42% of the apps on LG's platform have these quasi-malware SDKs in them? Seems kinda bad, whether it's due to negligence or just pure incompetence? You'd think there might be legal consequences for a corporation that lets their app store turn into a malware delivery system?
It's not "quasi-malware," it is malware.
> <i>You'd think there might be legal consequences</i><p>I own an airgapped LG TV. Does anyone actually want to go class action/mass arb?
LG's own code is quasi-malware
They've seen the ruckus that follows from controlling / curating the app store experience. For example, see the comments at <a href="https://news.ycombinator.com/item?id=45017028">https://news.ycombinator.com/item?id=45017028</a>
I can imagine someone choosing "no ads" without realizing they just agreed to let strangers route traffic through their home IP indefinitely
I am afraid that my dumb TV, which I've been holding onto for many years, might be on its last leg.<p>I remember seeing privacy guides for smart TVs over the years, does anyone know a place with up to date info?<p>Most 55inch monitors are now "smart" sadly, so are most "digital signage" products. So there is no longer a way to get a true dumb panel at least over 50 inch<p>EDIT I am in Australia, there might be products that are available elsewhere but cannot be bought/shipped here
If you don't ever give your network credentials to the Smart TV you've closed off 99% of the attack surface.
From previous discussions there are apparently TVs which will connect to any open network nearby, if it can find one.<p>I got myself a normal, non-smart Philips 49" TV some ten years ago, it's good, but I don't expect to be able to find something similar anymore.
You can easily turn dumb mode on any smart TV.
I share your disappointment. I just want a screen with a tuner. If I want any “apps”, I’ll pair it with another device which will probably be an Apple TV.<p>I’m starting to wonder if a monitor and a soundbar with an external tuner is possible.
Stop hooking up your LG tv to any network
Stop hooking up your LG: <a href="https://www.theverge.com/tech/967983/lg-monitors-mcafee-adware-gamers-nexus" rel="nofollow">https://www.theverge.com/tech/967983/lg-monitors-mcafee-adwa...</a>
Want to stream Netflix? Disney+? Hulu?<p>You need to hook <i>something</i> up to a network, and another device would have similar risks.<p>Setting up a sandboxed VPC or auditing traffic is beyond the means of the average TV owner.
><i>You need to hook something up to a network, and another device would have similar risks.</i><p>Another device might not give the free reign for all shitty malware like they do. Apple TV for one wouldn't.
Apple TV is the usual recommendation.
> and another device would have similar risks<p>Do you think an Apple TV and a Walmart special TV have same risks? I don't. I give the Apple device my network credentials and the TV never sees them.
Never once had a problem with an LG because I've never given it internet access. A trustworthy set top box handles everything instead. Concerned that might not be an option in the future.
That is my problem. What can you trust anymore? Is there an appliance out there that can do the basics and not be a malware gateway?
LG now installs adware when you merely connect one of their monitors to a Windows PC.
13 years ago: <a href="https://news.ycombinator.com/item?id=6759426">https://news.ycombinator.com/item?id=6759426</a>
I'm mostly very happy with my LG C4 as a home theatre centerpiece, and I did have it online so that I could use the apps for YouTube and Jellyfin. However, the lack of support for modern 4k rips (HEVC+DTS) ended up being a dealbreaker and I finally ditched the built in software for a fire stick instead.<p>No transcoding, no weird codec issues, just the raw files direct streamed from the underpowered Unraid box, into the back of the AVR where the audio is handled correctly and the video is sent to the screen.
Stop buying LG
My LG DualUp monitors (with no internet access) recently triggered some LG Adware Bullshit to install on my Windows laptop. So I'd say stop using LG anything (or Windows anything since they're voluntarily in on the scam too lol). If you want the 2560x2880, maybe buy the knock-off INNOCN vertical monitors.<p><a href="https://old.reddit.com/r/pcmasterrace/comments/1v1pkbs/lg_spyware_screens/" rel="nofollow">https://old.reddit.com/r/pcmasterrace/comments/1v1pkbs/lg_sp...</a> ← examples of others who ran into the same shit
Stop buying LG TVs.
