned it into a walking desk as part of my WFH setup. I wasn't sure how much I would use it, but holy cow I love it!

Apparently there's a demand for well designed hardware that runs generic software.

---

Legally - prohibit selling physical goods that contain digital locks unless the owner is given a key. Period.

---

That's all you have to do. If I own the device, I get the keys for the physical locks, and the keys for the digital locks.

I'm completely ok with manufacturers locking down computers for security, in much the same way that I appreciate that cars have door/ignition locks.

But if I own it - I get all the keys. I may never use them, but they are mine, as part of ownership.

What happens if, when you're upgrading your new right-to-repair laptop, you leave some wires sticking out of the battery and fry yourself, and then sue the laptop maker?

Indeed, what happens when you fry yourself repairing the ur-right-to-repair device, the light fixture with a removable lightbulb?

You can invent any scenario for any machine or device that the user can repair, but it should be fairly straightforward to add language that says "if you modify the device's behavior in such a way that it harms you, that's not our fault."

That said, I still hate treadmills and prefer to run outside, but there’s a huge difference between a cheap one and a good one.

- When my kids were younger, I was always nearby during a workout.

- I can comfortably work out regardless of the season, weather, or time of day.

- I can easily take a bathroom break mid-workout.

- I can do much longer workouts without getting bored, because I can watch movies or play video games during the workout. (E.g., using an exercise bike + my own computer.) This works around motivational / persistence issues I used to have.

- I can end a workout on short notice. Contrast to a long-distance run or bikeride, where I may be far from home when something comes up.

If it's an option for the exercise you want and your health and safety, sure. It's not always an option and there are some exercises (like rowing) that are't practical to do every day unless you live on or near a body of water, and even then. If the lake freezes over, good luck rowing!

> I will 100% run in single digit temperatures with snow on the ground before I touch a treadmill.

Good for you, do you want a cookie or something?

Then you need to make an effort, because it's really not hard to understand if one has even just a bit of life experience as an adult. But it sounds like an excuse to brag about the harsh weather one runs in, and those damned kids and their video games or something. Here, I'll one-up you: I regularly ran in snow and sub-zero (Fahrenheit, bitches) temperatures when I lived in Indiana. I now live in the much milder Pacific Northwest, and I own a treadmill. 'cuz you know what? Sometimes outside isn't better than any of those, and I just need to get some miles in.

But some of these exercise machines actually come with an impressive 32inch HD screen and loud speakers built-in which you can hear over the running noise. If you stop paying hundreds of dollars per year for an iFit subscription, the only thing this giant display does is show you the time and distance on a white background.

And perhaps you'd say, "don't buy a machine with a built-in screen", I'd say the article points out people actually decided to purchase these models _specifically_ because help articles and other resources showed how to get into the Android interface. Sideloading apps was practically sold as a feature.