101 comments

[ 0.21 ms ] story [ 7.1 ms ] thread
Wise words "Never give ANY smart device internet.".

That is just stupid to give internet access to a "smart" tv or a "smart" phone. You have zero control over it.

Except... some of us like to stream content on TVs. And some of us really don't like the idea of maintaining yet another extra piece of hardware for that.

And so your TV does need Internet access.

The same holds for many other devices, in different shapes. Sure, you can opt out of civilization completely to avoid all the side effects of late stage capitalism, but maybe it's worth applying a bit more nuanced thinking to find a balance that doesn't throw you back to the 1800s. (Unless you like the 1800s, in which case, enjoy)

> Except... some of us like to stream content on TVs.

Linux mini-PC running Bigscreen Plasma. No, it can't be used to stream Netflix at native resolution because of DRM. But if you can't live without Netflix content, you can use alternative sources and save money in the process. VacuumTube for YT instead of the official app.

Yes, this is an additional device, but it is not unlike a streaming stick or Android shitbox.

classic linux advice lol. disable the smart features on your TV and then buy a whole computer so you can ... not be able to watch netflix and youtube on your TV

disclaimer: i run a whole variety of home media stuff, so i am one of you - but it's just a funny example of exactly the kind of thing that makes people not do this stuff

I self host a lot, including jellyfin, but I've never tried to do the Linux HTPC. Whenever I look into it everything has changed from a few years ago, it all sounds difficult to get working and keep working, and I give up. I didn't know we had a whole new set of software. It was once MythTV, then XBMC, then something else I can't remember, and now I've lost track.
> I self host a lot, including jellyfin, but I've never tried to do the Linux HTPC.

I think now is the right time to revisit the Linux HTPC, mostly because Plasma 6.7 integrated the new Bigscreen interface. This is a genuine 10-foot desktop environment optimized for TV remotes and controllers. Previously, most Linux HTPCs simply used GNOME/KDE, with the scaling cranked up to 200 or 300%. In terms of apps, I suggest Kodi for local files, VacuumTube as a Youtube TV/Leanback substitute, and Steam or SteamLink for gaming, depending on hardware. With an airmouse remote you can also simply use Firefox or Chromium and stream from pretty much anywhere, subject to resolution restrictions for Netflix and some other services.

How is this different from Kodi (which was XBMC, right?)? Why do I need both?

Why would I want to futz around with a web browser on my TV? How am I going to type in my passwords?

Kodi is essentially a media player, it's not a general purpose TV UI like Plasma Bigscreen. Yes, there are a couple of distros out there like OSMC basically designed to use Kodi as the UI for everything, but in my experience they are way too limited. And you really do want a Web browser for streaming, because you are unlikely to find dedicated Linux apps for whatever streaming platform you intend to use. You could presumably run Waydroid and use Android apps, but using Bigscreen virtual keyboard or a remote with a keyboard on the back is just much easier.
That's the famous dropbox comment right there.

> 1. For a Linux user, you can already build such a system yourself quite trivially by getting an FTP account, mounting it locally with curlftpfs, and then using SVN or CVS on the mounted filesystem. > 2. It doesn't actually replace a USB drive... This does not solve the connectivity issue. > 3. It does not seem very 'viral' or income-generating."

Normal users don't care about running an extra mini-PC. If you do shoulder it, it becomes part of your attack surface as well, so it's non-trivial work.

And sure, you can find content anywhere - ordinary people won't.

If the TV only plugged into the wall for electricity and showed the video that was fed into it via one of its inputs, does that TV qualify as "yet another extra piece of hardware that needs to be maintained"? The only reason it needs "maintenance" is because it does all this extra "smart" stuff. A separate device that has the "smarts" and treats the TV as a bare monitor screen would still be only one device to "maintain".
Back when I first started my career, I generally disagreed. My first job was at a connected device startup in the IoT space. The whole ethos around data was pretty good. Maybe it was because the tech side of the company I worked for was 99% ex-gov contractors (aerospace, low level routers, submarines...).

We collected such minimal information. Basically only enough to allow for OTAs, functionality, and debugging. Thinking back, we could've collected so much more.

I remember when Alexa hit the market and we (as a company) thought there's NO WAY amazon was making any money on them.

Today... NO WAY. Along the way the value stopped being "This product is priced so we can make a profit" and became "The data we collect is more valuable than the sale".

Well, nowadays the purpose of a TV is usually to watch content over the internet, so I wouldn't call it "stupid" to connect the TV to the internet.