Unfortunately they make arguably the best OLEDs and webOS is pretty decent to use (especially compared to the terrible OS that Samsung and Sony run). I think the best thing people can do is update their firmware then disconnect it from the internet. Using an AppleTV or similar provides a better experience than any TVs built in apps anyway.
I don’t ever use their “smart” functionality (that’s what my Apple TV is for) but I’ve never had any issues with the Google TV (Android) build that Sony ships. It doesn’t nag me about being kept offline, is reasonably fast, and doesn’t even show its home screen unless I specifically summon it, so it checks my boxes.
How important is "the best" OLED vs the second best or 100th best OLED? I am personally ok not buying the bleeding edge to not get malware onto my OS.
If you care about home cinema it's important. There's a pretty big jump down. You can look up the specs and reviews of the C and G series from LG. Anecdotally quite a few times when people see my 7 year old LG C9 I've had them ask if it was some new expensive TV as they are so impressed with the picture.
reasonably important, if you're never connecting your lg tv to any network, and just connecting it to an AppleTV or something and letting HDMI-CEC control it so you never even see their OS.
Exactly this. And with an Apple TV 4K Ethernet, you've got a bonus Thread border router for smart home devices. I actually didn't even realize that initially, but was very pleased when I found IKEAs latest round of Matter over Thread devices paired nicely with it and my existing Home Assistant + Hue setup.
I would suggest a mini-PC running Linux and Plasma Bigscreen instead of an AppleTV if you want something 100% private and user-controlled.
Unless you're using streaming services like Netflix, in which case you're stuck with 720p because of widevine.
Do you recommend any specific distro for this?
If you care about malware you do not plug it into the internet. I think windows computers are pretty mallwareish as well or at least spyware. People who buy Oled buy them because they care about PQ.
2nd best, not. 100th, better to get a great LCD than a junk OLED?
Exactly. If you get the best today it'll be the second best tomorrow anyway. Absolute position is undetectable, you can only perceive change. Use that to your advantage and stay off the treadmill.
[dead]
I haven’t looked recently but last I checked Samsung made the best panels. Has that changed recently?
Samsung scored highest on <a href="https://www.rtings.com/" rel="nofollow">https://www.rtings.com/</a> for my criteria, and I'm happy with the purchase. I didn't connect it to the network, of course. (I had to stop my handyman from connecting it and he seemed to think I was crazy for insisting.)
I installed a Pihole and set an edge router to direct any port 53 traffic that wasn’t from the Pihole, to the Pihole.<p>That made a Samsung behave a little better. But giving it no network access is better.
"I work in software. I have seen things you people wouldn't believe. Attack ships on fire off the shoulder of Orion. I watched C-beams glitter in the dark near the Tannhäuser Gate..."
[dead]
Samsung is good, except:<p>- No Dolby Vision support, only HDR10+
- Issues with judder/micro stutter
- History of nerfing TVs via OTA updates
- HDMI ports randomly failing
- Bad HDMI-CEC implementation
- Selling completely different panel generations under the exact same model names.
Their panels are often over-saturated with that fake HDR like look, similar to their phones.
Most screens come with "showroom settings" out of the box. You need to configure them to something more neutral once and then it's fine.
I'm aware of that setting, but this is the Samsung baseline. The panels they export for OEMs / other manufacturers don't seem to have the same hyper saturation. Even just standing next to someone using a Samsung phone or tablet you can often spot it straight away we know you what to look for.
Even phones have screen settings these days (much less detailed than monitors). On my Motorola phone w/ OLED screen, I turned off "vibrant colors" or something like that. Maybe the people you saw didn't bother or liked it. Maybe there is something that can't be turned off, who knows. I only have semi-regular experience with an older (and non OLED) Samsung tablet which seems fine.
Over saturated HDR is a good default in times when all TV shows only use various shades of pitch black.
That goes away if you set them in filmaker mode.
No, qd-oled is still best, LG is closing the gap with tandem oled but is still the second best panel tech.
Have to agree, WebOS is much better than Android TV OS, with ads on the dashboard.
As long as you keep it off the internet. Otherwise it’s absolute loaded with adverts everywhere.
