News for hackers. Stuff that matters.
Re:Jailbreaking RabbitOS: Uncovering secret logs, and GPL vi... by Aurornis on Wednesday July 17, 2024 @02:14PM (#40988715)
> If it sends data, it should sent it to the weather API,

That's not how the device works. The weather and location data are both context inputs to an LLM. The LLM produces the response and sends it to the device. The LLM runs on the server, not the device.

You can't have the device connect to a separate weather API unless you send keys to the device, which would require per-user access credentials (good luck finding a 3rd party provider happy to do that). It would also increase the number of round trips, which increases response delay, which is one of the primary complaints about the device.

Re:Jailbreaking RabbitOS: Uncovering secret logs, and GPL vi... by freedomben on Wednesday July 17, 2024 @02:58PM (#40989135)
I am far from an expert on LLMs and have never used the Rabbit, but wouldn't it be silly to have the llm produce the weather? Wouldn't that mean it must have the information in either the context window (or the training set, but that seems pretty unlikely to be current), meaning it already had to be gathered from an external source and wouldn't need to be sent to the LLM anyway?

What can/does the Rabbit add to it above what a simple string concatenation would?

Re:Jailbreaking RabbitOS: Uncovering secret logs, and GPL vi... by Aurornis on Wednesday July 17, 2024 @04:11PM (#40989880)
The point of these products is to use a natural language interface to accept freeform questions and produce intuitive and potentially complex responses.

Weather was just an example. You can't predict every combination of weather related questions that someone might want to ask and force those into predetermined response strings.

The idea is to be able to ask things like "What days this week are best for having an afternoon picnic?" and get a reasonable answer back.

If your goal is to hide as much of your personal information as possible from 3rd parties, you're not in the target audience for these products. Nothing wrong with that, it's just targeted at a different demographic of people.

Re:Jailbreaking RabbitOS: Uncovering secret logs, and GPL vi... by freedomben on Wednesday July 17, 2024 @06:07PM (#40990804)
Ah thank you, that does make sense! I appreciate the context you've been able to add (both here and elsewhere in the thread).
Re:Jailbreaking RabbitOS: Uncovering secret logs, and GPL vi... by d110af5ccf on Wednesday July 17, 2024 @05:57PM (#40990732)
> wouldn't it be silly to have the llm produce the weather?

Typically the LLM queries external tools as appropriate and then incorporates the result into the response.

Re:Jailbreaking RabbitOS: Uncovering secret logs, and GPL vi... by seanhunter on Thursday July 18, 2024 @03:03AM (#40993158)
As I understand it, you can think of Rabbit's "stack" as a prompt to a standard llm (I think they just used openAI but I could be wrong) to understand what you want, and then a bunch of (brittle) selenium scripts to go call various websites to do the thing.

The llm is there to understand that you've said "what's the weather?" not, say "call me an uber", and then to collate the responses from potentially several calls to websites and produce a natural language response.

There is a layer of upsell/hustle/scam[1] on top of that where they said they had a "large action model" which learned your preferences and understood how all these websites worked sematically so the actions would be robust etc and a bunch of other stuff which turned out not to be true.

[1] depending on your point of view. I would encourage people to watch https://www.youtube.com/watch?v=NPOHf20slZg and https://www.youtube.com/watch?v=zLvFc_24vSM and do whatever personal research and make their own minds up

Re:Jailbreaking RabbitOS: Uncovering secret logs, and GPL vi... by nicce on Wednesday July 17, 2024 @03:25PM (#40989403)
Seems like that is indeed the case. But that does not explain the need for logging.

However, in these days weather APIs are the ones you can actually query without API keys.

See, for example. https://www.weather.gov/documentation/services-web-api

There is a forecast for you:

`curl -X GET "https://api.weather.gov/gridpoints/TOP/31,80/forecast" \ -H "Accept: application/geo+json" `

All the third-party APIs for weather just try to artificially monetize them, because under the hood the information is typically governmental funded.

See, for example, https://news.ycombinator.com/item?id=40589172

Re:Jailbreaking RabbitOS: Uncovering secret logs, and GPL vi... by bsharper on Wednesday July 17, 2024 @05:29PM (#40990534)
Not specifically related to your point, but government provided weather APIs might not be a thing in the US in the future: https://www.theatlantic.com/science/archive/2024/07/noaa-pro...