Yeah no, I get the distinct impression that this is investor bait. The demo models are just plausible enough to draw some funding (“this one’s just the prototype! next version will be better with your money! swearsies!”). It’s not intended to be useful, it’s intended to get VC buy-in. I think it’s vaporware.

I mean, my first complaint would be that this is essentially a surveillance platform, basically Flock in a human-shaped shell. Also it’s likely that it works essentially like Waymo, where there is remote human oversight to handle situations that are beyond the capabilities of the automation. That means that beyond just video, audio, and whatever else being sent to some corporate servers, there’s potentially a human in another country watching through those eyes in real-time. Even if those remote employees are well-intentioned and trustworthy, how secure is the access to that? How much effort is there to prevent someone else from breaking into the stream?

My second complaint is just that this appears less advanced than Disney animatronics from the 80s. I haven’t seen any evidence that these things can walk, they all appear to be standing still. It’s basically a bigger Tickle-Me Elmo, with a webcam.

What exactly was a classroom supposed to do with an anamatronic mannequin anyway? What practical benefit was this thing supposed to have in an education setting?

yikes

People invest money in this? I should start a robotics company…

Your first concern should be your boundary firewall. You should have all ports closed except the ones that you are definitely using for external services. You should know which ports you have open and why, and what traffic, how much and how often you expect to see on those ports (8080 will have regular Internet use traffic, but your reverse proxy port should only have traffic when you’re away from home and actively using it), and you should monitor that traffic at the firewall every so often, and especially when you make changes to your network. Closed ports should be configured to drop packets rather than respond that the port is closed (stealth mode). On a home network, preventing unwanted incoming connections will protect you from the majority of malicious activity. It’s the most effective single thing you can focus on.

The next thing would be to separate untrusted devices onto dedicated VLANs. This would be for IoT devices, gaming consoles, “smart” appliances, anything that connects to the Internet whose software you don’t have control over. They get isolated on a VLAN that only connects to the Internet and doesn’t allow local connections to devices on other VLANs, so the rest of your network doesn’t exist as far as they’re concerned. This should cut down on things like “smart” appliances taking inventory of your home network and reporting it back to the manufacturer’s servers.

If you do these two things, and you’ve got your reverse proxy configured properly so that other people can’t break into it, you should minimize unwanted connections to your network and your server/containers should be fine with default internal firewall policies. The only reason you would need to do more is if you expect a direct/intentional attack by a motivated hacker, but in that case there’s not much you can do unless you’re an expert.

If you want to go further, try implementing the community version of runZero:

https://www.runzero.com/platform/community-edition/

https://help.runzero.com/docs/self-hosting/

https://www.cisa.gov/resources-tools/services/runzero-community-edition

This is a network visibility tool that will discover and identify devices. To get a really complete look, you would run it from inside your network and deal with anything that you don’t think should be accessible, then run it again from outside your network to see what a potential attacker would see.

Yup.

What’s that line? “Luck is when preparation meets opportunity”?

The best time to build a chip fab is 10 years ago. The second best time is right now.