Not the 2020 version I have, it has a suggested shows row from the apps I have already installed, which makes sense.<p>Android TV even has ads for Disney and Apple, which I never installed.
You can replace the Android TV launcher with an alternative like Projectivy [1] to get rid of whatever nonsense the stock launcher tries to push. Add Flicky [2] to address F-Droid and you've got a nuisance-free Android TV.<p>[1] <a href="https://github.com/spocky/miproja1" rel="nofollow">https://github.com/spocky/miproja1</a><p>[2] <a href="https://github.com/mlm-games/flicky" rel="nofollow">https://github.com/mlm-games/flicky</a>
Aren't they the only TVs that can be jailbroken?
And buy what? Smasnug? Sony? They're all uniquely shit.
What happens to the copies already installed?<p>Spur says these SDKs can keep running after the app is closed and only stop when the user deletes the app or opts out. LG says developers must remove them or have their apps suspended, but the article doesn’t say whether that disables existing installs. If it doesn’t, LG needs to tell affected users which apps to remove.<p>Does webOS have any way to kill an installed app remotely?
My question is how would a user know their TV is being used like this?<p>Also this is the reason you down download random crap onto your devices.<p>I have an LG that is connected on its own network with bare minimal apps (netflix, prime, etc) because it's too convenient for my family. I actually bought it because it didn't display ads on the home screen like the other smart TVs I'd researched. Thought LG was the lesser evil, turns out they're all a bad as each other.
Only reason LG doesn't have adverts is by forcing it to use a pihole, but even that needs updating -- recently they've managed to push things through and I need to do another investigation to see what needs blocking. Trouble is I only see them when I'm not in the mood to be working, and then forget about them
If other non-Android-based TV manufacturers follow, this will have a much bigger impact on the spread (and cost) of scraping than either Anubis or Cloudflare.
is this some kind of tactical distraction from the other LG headlines this week?<p>I thought residential proxies are already banned from SmartTV apps by virtue of practically every APK under the sun being subject to the Google Play terms of service.
> I thought residential proxies are already banned from SmartTV apps by virtue of practically every APK under the sun being subject to the Google Play terms of service.<p>The platforms in question here are webOS and Tizen, neither of which are Android or use the Google Play Store.
That only applies to the subset of TVs that use Google TV/Android TV.<p>Not so much for the rest of them that have operating systems with names like Roku TV OS, Tizen, WebOS, and Fire TV OS. They do their own things.
LG webOS is not Android though, it's from the old Palm/HP devices of the early 2010s. And I'm pretty sure there are still tons of play store apps with these proxy SDKs in them, advertised/consented or not.
My TV doesn't know my router's wi-fi password.
My TV thinks it's January 1st 1970.
And so it thinks it is fairly new, then, and doesn't require any tubes replaced. Should that change, it will let you know.
My TV isn't even connected to power
Every time anything asks for a DOB or anything like that, I enter the earliest date their system allows. Been doing it for decades.<p>I guess that might make me more trackable?
I've said it before on HN a long time ago but I'll repeat myself, I have about a thousand times more confidence that Sony and/or Microsoft will keep their PS5 and Xbox operating systems secure and not crapped up with stuff like this, than I do that random TV manufacturers will not result in a cybersecurity or privacy disaster.<p>Yeah, the PS and Xbox OSes show you ads, and they have telemetry. But both companies also have an <i>extremely</i> important core functional need of keeping them secure, because possible fuckery with the OS could result in game piracy/DRM bypasses and a direct threat to their revenue models.
The gaming consoles aren't subsidized via the data collection like smart TVs are via content recognition (selling everything on your screen to advertisers).<p>Consoles are sometimes sold at a loss, but the revenue model is different. Playstation plus/game pass, a cut of game sales and microtransactions, exclusives, and accessories.<p>No one should ever connect their TV to the internet. There just isn't any reason to, get access to your streaming apps another way.
Hope you don't have any open WiFi networks nearby. IMO it's better to put it on one of your networks and isolate it from the internet and other devices.
Yes. I bought a Samsung TV and there isn’t a way to set up Art Mode without the internet. So first you have to get a raspberry pi, install pi hole, then switch your router’s DNS.<p>What a wild experience 2026 is. But I do feel like a wizard.