You might say it's naive, but is it really naive to buy a TV and expect it to be a device to display audiovisual content and not a spyware/adware machine?

I feel like it's not the user's behavior that should be put into question here, but the borderline criminal behavior of the manufacturer.

This is an exhausting read. From the diminishing use of the word “rape” to the steam of conscious delivery to the blogspam cliches of hyperbole and exclamation.

The malware installed by LG on Microsoft PCs and the spying by smart TVs are both despicable. But I couldn’t get through this article.

I find it so incredibly short sighted to implement such shenanigans. I was set to buy a LG 39GX950B as an upgrade to my current ultrawide until I read that they will automatically install an installer that will ask whether you want to install additional tools every freaking time you plug in the monitor. Absurd.
[delayed]
I disagree, clearly purchasing choices only hurt you and doesn’t help the situation.

Instead we should embrace hacker culture and take by force that which won’t be given to us. By force I mean the gentle kind of force of forcibly owning the stuff you already legally own.

There’s never been a better time, we’re in this sweet spot where we have LLM agents that can help normal people do this stuff, but not yet at the point where a significant amount of the consumer technology we use has been hardened.

Yes, okay. If I’m fatalistic then this is the best time to buy something like the monitor because I now still could flash the firmware to rip out the auto install. Presumably.

But isn’t it way better to get legislation in place to prevent this? And how can it technically even do this? Isn’t it a huge security risk if just plugging in something on USB-C can execute a binary??

Update: reread the news item on ars at the time: https://arstechnica.com/gadgets/2026/07/microsoft-responds-t...

So apparently it is a windows feature to be able to automatically install software belonging to a device fingerprint. It isn’t something the firmware or monitor is doing over USB-C but rather a function of windows that can (and should) be disabled.

Agreed.

A non-cohesive angry rant

Yeah, I didn't get this part:

> Hah! I don't have to worry about this! I got Linux! For now.. That's true. But EDID transmission still happens

EDID transmission is how monitors communicate their specs to the computer, how is that an issue?

> But what stops LG from convincing the Ubuntu maintainers to make an LG variant of their supposed driver to magically appear in your snap or apt package repository? You hope to God they don't, but the danger is always there.

So the whole argument there is that yes, it is safe, but there exists a nonzero possibility that you won't be in the future?

The author's "Artwork" page might explain a few things.
A periodic reminder that you can buy a TV that's not smart. It won't be the fancy Samsung wall-art one and it won't be the absolute shiniest display tech out there, but it will be good enough, it'll be dirt cheap, and it won't have a network port or an 802.11 radio.

[Sceptre](https://www.sceptre.com/TV/4K-UHD-TV-category1category73.htm...)'s 4K series is sold at Wal-Mart, often for under half the web-listed prices. I’ve bought a few at the 42” scale for like $180 shipped. They’re fine and they’re incapable of all the spyware bullshit.

Yep! Our family is on our second one. First was 42” and lasted five years. Current one is 55” and is going on seven years. Both were around $200-250. Picture quality is great for us. Apple TV takes care of streaming. And easy connection to our stereo gives great audio. Cheers!
Let me know when they (or anyone else) comes out with an oled model.
I did a quick search on my local electronics store's web site, and there are several options.

I don't know where you are, so I can't say what availability is like there. But it's worth doing a basic search.

What search terms did you use? I'm in the US, can't find anything with an oled panel that's not a smart tv or a computer monitor.
A bit into tinfoilhat territory but just because they don't advertise that they have an 802.11 radio doesn't mean the devices can't have one. Or an LTE/4G/5G radio.

If the user data is worth that much then I wouldn't be surprised if some manufacturers put such radios in their non-smart TVs in order to try and gather such data.

I live in a densely populated part of a large UK city and (checks `nmcli dev wifi list`) there are 14 distinct wireless networks near me that aren't mine. There's a good chance that any IOT device could find something nearby, and there's even a whole load of LoRa nodes that it could use for a very slow uplink.

I think they'd have to have some FCC boilerplate on the outside if the device had a radio?

[edit: or whatever UK FCC would be]

I'm just wondering when 5g or 6g will start getting iot devices online without consumer intervention.

search for 5g miot or 5g redcap or 5g mmtc

Problem is, smart devices are heavily subsidized in an expectation for future profit from data collection.
> Amid the overall electronics boom thanks to A.I.

What is it talking about? What boom?

(comment deleted)
Moreover, how could any past and positive "electronics boom" be attributed to "AI"?

If anything it's the opposite, as memory components become obscenely expensive.

