YUNZII RT80 Rapid Trigger Hall Effect Magnetic Switch Gaming Keyboard,82-Key Bluetooth/2.4GHz/Wired RGB Keyboard,Tray Mount Hot Swapped Adjustable Actuation Esports(Black, Gateron White)

As of 31/03/2025 the description says: "Fully Customisable Web: No fussy drive or software downloads, the RT80 has a web for both Win and Mac, allowing for extensive customization..." This is not true. The web address provided on the manual will download and run an app called "iotdriver" which stays in the background until reboot. The app doesn't work on Linux. The app is a web server that listen on port 3814 and sits between the configuration web app and the keyboard. It is the same "QMK based" configurator other keyboard manufacturers are using and it's provided by a third party called RongYuan Tech. Even though it claims to be based on QMK, there is no source code available for download anywhere, and YUNZII is in fact mentioned in the license violations page of the official QMK documentation stating "Selling tri-mode boards based on QMK without sources, just via.json provided." The local app doesn't require privileged access to run and a *superficial* analysis doesn't reveal any malware or suspicious activity. I am however concerned by the way the app is launched: a custom url scheme (iotdriver://) is registered with the browser and it is executed from Javascript. This means that ANY website is capable of launching and communicating with the app, reading any information of the system or the keyboard it might provide, without any sort of authentication. To properly assess what is transmitted I would have to plug in the keyboard and spend some time decoding the GRPC interface they use, but this would require me to plug in the keyboard that I'm still considering returning. It is a pity because the build, the switches, and the keycaps are all of high quality, but the untruthful information provided in the description makes me doubt other specs provided.