You don't need an actual physical raspberry pi to temporarily run pihole on your LAN, you can, for instance, install a barebones debian VM inside any common hypervisor on your laptop like virtualbox or qemu, then install pihole on that basic debian x86-64 system.
They might hardcode DNS. It's not certain that this will work.
This is why I’m a bit conflicted about DoH and ODoH. Firefox and Chrome have defaulted to DoH for years if I’m not mistaken (although I’m in Europe so I believe my FF still uses regular DNS instead of DoH by default).<p>This also means that DoH effectively sends all your queries to CloudFlare on FF. Chrome is slightly smarter and tries to map your DNS provider to a DoH implementation if known.
That's why I'm not a fan of DoH or certificate pinning. Those are tools of control.
I have my router set with iptables rules to block/redirect all port 53 and you can also add known DoH to a blocklist to try and force LAN devices to use your router DNS.
I block known DoH servers on my lan and forward all dns requests to my dns server.
You can intercept normal DNS with iptables rules.<p>The best way to deal with a TV you don't trust is what no one wants to hear.<p>Open up the back and disconnect the wifi antenna. It is easy to open them up and everything is pretty simple and obvious once you do.
> So first you have to get a raspberry pi, install pi hole, then switch your router’s DNS.<p>This does not provide any meaningful protection against data exfiltration. The TV is very possibly using public DNS or outright phoning home through stable IPs.
If it connects to another network, it's somebody else's problem. Unless of course, it has a built in webcam or microphone.
It does, at least for any media played through the device. Read up on automatic content recognition.<p><a href="https://www.howtogeek.com/its-not-just-streaming-content-your-smart-tv-collects-data-on-everything/" rel="nofollow">https://www.howtogeek.com/its-not-just-streaming-content-you...</a>
I haven't seen any open WiFi networks around me in years. I don't think it's a thing anymore; it's definitely not something a TV company can rely on.
I have an open guest network with a captive portal, and not once have I seen my LG TV try to connect to it.
Pretty sure they can get internet through the HDMI cord from Roku or similar device
Source? HDMI includes Ethernet in the spec, but I've never heard of any devices actually implementing it.
That would require the Roku to specifically be set up to act as a router. You can't just connect to a random device that's not specifically a router/AP and use its internet connection.<p>Since Roku like other smart TV companies makes money off of user data captur, it's not incentivized to enable those conditions for a downstream device, especially if not specifically advertised as a feature.
<i>If</i> this was a feature they wanted to provide, it would simplest to set the Roku up as a bridge. No dhcp, no nat, just a virtual switch. Roku devices run on Linux, if their HDMI chip supports Ethernet and that's plumbed to a Linux supported MAC (probably not), it might take an hour to build and test the feature. Longer if the wifi interface doesn't like being bridged (I've seen that on some openwrt devices).<p>There's esp-idf examples from espressif for doing bridging on an esp32 if you have one with a MAC and a PHY and/or spi mac+phy.<p>Or for wired ethernet, they could include a three port switch IC.
This again? Yes, it’s in the spec. No, no one has been shown to have actually implemented it. No streaming box is going to allow random devices to use their connection.
E-Arc uses the wires intended for Ethernet. Hook your Roku up to an earc port if you're seriously concerned about it.
does a roku provide a dhcp server, issue a dhcp lease, do NAT and routing to things that are plugged into it over the 100M ethernet built into a current gen HDMI link?
This is the best approach
> researchers found that more than 42 percent of games and other apps available for download on LG’s webOS store allow unknown third-parties to route their Internet traffic through a user’s TV.<p>Eh, so even sources as reliable as Krebs on Security sometimes engage in bad statistics.<p>This is a statistic that feels significant, but actually tells you nothing. For all we know, "42% of all apps" can mean a single spray-and-pray campaign with a few hundred downloads in total, with the vast majority of users only downloading apps from the top10, which are all unaffected. Or maybe the problem is widespread across the entire distribution of app downloads, with the majority of users having at least one infected app. We don't know either way, because "42% of apps" is a completely meaningless statistic.