I guess theyre talking about all the electronics being used to populate the various data centre's popping up about the place. The GPUs, RAM and what not
Interesting, I knew about these EDID devices to use to pair with KVM for a slightly better experience, but never thought about their use on this perspective!
It's not a matter of "cheap", even the high end Sony TVs have spyware on them by default. The best thing you can do is get Claude or Codex to adb into your TV and uninstall all the malware, then keep it disconnected from Wifi and use an external box like Apple TV to watch.

Just disconnecting from Wifi often doesn't work because the TV will connect to insecure wifi to upload data and fingerprint what you're watching and who you are.

  > Just disconnecting from Wifi often doesn't work because the TV will connect to insecure wifi to upload data
Is there any evidence of this actually happening? It's oft stated yet I've never seen any proof or specific models where this has been observed.

It made more sense when I first heard this theorized back in the early 2010s when smart TVs were becoming more common and unsecured WiFi hadn't vanished completely yet. Now it would be way more logical to include a cheap 5g radio, which has also been alleged but I haven't seen any model shown to include one.

IIRC a decade ago Samsung smart TV's were found doing this.
I don’t think that will help with the TV installing malware on your pc. Though to your point, Claude or codex could probably help with that too.
> crackhead@blorb.localhost

Checks out, and I mean that in the kindest way possible

Warren Buffett has often said, "In looking for people to hire, you look for three qualities: integrity, intelligence, and energy. And if you don't have the first, the other two will kill you."

The exact same logic applies to devices you buy. These companies have shown they do not have any integrity. So why would you want buy something from them that is "smart" and never sleeps?

Because our government has failed to protect us from monopolies or duopolies. How many things can you buy with modern technology that you'd say the brand had integrity?
Competition enforces integrity? I can see how it might help, but I'm afraid it's a deeper moral problem
Yea competition only enforces integrity if consumers are selecting for integrity. Without getting into a nitty grityy morality debate, you've got an obvious first issue here that many if not most people dont know what they are buying when it comes to tech, so we cant expect a market to correct for our perceived morality if the consumers havent even got a clue they're being slighted in the first place.
Integrity can be bought and compromised.

In fact it seems like many (most?) decent startup products end up rugpulls.

The solution for smart TVs is to not connect it to the Internet and attach an Apple TV. Sure they’ve gotten expensive, but how much is your privacy worth?
What makes you think Apple TV won't sell your data just like the TV manufacturer's do? Would you know if they did?
I took an old HP all in one, installed a linux distro, put kodi on it with some custom applications and now I have a smart TV that I control.
What if you want to hook a gaming PC up to a smart TV? Linux has come far in recent years, but Windows is still the most broadly supported gaming OS.

Once awareness of this side-loaded crapware gets out, I'd expect the community to come up with fixes to ensure it doesn't get loaded. In the meantime, this should blow up in the faces of MS, LG, etc. just like things blew up for Sony when they put root-kits on CD's.

This is the correct solution. It's a much nicer user experience too.
But the stuff I want to watch isn't on Apple TV. I don't need another way to pay someone for entertainment.
The article addresses that. This is about the recent controversy where plugging an LG display into a Windows machine caused unwanted software to be installed as a "driver update". Disconnecting the TV from the Internet is completely irrelevant to the article.
Wait, the solution is to attach a device that is ultimately controlled by a bunch of shareholders?
Using apples ad/malware bullshit device is somehow better than Samsungs? I don't thinks so.
what privacy? my smart TV/Android TV stick both don't have camera/mic and only thing I use them for is watching Youtube through Smarttube with dummy account signed in and to watch freely available IPTV streams you can find online, only reason I use the Android TV stick is because the TV OS was not updated at all, slow and didn't even allow to install anything with basic Android system apps removed
Apple products may be less compromised, but generally apple has one big anti-consumer hole - any app can talk to the internet unfettered.
This is a solved problem and this article completely missed the forest for the trees.

Smart TVs are to be plugged in to be updated, and that's it.

Their default state is to be permanently offline.

Hook up an Apple TV if you want apps.

The TV is offline. Read the article!
I don't actually believe the claims of this blog. A driver for a monitor from Windows update allowing mcafee antivirus and/or other programs to be installed automatically? I think more details should be shared. Also contains a long rant about EDID which I think is unwarranted.
An install of Windows 11 from MSFT-provided media on an HP desktop PC earlier this year resulted in a ton of HP driver-related crapware on the PC. Windows Update will happily download drivers and user-mode software the driver manufacturer flags as being related.

