Oh okay, I just assumed the main method to redirect the vendor cloud connections to the local valetudo was based on the patch DNS parts in dustbuilder that seems present on most models, but if you say more is required elsewhere to block vendor cloud connections I’m sure that’s true.

In any case your work is highly appreciated! And i didn’t mean to suggest that it hasn’t taken a massive amount of work overall to make valetudo work as well as it does.

It’s just DNS based, and iirc dont require any major effort other than patching the hosts file. Of course it is possible it is not enough, but I have high confidence in the authors after also having watched various talks at I.e DEFCON, that i would be surprised if they missed the firmware doing other nasty things.

Patching DNS is specifically possible to enable/disable on the firmware build tool: I.e https://builder.dontvacuum.me/_dreame_r2416.html and the source for that is here https://github.com/dgiese/dustbuilder-script-public/blob/7afed16999711833a8ac0b3b482e935c3ef77219/modifys8image.sh#L169

Valetudo actively blocks the cloud connections. Also, only firmware versions specifically installed with Valetudo is supported (so no chance an update to the original device firmware happens, and does new things).

I think there’s a very low chance something escapes to the vendor cloud.

None the less, I personally run these on a separate VLAN without internet access.

There’s an ongoing case about duress pin use

https://www.theguardian.com/us-news/2026/jul/23/cop-city-protester-phone