Apparently all these vendors did nothing to prevent this, a nice article from spur intelligence<p><a href="https://www.cbsnews.com/newyork/video/how-smart-tvs-may-be-sharing-your-data/" rel="nofollow">https://www.cbsnews.com/newyork/video/how-smart-tvs-may-be-s...</a>
It's absolutely crazy that they were accepted in the first place
I'm very worried with all this bullshit around TVs.<p>I've been running the same Samsung UE40C6530 since 2010. It's 16 f'ng years and the thing works flawlessly like the first day. No other electronic device in my life worked so well, during so long.<p>But I'm about to move to a new home, and it feels like it's about time to get something more modern, at least a 4k TV.<p>But I'm honestly totally lost at what to buy. I do not want a "Smart" tv that's slow to start, bloated with crap, installing updates every day, and maybe even spying on me.<p>I want a plain, old, normal TV. If possible without Android or any advanced operating system. Just a TV. I'll plug external content myself, either via a Chromecast device, or something similar. I don't want my TV to be a full fledged computer.<p>Is there such a thing? What would you buy nowadays? It seems you're forced to get yet another computer to maintain and be worried about whatever you buy.
The new Chromecasts and Apple TVs are really pretty good. I connect my LG TV to the wifi every few months to run updates, then disconnect it after. I control my TV through the Chromecast remote, so I never see any LG dashboards/apps.
If you hook an Apple TV (or similar) up to any 4k TV, and turn CEC on (to let the Apple TV control it), and never set it up otherwise, it becomes a dumb monitor.
I've heard you are not forced to connect to wifi, and on most of them you can connect make it default certain HDMI input. Latency to turn on/off might be less good than the 2010 one, but other than that this might be a very good way to do it.
You buy a commercial panel used for advertising/signage that's 3x the price of the "Smart" consumer panels.
My Sony tv has never connected to my network and it works great. I use an external device as the source.
If you’re fine with “okay” picture quality, try a Sceptre. You can get them on Amazon. I’ve had good success with them. I heard you can still disable some smart features on Sony TVs.
[dead]
Heh. <i>tinfoil hat on</i> I always suspected that the AI gods would manifest themselves through TV. Hat stays on from this point on. It is not like LG suddenly found it in their heart to stop the money flow from the offending apps. Not when combined with recent security incident at frontier labs and current admin freaking out over open models.
Honestly I have nothing but anger for all parties involved here. We need to treat any appliance as hostile. Vote for people that will stop this stuff. Don't buy it. This is digital assault and should be treated as such.<p>If any of the HN crowd reading this are tech reviewers, make privacy and security a first class feature of the things you review. If it has a network connection then ask hard questions of the manufacturer about how they are managing that massive responsibility and what promises they have about how they will, and won't, use it. Ask what qualifies a 'trusted partner' and get a list of them so you can dig into them and report on how much those partners can or can't be trusted.<p>I really don't care how bright the screen is if this type of stuff happens. I'd rather watch nothing.
Is there a (technical) difference between a residential proxy and bot network node?
Residential proxies operated by "legitimate" providers can only open TCP connections, which more or less rules out DDoS attacks, which seem to be the most common use of botnets. (And all tcp connections typically have to go through the proxy providers datacenter first to get through NAT, which effectively limits the total amount of traffic/connections you can make)
As they are both distributed systems there will be some inherit underlying similarities, but a botnet has things like antidebug, stealth, privilege escalation, etc. They typically include attack payloads or spying features like taking screenshots, keyloggers and stealing account information. Additionally they may include further ways of spreading to other computers such as messaging people on Discord or using other vulnerabilities. They might also try and take exclusive control of the device by patching security vulnerabilities and uninstalling other malware. Well unless they sell dropper capabilities letting other people deploy malware to the machine.
A figleaf of "We gave ourselves permission on page 247, paragraph 3 of your user agreement"
So does this mean that using a proxy will cause all of the "smart" features to stop working? Win-win.
Thanks for the heads up, LG.<p>Those cheap/discount tv brands make soo much sense these days
This is the best news I've heard all week. Finally good news for once!
LG is on my blacklist. That means I won't buy LG products and in my job actively fight against buying products from them. And they put themselves onto that lost with their behavior.
