One exploit, one memorable name, and a wiki you can follow: how hackalice got 888 stars in two weeks

Yandex Station Extended is a Russian open-source wiki on how to root Yandex's smart speakers and what you can do once you have root. The exploit wasn't found by its author, and he didn't write most of the tools. He got two things right: three days after the exploit went public, he was the first to organize every model and every method into a site that accepts PRs, and he gave it a name people could remember: hackalice. Below: how it grew, what you can take from it, and why copying this one now is already too late.

A person who swapped Alice for Claude

2026 年 10 月 27 日晚上,Habr 上出了一篇教程,标题是《我怎么把 Claude 住进 Yandex Station Mini》,到 11-06 有约 1 万次阅读(Habr 页面计数)。作者手上有一台 Mini 3:「好硬件,4 核、麦克风、喇叭、一圈灯——全被锁在 Alice 里。」他拿到 root,删掉 Yandex 的整套软件,换上自己的语音链路:喊一声「Клод」(Claude),音箱本地识别语音,把问题发给 Claude API,再用 ElevenLabs 念出答案。他说代码大部分是 Claude Code 写的,「大 Claude 在给小 Claude 盖房子」。

The last two lines of the article read: "Almost forgot, special thanks to the Yandex Station Extended community on Telegram, @hackalice" and "Don't forget the site hackalice.me."

The same day, Habr's weekly news roundup also mentioned that guides for every model are collected in the open-source wiki Yandex Station Extended. The repo went from 10-26 with 50 stars to 513, climbing from 10-27 to 247,10-28.

What it is

The repo itself is just a front door. The first paragraph of the README reads: "Yandex Station is just plain Linux inside. Here's everything the community knows: how to get root without disassembly, how to keep that access, and how to turn off updates." The main content lives on the site hackalice.me, built with MkDocs. 11-06 covers 17 models and 17 recipes:

• Which root method works for each model (DNS method, changing the CA from factory mode, USB with ADB, Android apps), all in one table;
• SSH and blocking OTA, so an update doesn't remove your access again;
• Package managers, USB peripherals, AirPlay, Spotify Connect, custom alert sounds and lights;
• Replacing Alice with your own LLM (Home Assistant, self-hosted backends, ChatGPT Voice);
• Each model's chip, flash partition layout, and firmware architecture.

The author, Марк Писаренко (Marker284 on GitHub), works as a sysadmin and smart-home engineer in Almaty. This is his only repo on GitHub, and before it he had 20 followers.

Why these two weeks

It started with a vulnerability. In June 2025, the signing for India's CA eMudhra was compromised: the private key was built on very weak values. In Oct 2026 20, someone named bitracker demonstrated that the Yandex Station Mini 2 still trusted eMudhra's certificate chain. By redirecting DNS to a fake server and pushing a config with ADB enabled, they got root without opening the device.

The next few days moved fast:

Demand spiked for three reasons. First, the install base: Yandex holds roughly 90% of Russia's smart speaker market (CNews citing М.Видео, 2026 Q1). Second, the forced patch itself was emotional: CNews's headline said Yandex had immediately shut the possibility down, and many people realized for the first time that they couldn't control the speaker they'd bought. Third, the window never fully closed: a factory reset could return to flashable firmware, so "what model is mine, which method should I use, and how do I block updates after flashing?" became a question people kept asking. Add large language models: many wanted to swap Alice for ChatGPT, DeepSeek, or Claude, and TikTok was full of "vibe-coded a web panel" videos that made it look doable for ordinary people.

How the stars grew

(Daily GitHub star counts; 11-06 is the day's count from the GitHub API, with 121 forks on top.)

It never made GitHub Trending. Its traffic came from a handful of Russian-language sources:

• Media: the SecurityLab feature (the site later showed referrals with utm_source=Securitylab.ru) and two Habr articles. CNews's 10-22 coverage came before the repo existed and didn't mention it, but it did create the search demand.
• TikTok: #hackalice has become a tag, and the top videos reached 1,500 to 377k views. One video wrote "рут права на лайт 2, breaking channel: @hackalice" directly in the clip, sending viewers to Telegram.
• Telegram: the channel @hackalice has 1,802 subscribers. SecurityLab says the whole community exceeds 9,000 people (likely several groups combined; which groups exactly is unverified).
• Forums: the "crack the Yandex speaker" thread on 4pda opens by pointing people to hackalice.me, and a Pikabu comment says "search hackalice.me."
• The README asks for a star: "⭐ Useful? Star it, that keeps the project going." At traffic peaks, that line is the final step that turns visitors into stars.

