For the best experience on desktop, install the Chrome extension to track your reading on news.ycombinator.com
Hacker Newsnew | past | comments | ask | show | jobs | submit | history | achillean's commentsregister

There will be some honeypots in this data but this is a start:

https://www.shodan.io/search/report?query=product%3Atelnetd+...


FYI: it might be better to search by port:23

https://www.shodan.io/search?query=port%3A23

Or to filter by product:telnetd

https://www.shodan.io/search?query=product%3Atelnetd

A query of "telnet" searches Shodan for banners where the "data" property contains the string "telnet":

https://book.shodan.io/getting-started/query-syntax/


Port 23 has decreased significantly over the past decade:

https://i.imgur.com/tZoTWu6.png

Still seeing a sizable number of open ports but it's on the decline.


Already seeing some of the new Moltbot deployments exposed to the Internet: https://www.shodan.io/search/report?query=http.favicon.hash%...


Maybe those folks buying Mac Minis to host at home weren't so silly after all. The exposed ones are almost all hosted on VPSs which, by design, have publicly-routable IP addresses.

But anyway I think connecting to a Clawdbot instance requires pairing unless you're coming from localhost: https://docs.molt.bot/start/pairing


The silly part is buying a $600 Mac mini when any $100 NUC or $50 raspberry pi or any cheap mini PC off of eBay will do the job exactly the same.


The silly part is buying a $50 raspberry pi, then storage and memory and so on, when a $200 used M1 Mac mini is plug-and-play.


$40 used ThinkCentre Tiny is also plug and play! Or Dell Optiplex Micro, practically the same thing.


The silly part is buying a $200 used M1 Mac mini, when a $5 Arduino clone can be used to blink an LED.

Oh wait—that’s the silly part


That was supposed to be a joke. Guess I won’t give up my day job


"What is my purpose?"

"You turn this LED on or off"


Doesn't Moltbot specifically require MacOS for iMessage, Apple reminders, and some other Apple-ecosystem features?

HN is the last place I expected to see someone laugh at self-hosting


If you want iMessage you still need an always-on Mac, whether that's the main moltbot gateway, or the MacOS app running in 'node mode' to allow a moltbot gateway to use it to send/receive iMessages.


I noticed when I was reading Federico Viticci's post about it that he was using telegram, which has much better support for "markdown"-y rendering, which looks a lot nicer than iMessage. And then I thought to myself, why would iMessage actually matter? The only other use-case would be interacting with texts, but almost anyone can tell when someone is using an LLM to text - I feel like our texting styles are so personal, and what is there even to gain from using an LLM just with text messages? So is it even worth it to run on a Mac?


I see value in the LLM being able to read/integrate my iMessages since a lot of my scheduling/commitments are discussed on there.


> need an always-on Mac

Not really, you can emulate macOS on any Linux/x86-64.

But it is actually a good point to get a Mac Mini instead of a NUC. The Mac Mini is going to deliver better performance per Watt.


Can you really register iMessage on an emulated MacOS these days? I'd love to learn more, the AIs I asked say it doesn't seem possible in VMs anymore.


I think you need to register on a real Mac (2 of 3 of my MBPs use OCLP), but then can use an emulated one if you add it to your Apple account. Either way, I don't recommend to use a protocol behind such a moat. Probably better to use Signal or Threema.


Moltbot is supposed to be a 'personal AI assistant'

with >60% market share in US, you can't really expect people to just 'not use iMessage'. It's what the messages are going to be coming in on


> Not really, you can emulate macOS on any Linux/x86-64.

Intel is going to stop being supported with the current OS version (Tahoe, 2025). OS are supported for about 3 years.

I'm curious what will happen after. If they'll break it or if they'll allow the services to keep running on unsupported hardware.

Got a couple years left


I expect someone will eventually get around to reverse engineering the various M series specific instructions for qemu. Does imessage make use of hardware attestation to register with the remote endpoint?


