Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Impending Doom of Expiring Root CAs and Legacy Clients

scotthelme.co.uk

Post reply on HN
Print view View original

121–130 of 209 posts

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#121

Post by TeMPOraL »

hanklazard wrote: post #9
geerlingguy wrote: post #3

I begrudgingly bought a 'Smart TV' just because I wanted a 4K monitor. But I use it as a dumb monitor and watch app-based content through an Apple TV. At least I'm reasonably sure the Apple TV will be updated for 5-10 years, and is a lot more disposable than a giant TV. My last TV worked great for about 12 years. No way Panasonic would've kept supporting it that long. Honestly, the thing I hate most about smart TVs,…

Someone on HN recently floated the idea of a company that would make quality, non-smart electronics and appliances that would also be easily serviceable. I wish this existed and would pay significantly more for products like this. To address your question, I think they’re all “smart” now. I ended up getting a low-end Samsung 4K a few months ago and it’s been good so far. It starts up very quickly, maybe 1-2 seconds.…

> I’m just waiting for the day when all TVs require a working internet connection and we have to start hacking their hardware and software to protect our data.

These days won't come. What will happen instead is TVs will start coming with embedded SIM cards for cellular data connection (prepaid or otherwise negotiated between TV vendors and telcos), and then we won't have any choice in the matter as consumers, short of opening the box up and snipping the antenna (and losing warranty in the process).

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#122

Post by dsl »

a1a1a1a1a1a1 wrote: post #97
hanklazard wrote: post #9

Earlier quoted context omitted.

Someone on HN recently floated the idea of a company that would make quality, non-smart electronics and appliances that would also be easily serviceable. I wish this existed and would pay significantly more for products like this. To address your question, I think they’re all “smart” now. I ended up getting a low-end Samsung 4K a few months ago and it’s been good so far. It starts up very quickly, maybe 1-2 seconds.…

I believe a lot of television manufacturers already offer the equivalent of that as "commercial TVs" or "digital signage" they are marketed toward businesses. I think they're typically more expensive because they don't collect and sell data to subsidize cost, but that might be what you're looking for. Here's an example of a Samsung digital signage TV https://www.samsung.com/us/business/products/displays/4k-uhd...

They are more expensive because they generally have higher quality components and are not made to be disposable, and commercial applications have a higher price tolerance than consumers.

Despite the common trope, "selling data" doesn't lower the price of consumer devices. You only see price-less-than-cost plays when companies are trying to buy market share (think Alexa, Google Home, early Kindle, etc).

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#124

Post by dsl »

hinkley wrote: post #107
oarsinsync wrote: post #64

Earlier quoted context omitted.

> I’m just waiting for the day when all TVs require a working internet connection We're not there yet, but we're on our way. My Philips Ambilight TV pops up a warning every few weeks to remind me that I should connect the TV to the network to benefit from all the smart apps it has bundled. Immensely frustrating.

With ethernet over HDMI being a thing, I've heard reports of TVs tunneling out through a media box without asking first.

Ethernet-over-HDMI is so poorly supported in consumer devices that in HDMI 2.1 they dropped in completely and reused the pins for eARC audio.

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#125

Post by stormdennis »

jfk13 wrote: post #80
stormdennis wrote: post #62

Earlier quoted context omitted.

I don't know to be truthful. The TV remote has loads of buttons bottom the only ones I use are on/off, source to find the HDMI and volume sometimes. I'd love just to have a dumb monitor of the same size but they're not available. A bonus then would be no need to have a tv licence.

If you're referring to a UK TV licence, it doesn't matter what kind of monitor you're using; it's about what you watch (live TV, whether over the air or online, or any use of BBC iPlayer). Watching TV via a computer and a dumb monitor still requires a licence. https://www.tvlicensing.co.uk/check-if-you-need-one (Edited to add: Conversely, merely owning a TV does not require a license; if you're only using it as a com…

Unfortunately not. Having a tv set in the house here requires a licence even the thing is out of order

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#126

Post by djrogers »

dsl wrote: post #122
a1a1a1a1a1a1 wrote: post #97

Earlier quoted context omitted.

I believe a lot of television manufacturers already offer the equivalent of that as "commercial TVs" or "digital signage" they are marketed toward businesses. I think they're typically more expensive because they don't collect and sell data to subsidize cost, but that might be what you're looking for. Here's an example of a Samsung digital signage TV https://www.samsung.com/us/business/products/displays/4k-uhd...

They are more expensive because they generally have higher quality components and are not made to be disposable, and commercial applications have a higher price tolerance than consumers. Despite the common trope, "selling data" doesn't lower the price of consumer devices. You only see price-less-than-cost plays when companies are trying to buy market share (think Alexa, Google Home, early Kindle, etc).

