Live data from Hacker News

LG to ban residential proxies from smart TV apps

krebsonsecurity.com

161–170 of 549 posts

Re: LG to ban residential proxies from smart TV apps

#161
My question is how would a user know their TV is being used like this?

Also this is the reason you down download random crap onto your devices.

I have an LG that is connected on its own network with bare minimal apps (netflix, prime, etc) because it's too convenient for my family. I actually bought it because it didn't display ads on the home screen like the other smart TVs I'd researched. Thought LG was the lesser evil, turns out they're all a bad as each other.

Re: LG to ban residential proxies from smart TV apps

#162

42% of the apps on LG's platform have these quasi-malware SDKs in them? Seems kinda bad, whether it's due to negligence or just pure incompetence? You'd think there might be legal consequences for a corporation that lets their app store turn into a malware delivery system?

They've seen the ruckus that follows from controlling / curating the app store experience. For example, see the comments at https://news.ycombinator.com/item?id=45017028

Re: LG to ban residential proxies from smart TV apps

#163

Earlier quoted context omitted.

Fine with Linux though :) LG's behavior isn't fine, but their monitors don't install crapware on Linux.

The monitors aren't installing anything. That headline was a lie. It's Windows Update that's installing LG crapware upon seeing relevant hardware IDs. That's why the problem affected older monitors too - it's the update side that suddenly started to ship malware.

> That headline was a lie.

Kinda agree but let's call it "misinformed" or something, instead of a lie.

Re: LG to ban residential proxies from smart TV apps

#164

Earlier quoted context omitted.

Wait, you're saying a monitor can just advertise a URL over the video connection for its driver and then Windows will blindly install it, without user confirmation? I thought that LG had submitted these "drivers" (adware) to Microsoft and they approved it.

I think the point is that: 1. Yes Windows must have "approved" the drivers 2. Windows Update runs automatically and not (usually) manually 3. Automatic update can't even be disabled, only manually postponed a bit At least 2 and 3 are different on virtually every Linux distro. Also, I find it very unlikely that they would accept such behavior. To give MS the benefit of the doubt here, now that this happened and has be…

https://github.com/raphire/win11debloat

This has an option to disable downloading of auxiliary apps when a device is connected. Yes, it's a Windows Update thing.

> Prevent Windows from auto-installing device companion apps, like LG Monitor App, Alienware Command Center and more.

Re: LG to ban residential proxies from smart TV apps

#165
post #59

Earlier quoted context omitted.

They might hardcode DNS. It's not certain that this will work.

This is why I’m a bit conflicted about DoH and ODoH. Firefox and Chrome have defaulted to DoH for years if I’m not mistaken (although I’m in Europe so I believe my FF still uses regular DNS instead of DoH by default). This also means that DoH effectively sends all your queries to CloudFlare on FF. Chrome is slightly smarter and tries to map your DNS provider to a DoH implementation if known.

That's why I'm not a fan of DoH or certificate pinning. Those are tools of control.

Re: LG to ban residential proxies from smart TV apps

#166

Earlier quoted context omitted.

Another win for the Linux security model (software installed and updated manually from vetted repos only).

> Another win for the Linux security model I swear, OSs have become sports teams. Linux's 'security model’ has plenty of holes. The very fact the kernel and much of its user-mode is written in C almost guarantees that its security model is worthless. The Linux ecosystem operates on trust and respect that can and has been easily abused by bad actors to provide supply-chain pwnage. There have been so many zero-click lo…

AUR is an effectively unmoderated user repo. It’s not Arch Linux’s core repository, nor is it enabled by default or indeed even possible to use without manual downloads from outside the package manager.

Re: LG to ban residential proxies from smart TV apps

#167

Earlier quoted context omitted.

Another win for the Linux security model (software installed and updated manually from vetted repos only).

> Another win for the Linux security model I swear, OSs have become sports teams. Linux's 'security model’ has plenty of holes. The very fact the kernel and much of its user-mode is written in C almost guarantees that its security model is worthless. The Linux ecosystem operates on trust and respect that can and has been easily abused by bad actors to provide supply-chain pwnage. There have been so many zero-click lo…

I think you can probably find a better example, even if less recent. The AUR is unofficial and not properly vetted in the same way as the actual Arch repos, Debian repos, etc.

Re: LG to ban residential proxies from smart TV apps

#168

Earlier quoted context omitted.

Grey market residential proxy service providers are one of the most common methods of implementing bot spam, social media manipulation and plenty of straight-out fraud. There's all kinds of things that malicious actors want to do where they value coming from an ordinary (comcast, charter, centurylink, shaw cable, whatever) residential IP.

I mean, some of us have legitimate business needs to get past cloudflares frankly somewhat bs gatekeeping business model, however

To be clear, bot spam and social media manipulation are legitimate business needs for the business selling said services.

Re: LG to ban residential proxies from smart TV apps

#170
post #37

Earlier quoted context omitted.

Yes. I bought a Samsung TV and there isn’t a way to set up Art Mode without the internet. So first you have to get a raspberry pi, install pi hole, then switch your router’s DNS. What a wild experience 2026 is. But I do feel like a wizard.

They might hardcode DNS. It's not certain that this will work.

I block known DoH servers on my lan and forward all dns requests to my dns server.
Post reply on HN