i took it as a google search, which made me laugh at how much I read before i got to the point. I enjoyed reading this post actually but there is very little meat to what actually happened.

Agreed, talking about how he discovered this API is what I would have wanted to read. He said the only opened port was 8xxx and it was a dead-end, so what port was this API running on then? How did he discover it without sniffing packets from the app? various, etc

And if the browser "404'd", that means there's actually a web server listening (different to connection refused/timed out error messages). So was it a 404 or something else but you don't understand HTTP so you just called it 404?

From the writing my impression is this is a guy flexing his "I know tech" muscles. Calling it "pwn"? Talking about his Librem phone/desktop? Well done 1337 hacker! /s

Put signature and stated use case appears to match the Elgato Key Lights API.

https://www.elgato.com/en/key-light

https://www.npmjs.com/package/elgato-light-api

Yeah, I'm wondering the same, since he refused to use the app at all, so no sniffing packets either.

Yeah, I assumed he was vague here because hacking your own device, or writing about how to hack it, might be against the law in some jurisdictions.

of lamp endpoints I presume!