There is a Group Policy setting under Computer Configuration / Administrative Templates / System / Device Installation / "Prevent automatic download of applications associated with device metadata" that seems to curb most of it, thought I still ended up with a user mode app related to the audio driver.

Setup the TV up in "store" or "demo" mode and use it as a simple display without internet access.

Connect a mini-PC to provide any "smarts" required.

You might consider reading the article. It's not about connecting the TV to the internet
The reason this keeps happening btw is because we haven't sent anyone to jail over it. Not even when it's clearly criminal, like when Google tracked location data despite opt-out [1], or when LG did what they're doing now but forgot to bury something about it deep in the EULA [2] (we're all totally on board with click-through EULAs having such power, right?)

The 2nd story is crazy - I wonder if I hack LG and start downloading all their trade secrets, when caught, the government would just let me stop the download and face no punishment, if I say I just forgot to ask them for consent. Or maybe it's different if I do the hacking through a backdoored cable I sell them, like they hack us through backdoored TVs.

[1] https://inews.co.uk/news/technology/how-to-stop-google-from-...

[2] https://www.cbc.ca/news/science/smart-tvs-that-send-data-wit...

> Oh, there's a driver update for the LG television. Makes sense, right? It's a fairly recent television, and the drivers will help us take advantage of all of the TV's features. Of course, I'd like Microsoft to download it.

At this point I assume the author was making intentionally bad choices out of morbid curiosity. I can't imagine anyone technical thinking drivers should be required to connect to a TV via HDMI. (or maybe I'm not technical enough)

Windows does similar normal monitors. Often just a color profile, sometimes more…
A technical person might think this TV uses HDMI vendor extensions and so a driver would help.
Windows used to always give a little popup saying it was installing drivers when you plugged shit into it. Now, apparently, TVs are for some reason trojan horsing this.

There's no reason to expect a normal user to think "Yes, this port is the USB port and thus commonly needs driver updates, but that HDMI port does not ever need driver updates." Most people don't even know it's called a USB port, let alone whether it should host driver updates. Besides, I could imagine a scenario where there's some outdated HDMI decoding thing on it. Or maybe just some tech for home theater stuff I'm not aware of.

It's shocking how many comments here didn't bother to read the article. At all.

They're not talking about putting the TV online. The TV is completely offline.

They're talking about plugging the TV into a PC or laptop via HDMI or Displayport (like if you're running an HTPC), which then triggers a companion app update on the PC via Windows Update. This was a news item a few weeks ago with their monitors. They then also discuss a hardware blocker for HDMI or DP to prevent this.

Again, this has nothing to do about the TV's smart apps.

Its not entirely clear from the article--is the EDID telling Windows to install the driver without asking you, or is it prompting you to install a driver, you are agreeing, then along with the driver comes the junkware?
The EDID is just a model identifier and some capability metadata, it can't tell Windows to do anything.

It's Windows that decides that it should download a driver from Windows Update because it recognises it hasn't got a driver from that hardware, and it's Microsoft that let the vendor submit drivers that are bundled with near malwareto Windows Update.

That is how you end up with walled-garden OSes. Users plug in random device into their computer, the OS vendor tries to simplify operation by installing a device driver that was not vetted, and then users complain they are not protected.

Then the OS vendor will start limiting which devices they support and with very strict review processes.

This is a fair trade off for many. I want my OS to protect me. All things being equal, if my OS doesn’t help shitty vendors install unwanted stuff… good.

It can swing the other way, my options are limited to company’s that pay my OS provider for access.

My OS has no walled garden and also does not randomly install drivers when I plug hardware in. It comes with generic defaults, adds drivers I tell it to, and never modifies anything without me telling it to. Crazy idea.
(comment deleted)
Since you forgot to mention which OS, your comment comes across as solipsistic.
I use NixOS, but basically anything other than Windows, MacOS, iOS, and Android fits the bill.
Basically, Windows has been installing monitor drivers for a very long time automatically. Usually a single INF file. Recently, companies like LG have discovered and abused that by instead of just that single INF file, they are installing software that pushes malware like McAffee anti-virus onto your computer.

More of a Windows Update + MS partner issue than EDID.

One day someone would reverse engineer the data TV feeds back to mother ship, and makes a fake driver to feed it garbage. Or not garbage. I could see some fun and profit a crowdfunded poison data could generate
>You know what? There's really nothing good to watch on TV anyways. If Hollywood has to subsidize the television industry just to keep its base, it doesn't have any money to invest in anything new. Every channel just wants to brainwash you. So throwing the Flat Panel into the garbage might be a good idea anyways.

