Oh let's be charitable! A parameter measured in ms is mistakenly thought be measured in s. Hilarity ensues.

Real world example: þe Windows registry DWORD time periods seems to invite 10^-3s granularity for totally inappropriate timescales. Perhaps its considered a "best practice" by the dick heads that decide to do these things, who knows? Why bother considering how a sysadmin might actually want to use the knobs and dials and what is an appropriate value for a parameter.

I could probably find a better example but this is recent: Smoothwall has an agent (IDEX) that you install on a Windows domain controller and one of its functions can be to harvest DHCP data and pass it onto the firewall so that it can track sessions. The upload period is a registry DWORD value.

I fixed a "problem" by stopping IDEX trying to upload data a thousand times per second. I will also point out that switching on this functionality and the periodicity setting is only applied by editing the registry - there is no GUI for this. The dReal world example -ocs are clear that you should initially set 1000 as the period.

For me that sort of thing comes under the heading of "you are holding it wrong", potential victim shaming and rubbish engineering.

> Since scanning doesn't cost us anything, better do it a thousand times a second!

This works only up to a point. Now it is costing them something.

"you mean one tick is a microsecond?"

> It was working as designed and they didn't want to check less frequently, despite there being no logical reason to do this.

We had a similar thing, the other team wouldn't back down.

We ended up implementing a kind of rate limiting internally.

If the previous request (from that IP) was more than 4.5 seconds ago we let the check request through as normal.

If the previous request (from that IP) was more recent than that we just returned a cached "there is no update" payload that had a TTL of 60 seconds.

We told them this and left it up to them, they soon changed their polling frequency.

The scanning is malicious.

The frequency etc. leading to 1TB is probably ignorance, but that doesn't matter as it is consequence of malicious scanning either way.

It's malicious either way. Question is whether 1TB was intended operation. I don't think it was.

I’m not defending the spying.

The traffic volume just sounds like a bug to me.

Any amount above $0 is too much, for a coffee maker.

Of course, that's the whole point.

Grandpa gets his money back. The company? Well, it has to spend money talking to a lawyer, because even though a lawyer can't attend small-claims court, they still consult.

They also have to send an employee to small-claims court, just have to deal with it. In the end it costs the company thousands of dollars maybe even over ten grand. It costs you a hundred bucks and you get your money back. That sort of asymmetry is beautiful, and if everybody availed themselves in small claims court, it would be far better than any class action lawsuit.

> I could see its use - you could remotely activate them

What is the point of activating a washing machine remotely if you aren't there to put your laundry inside? What is the point of activating your coffee machine remotely if you are not here to drink it? Even when you have to fill water in the machine and grind coffee beans, and wait for the machine to preheat the water.it takes less than 3 minutes to prepare an espresso.

Of course you can set up firewalls and VLANs to have the best of both worlds. You can remotely interact with an IoT device like this to set them off or check the status, but the device itself can't see anything else on the local network.

I have all of my IoT devices on separate Wifi network(s) and VLANs and almost all of them are isolated so they can't talk to each other, plus I occasionally look at how much data they are sending/receiving from the Internet (some is expected obviously, and it differs by device).

Doing this requires a considerable amount of admin work and IT knowledge though. It also requires something a step above most consumer grade or supplier provided networking equipment.

I've never spotted anything egregious like the coffee maker in the OP but if I did I'd be making sure other people knew about it and the device itself is either firewalled off properly or replaced by a brand that isn't a security risk.

Belief and stakeholder buy-in is all that it takes for that data to be collected, no?

Honda had enough customers that they still made millions selling that data. One company only gave them $25,920 for a bunch of it, but why should that matter when it was data they would have collected anyway, can still use themselves, and they're still able to sell it over and over and over again. It doesn't really cost Honda anything to do it so it's basically all profit for them. It tells us how little Honda values our privacy, not the value of that data to Honda.