Umm, no - this is not just a 'common trope'. The CTO of Vizio has stated in multiple interviews that removing the data collection capabilities of their TVs would increase the prices. Direct quote:

"The greater strategy is I really don't need to make money off of the TV. I need to cover my cost."

and

"It's not just about data collection. It's about post-purchase monetization of the TV."

[1] https://www.theverge.com/2019/1/7/18172397/airplay-2-homekit...

[2]https://www.businessinsider.com/smart-tv-data-collection-adv...

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#127

Post by stragies »

hinkley wrote: post #107
oarsinsync wrote: post #64

Earlier quoted context omitted.

> I’m just waiting for the day when all TVs require a working internet connection We're not there yet, but we're on our way. My Philips Ambilight TV pops up a warning every few weeks to remind me that I should connect the TV to the network to benefit from all the smart apps it has bundled. Immensely frustrating.

With ethernet over HDMI being a thing, I've heard reports of TVs tunneling out through a media box without asking first.

That would require 2 Devices supporting Ethernet-over-HDMI, and one of needs to have routing/bridging enabled.

I have -up2now- not seen 1 device, where the combination of HW/SW was capable of offering ethernet to the Device OS.

AFAIK, no (mainstream) PC/Embedded/Mobile graphics chip/firmware/driver combination supports this. Please do indicate a counter-example, if you know of one.

I consider that unlikely to change too, since Ethernet is limited to 100Mbit over HDMI. Gigabit (Wifi) ate that lunch.

Outside of "Device-Collections" from e.g. B&O, that might use that comm-channel to have a "guaranteed communication backend" available, I see no real (commercially) interesting reason for implement it.

Having said that, I'd be very happy, if GFX-card/TV vendors started implementing the optional parts of the HDMI spec, like CEC,ARC, and Ethernet. I'd find use for it.

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#128

Post by TeMPOraL »

hinkley wrote: post #115
cameronbrown wrote: post #28

Earlier quoted context omitted.

Doubt it would work. Hardware is commoditized and low margin. That's why TVs are embedding internet advertising, to make fat stacks from their otherwise barely profitable products.

Not all hardware is commoditized. I do not understand why so many other markets have a number of luxury/craftsman brands and in computers we only have Apple. Cars have tons. Even woodworking has 2 built-to-last brands and 2 others that like to flirt with that moniker. You will have to pay though, if you want the company to stick around. If you buy something that lasts 3x as long then they get less revenue from you, a…

> I wonder what bomb-proof consumer electronics built for modification would look like.

Starfleet technology. Sleek and sturdy, but opens up when pressed the right way, and generally can be completely disassembled with ease, have pieces of it replaced, and then put back together.

It's fictional, but it shows the way.

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#129

Post by jjoonathan »

nitrogen wrote: post #111
jjoonathan wrote: post #86

Earlier quoted context omitted.

The box would have to decrypt HDCP, swizzle one codec into another, and re-encrypt. I spent about $50 on dongles and the better part of a weekend pursuing that angle to no avail. Sony didn't make the announcement ahead of time, so nobody had an FPGA module ready. Of course, a cynic would say that was the whole point. I wasn't alone in having this problem -- the support forums were overflowing with outraged threads ab…

Active adapters of the sort you might need probably start around $70 and go up depending on the ports required. To get a 4k hdmi 2.0 to dp adapter would cost like $120+ for example.

I'm sure someone eventually made one to address the market need, and $120 sounds like a fair price given the complexity. It wasn't available when I needed it, and it doesn't change the fact that Sony just up and dropped support for old displays.

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#130

Post by topkai22 »

danpalmer wrote: post #43
topkai22 wrote: post #31

Certificates suck. They are monumentally user unfriendly and complex. How many major internet properties have had outages driven by certificate renewal in the last several years? Half? I know that enterprises I work with seem to have some sort of work impacting certificate problem every month. The ecosystem needs to become a lot more robust and user friendly in general. Unfortunately, I’m just a user of certificates…

While I empathise with your viewpoint, that the ecosystem is hard to work with, I'm afraid I don't think there are any quick solutions to this. > certificate warning date If this is user-visible then for most companies this would be nearly as bad as expiry, and if it's not user visible then it's not useful. > Make it easier for people to acquire and renew certs Let's Encrypt pretty much solves this problem. The place…

I suspect we need standards/protocals defined at layers above the crypto-layer. For the certificate warning date, a yellow lock rather then giant red screens browsers show me now would be good, so at least in some cases users can do the notification. However, the real solution is standardized tooling that helps the organization detect the issue.

Let's encrypt is definitely in this vain, however I think it needs to be the point where software defaults to user friendly behaviors like auto-renewal unless explicitly told not to. This seems like it could be address in standards making process, but maybe that's the wrong venue.

Post reply on HN