Alberto Fuentes (e/acc)

Reality of our days: 1. I am sitting on a set of vulns (4+) that allows me to remotely take over a consumer home automation device I have (3+ diff ways). 2. The vendor doesn't only serve consumers, but also critical infra (announced partnerships include pharma manufacturing plants, airport logistics, hospitals, etc) across various locations in Europe and the US (not the same product line, ofc, so maybe moot). 3. Claude and Astra refuse to help me explore even my own device, so now I'm using Chinese hosted models for investigating. 4. The vendor (with a revenue of $0.75B) does not maintain any security disclosure practice whatsoever, nor does respond to emails. So, to recap, I need to outsource vulnerability hunting of (potentially, I don't know) critical western infrastructure to Chinese models, because the western models refuse; and the vendor doesn't give a shit. Fun timeline. PS: The vendor is Swiss.