> but the setup process gets blocked when you need your actual device to sync

Not entirely, it's obvious that it's just pinging some endpoint for a protocol buffer. The server will return a protocol buffer with a "continue" message, but you can just spoof that.

Also: who will get the first glass xss bounty?