Definitely have to agree with the author on that. Only use for a TV for me is for playing on the Steam Machine.

I couldn't understand what this article was saying.

There's nothing nefarious about EDIDs. EDIDs are just a way of the monitor to announce its capabilities to the device so that the device and the display can agree on things like resolution, refresh rate, etc. EDIDs are just blobs of data without capability to execute logic, as far as I'm aware.

It sounds like the author is claiming that Windows does some sort of driver update in response to EDID announcements, but OP doesn't explain it at all. If that's true, that would entirely be on the Windows end not on the EDID's end. It sounds like Windows is recognizing LG as the manufacturer declared in the EDID and then downloading a driver for LG. I don't think there's any way for the EDID to declare to the OS that it wants to perform a driver update.

In a nutshell, the article is saying that because you can't guarantee OS vendors won't go down the path Microsoft has (i.e. installing unwanted software as a "driver update" when you plug the display into your computer), it's therefore better to block the EDID just in case your Linux distro vendor goes rogue too. I don't agree with that argument, personally, but that's the argument he's making.
This is indeed what is happening behind the scenes. By default Windows Update will automatically download and install support packages for pretty much any device Windows can identify through manufacturer/device IDs, which includes PCIe and USB devices but also monitors. This is most commonly used to deliver drivers but Microsoft allows these packages to silently install any user-facing application as well, presumably due to peripherals such as GPUs or audio chipsets often requiring "control panels" or similar companion apps.

Around a month ago LG took advantage of this feature by publishing a Windows "driver" for all their TVs and monitors that consisted entirely of payola bloatware, resulting in predictable backlash [1] and the obligatory subsequent HN discussion [2]. None of this has anything to do with the TVs themselves being connected to the internet or not.

[1] https://youtube.com/watch?v=Q9uefFYe6bM

[2] https://news.ycombinator.com/item?id=48956688

> automatically

This is the root problem.

The computer should not do something that the user did not specifically command. It should not guess, "Oh, the user plugged in device X. This means I have the user's consent to download and install software."

Every user wants their computer to do things they didn't specific command. You may draw the line differently from random user Bob, but your claim is simply wrong.

The *vast* majority of users do want their machine to silently do whatever it takes for their device to work.

I don't want to go handwrite XF86Config. I want my machine to go negotiate resolutions and aspect ratios and pick a default. I don't want to have to go find a CD drive or go to the OEM's website to get my printer or scanner working. Many users want their audio device to be able to talk over HDMI when plugging in a monitor with speakers. And so on.

I also had to read it twice, if i understand correctly:

If i understand correctly:

1. TV is offline

2. Plug HDMI or DisplayPort into laptop

3. Windows (Update) on laptop recommends to install LG display driver

4. The LG display driver then installs all the bloat

Me to my normie friends and family: "Never connect your TV to the internet."

Them: "But then how will I get Netflix?"

Me: "Get an Apple TV and connect that to the internet. Then connect that to your TV with an HDMI cable."

Them: "I don't need an Apple TV. I just bought a TV!"

Me: "Apple TV is not a TV. It's a little box."

Them: "Then why does Apple call it a TV?"

Me (snarky): "I told Steve Jobs not to call it a TV but he did it anyway."

Them: "This is all too confusing. Just buy the things and hook it up. Here's my credit card."

Me: "OK"

Them (one month later): "Hey our new TV is working great!"

Me: "Good!"

Them: "Except it shows us an unskippable ad whenever we turn it on, and the ad seems to know a lot about us."

Me: "Um...that shouldn't be happening."

<investigation begins>

Me: "This TV knows your wifi password!"

Them: "Oh yeah! After you left last month the TV asked us if we wanted to 'finish the setup process'. So we did what it told us and now it's happy. Aren't you proud of us for figuring that out all on our own?"

Me (to myself): choose words carefully before speaking, self

> Me (to myself): choose words carefully before speaking, self

'Your TV is evil and has tricked you. I'm sorry I was unable to protect you.'

Going to have to replace the router now
> You know what? There's really nothing good to watch on TV anyways

In Australia TV is colloquially called “the idiot box”

A foreign friend asked, “is that because there are only idiots on there, or because you turn into one if you watch too much?”

Yes.

Samba, a media intelligence company have several partnerships with manufacturers to take screenshots and collect metadata.

Who the fuck invited them into the living room? They say it's optional and opt in but I really don't believe that.

Edit: it's called ACR and a much bigger problem then I originally thought. Wow.