The fork rate is about 13.6% (121 / 888). Typical projects don't reach that number, which suggests people are actually following the guides.

How it differs from the dozens of other repos

After 10-21, dozens of repos on the same topic appeared on GitHub. Most are much smaller:

The runner-up has less than an eighth of its traction. Most of these repos are "one person, one device, one tool." This one has no technology of its own that others lack. The difference is the format: a domain, navigation, content organized by "which model you own," an "edit on GitHub" link on every page, and a contributors credits page. When a journalist, forum, or TikToker needs to give readers one link, this is the only one that can answer "I have model X, what do I do?"

It then turned rivals into upstream sources. pulsar 10-30 was folded in as a recipe, and the authors of single-purpose repos like krevetkqqq and derangedabbot came in with PRs to merge their work. By 11-06, the repo had 58 contributors, 287 commits, and 70 merged PRs, 142 of the commits by the maintainer himself, 8 of which were from a claude account (inference: he is using Claude Code to keep up with content). The more others merge into it, the more firmly it holds its position as the single entry point.

What you can take from this

This is a playbook that transfers, and it has nothing to do with speakers: when a closed platform with many devices gets a jailbreak, a vulnerability, or a policy change, build the one definitive entry point within 72 hours.

1. Claim the name first. The domain, the Telegram channel, and the TikTok hashtag all use one word that is easy to say and easy to share. hackalice works ten times better than "Yandex Station Extended," and that's what got uploaded to TikTok.
2. A docs site plus GitHub. The body lives on MkDocs or Docusaurus; the README is just the storefront and the place to ask for stars.
3. Organize by what the reader owns, not by the technology. The first table is "your model → which method."
4. Turn contributions into a pipeline: every page is editable, contributors get credit, and PRs are merged the same day. Scattered single-purpose authors will send their work in on their own.
5. The risk disclaimer is spelled out clearly (it says "all content is only for your own device"), so reporters dare to link it.

If it were you

C. The playbook is worth learning, but this one can't be copied. The entry point for the Yandex speaker is already taken. A second wiki of the same kind would just become an upstream source for this one. And the whole project rests on a single vulnerability: if Yandex closes it in factory firmware or on the server side, the interest will fade with it.

Who it suits: developers who watch a closed-device community, such as a particular router, e-reader, car head unit, handheld console, or domestic smart speaker. You already hang out in that community's Telegram groups, forums, or QQ groups, so when an event breaks you can start working the same day.

Who it doesn't suit: anyone who wants to build yet another Yandex Station wiki now, or to translate one into English. Almost nobody in the English-speaking world uses this speaker, and nobody on X is talking about hackalice.

How to do it: pick one or two device communities you know well, and keep a model list, firmware versions, and known methods in a private doc. When an event happens (a jailbreak goes public, a forced update rolls out, a service shuts down or its rules change), build the repo and put up a domain within 24 hours. Within 48 hours, lay out every model and method you have in one table, and add a one-line star request to the README.

How to get users: go where the event is already being discussed: forum threads in that community, Telegram groups, and under short-video hashtags. Give journalists and tutorial writers a link they can cite, thank the authors of the single-purpose repos, and ask them to submit PRs to merge their work in.

When to act: within 72 hours of the event going public. You will be only a day or two behind the first single-purpose repos, and you win by being the first to cover "every model." A week later, the entry point belongs to someone else.

Signs you've misread it: (1) In the month after Yandex closes the factory firmware hole, hackalice's daily new stars drop to single digits and never recover, which would mean projects like this have a shorter life than they look and the reputation they build is limited. (2) When the next device community has an event, the traffic goes to the vendor's own notice page or a Telegram channel rather than a GitHub wiki, which would mean the "wiki plus GitHub" format only happened to work this time.

---

Data and sources: GitHub API (repos, contributors, commits, PRs, 11-06) and daily star counts (10-26 to 11-06); Habr, "Как я поселил Claude в Яндекс Станцию Мини" (10-27) and its weekly news roundup; Yandex's vulnerability write-up on Habr; SecurityLab (10-30); CNews (10-22); videos under the TikTok #hackalice hashtag (checked 11-06); Telegram @hackalice; public posts on 4pda and Pikabu. Anything marked "inference" or "not verified" is an inference or unverified.