The messed up thing is that we need to rely on LG to stop allowing it rather than just making it illegal.
Stop buying "smart" TV
One day there will be a decent TV that can be relatively easily hacked to run on open source firmware. My wife and I are moving soon, and I'm happy we've decided not to have a TV in the new place. Neither of our current LG TV's have ever been connected to the network, but it will feel good when I sell or give the cursed things away.
lg's had a good run of being a monitor, their software was a bit shit but the hardware supported e-arc etc.<p>i've got 2 expensive lg tvs and i bought them because you don't need to use their remote, it just turns on and shows the picture.
None of my TVs are connected to the Internet. That said, I could really do with a better open source fullscreen UI, especially since I mainly just want a web browser that works good. I'm just using KDE Plasma with a custom daemon to control the TV power state over an HDMI CEC adapter plus an old K830 keyboard.<p>I'm, frankly, a bit annoyed by this whole thing; I'd rather have USB adapter RF wireless because it is simpler to deal with vs Bluetooth, but actually I can't even find other Bluetooth keyboards that are as compelling as this K830 and worse yet, they don't even make the K830 anymore. I don't really mind KDE Plasma with just some minor customizations but I don't really like any of the options like Kodi. Maybe Plasma BigScreen will eventually be what I want for that. And finally, HDMI CEC is a pain in the ass. For reasons, I actually use an adapter to get CEC support on a normal PC platform, because most PC HDMI ports can't do it. And also, it's just a bizarre and overly complicated thing. I have it working reliably, but it took some time to iron out all the kinks, particularly because my TV responds quite differently depending on how recently it was powered off.<p>I really just want a big monitor and to basically just use DPMS... Like a computer does, but large computer monitors tend to be expensive and don't always have remote controls, which admittedly are handy.
>“The risk is amplified when consent comes from individuals within the household who use the device but shouldn’t give consent, such as minors.”<p>Note that the same applies for the other privacy invasive webos features. But since that doesn't harm big tech's monopoly they will conveniently avoid mentioning it.
This is madness.<p>Only LG themselves should be able to have this kind of invasive control over your television.
I mean, why didn't they do that from the start?
[dead]
[dead]
Sharing a slice of your internet in a privacy preserving way in exchange for something of value, seems fair, no?
Grey market residential proxy service providers are one of the most common methods of implementing bot spam, social media manipulation and plenty of straight-out fraud.<p>There's all kinds of things that malicious actors want to do where they value coming from an ordinary (comcast, charter, centurylink, shaw cable, whatever) residential IP.
You make a good point. I've reassessed and agree this is shady, and not a good pattern. And should be disabled/abolished.
I mean, some of us have legitimate business needs to get past cloudflares frankly somewhat bs gatekeeping business model, however
Sure, I do as well, I have my own VPN into my home office that lets me run traffic outbound through its default gateway while I'm somewhere else. But letting random third parties I don't know run traffic through my house is another thing entirely.
To be clear, bot spam and social media manipulation are legitimate business needs for the business selling said services.
Just because others abuse privacy doesn't mean that we should remove privacy from everyone else. They also let you get around geoblocking.
Only if the app provides 1. prominently-displayed, informed consent, 2. an option to opt-out without losing app functionality, or 3. joining the botnet provides some kind of actual benefit to the user, besides just money to the developer.
Add to that list respecting the TOS of the user's ISP so that the user does not get banned, and providing some sort of remuneration if illicit activity through the proxy causes problems for the primary user, and then _maybe_ you could call this all not shady as fuck.
Apparently at least one of the apps mentioned does that. From the article<p>>A Pac-Man smart TV app from Bright Data offers users the choice between viewing ads in the game or agreeing to allow their TV to serve as a residential proxy node.
No need of (2) and (3) - the user can choose to not install/use the app. (1) is the right fair boundary.
Some residential proxy providers offer a few cents for the use of your network.
No.<p>I'm surprised Comcast or some other ISP doesn't step in with a claim of tortious interference. Reselling or granting access to the ISPs services like this is almost always against the ISPs terms of service.<p>The consumer is in no place to consent to this exchange.
[dead]
Tell your relatives, buy an apple tv