Our SFF HP came out at 150€ with flash storage and 16GB of RAM. I see used M1s for 200-250€ where we live. The only drawback of the M1 is you’d be stuck buying a NAS/DAS for the storage part, whereas the HP has 3 internal SATA ports. Neither option is silly, they have different pros/cons. Managing Linux quirks has gotten frustrating, for example.


depending on how you set up the reverse proxy, clawdbot can think _all_ traffic comes from localhost


Wasn't aware about this favicon trick, nice :)


FYI we released a tool to calculate a bunch of these types of hashes: https://book.shodan.io/command-line-tools/shodan-hash/

More info about the favicon hashing technique: https://blog.shodan.io/deep-dive-http-favicon/


Like I said before [0] infosec professionals are going to have a great time collecting so much money from vibe coders and crypto bros deploying software they openly admit that they have no idea what it does.

If you are very clever there is a chance that someone connected Moltbot with a crypto wallet and, well...

A opportunity awaits for someone to find a >$1M treasure and cut a deal with the victim.

[0] https://news.ycombinator.com/item?id=46774750


I had a similar experience where a competitor released an academic paper rife with mistakes and misunderstandings of how my software worked. Instead of reaching out and trying to understand how their system was different than mine they used their incorrect data to draw their conclusions. I became rather disillusioned with academic papers as a result of how they were able to get away with publishing verifiably wrong data.


Honeypots are advertising that header as well nowadays:

https://www.shodan.io/search/report?query=x-clacks-overhead

Most of the non-honeypot results are for the Gargoyle Router Management interface exposed by Korea Telecom:

https://www.shodan.io/search/report?query=x-clacks-overhead+...

The results have increased significantly over time:

https://trends.shodan.io/search?query=x-clacks-overhead


Maybe it depends on the type of business/ customers that you have because I've had the opposite experience. For us as a security SaaS, B2B enterprise is incredibly stable and predictable. B2C has a lot more variability and payment issues compared to large orgs with dedicated procurement departments, vendor processes etc.


Searching for ALPR was also one of the popular early queries: https://github.com/jakejarvis/awesome-shodan-queries?tab=rea...

The old PIPS ALPR devices aren't online anymore but they had horrible security as well. Just sending a newline to their UDP port would cause them to send you all images as they were being collected in real-time - no authentication needed. And the images had the license plate information encoded in the JPG metadata. I did a talk about it at some point (https://imgur.com/HHcpJOr) and worked with EFF to take them offline


Shodan also has built-in detection for some of them. For example, you can search for "product:ollama" (https://www.shodan.io/search?query=product%3Aollama). Or if you have access to the tag filter then simply "tag:ai" (https://www.shodan.io/search/report?query=tag%3Aai).


Around 40,000 services on the Internet are currently including the header:

https://www.shodan.io/search/report?query=x-clacks-overhead+...

For some reason, a lot of honeypots are also using that header so I filtered those out. The number of services has slowly increased over time:

https://trends.shodan.io/search?query=x-clacks-overhead+-tag...


The result is very strange. It's saying that South Korea has the most number of websites with the header and yet I don't see ANY search result in Korean. No writeup or whatsoever. Wonder what those websites would be.


Flying by the seat of my pants, this page of information has details which we can guess at - 27,799 are South Korea, 27,690 are Korea Telecom (so close that I'll say it's a 1-to-1 match). Wikipedia tells me as of 2015, KT ran more than 140,000 Wifi hotspots.[1]

Further down the info, we see 28,587 (almost the same number as above) HTTP titles are "Gargoyle Router Management Utility" - which is an opensource variant of the OpenWRT world which patches the code to include the Clacks header.[2]

I'm going to conclude that there's a direct correlation in this data (it all being one and the same endpoint/device pattern) and that 30,000 KT Wifi hotspots across South Korea have their management UI open on the public interface and not locked to the internal network or a VPN, etc. running this Gargoyle patch.

[1] https://en.wikipedia.org/wiki/KT_Corporation

[2] https://github.com/ericpaulbishop/gargoyle/blob/master/patch...


Interesting. Thanks for the insight.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search:

HN For You