Nearly Half of LG Smart TV Apps Contain Residential Proxy SDKs

95 pointsposted 2 hours ago
by microcode

50 Comments

lbotos

4 minutes ago

I'll get on my high horse and say you can get solid "DID/Commercial" TVs for not that much more: https://www.bhphotovideo.com/c/product/1788343-REG/samsung_q...

I got this a few months ago -- 4k, solid brightness, and ok color.

Is it the OMG BEST? no. But I Disabled wifi, and even the channel display.

I use it with an apple TV with CEC on the TV -- I turn on the apple tv, TV turns on straight to apple interface. I turn off from the apple remote, TV turns off.

It's effectively "an apple TV" -- I'm happy.

gruez

2 minutes ago

>Is it the OMG BEST? no. But I Disabled wifi, and even the channel display.

Why not just get a (presumably subsidized) smart TV instead, and skipping the premium? It'd also be not disconnected from the internet, and despite vague HN/reddit speculation that TVs have cell modems in them, that has yet to be confirmed.

rustcleaner

5 minutes ago

Never ever connect your "Smart"-TV to your network, or if you have an incurable impulse to then make sure it's on a firewalled gateway-less VLAN. Take the money you save buying the thing (compared to what a profitable "dumb" version would cost) and buy a surplus corporate mini-workstation system, and slap LibreELEC/Kodi or whatever on it, and use that device as your "smart" device. No good for you can ever come from bringing the TV onto the internet... ever!

(Also: never paypig, never subscribe!)

andai

an hour ago

I've always have a deep, instinctive revulsion for smart TVs, but every year I read of some new mandmade horrors beyond comprehension, and it escalates by a few more points.

thewebguyd

9 minutes ago

Same, but for "smart" anything in the home that requires an internet connection and does not let me set it up or run it LAN only.

People forget the reasons TVs got cheaper is because smart TVs are heavily subsidized with ads and your watch data.

I have the most "low tech" home of any of my peers, intentionally.

cube2222

an hour ago

I think it’s worth emphasizing that based on the article, those are third party apps, not first party LG apps.

Based on the headline I thought it’s the built-in apps.

mycall

an hour ago

This does raise the question if other Smart TVs with the same third party apps have the same issue.

HDBaseT

19 minutes ago

The LG WebOS Store is a different beast.

Just browsing the list of apps raises eyebrows for even the most non-tech audiences. 99% of it is spam, with maybe 1% being well known apps like YouTube.

The rest are weird IPTV Players, Wallpaper apps. It feels like a portal into 2009 apps, but its not.

OkGoDoIt

an hour ago

In the article they mentioned that Amazon and Roku block apps from using these SDK’s, and specifically after Roku recently made a change to disallow this kind of thing, many of the affected apps were withdrawn from the Roku app store. The implication is that those other smart TVs don’t have the same third-party apps because these apps were specifically created to act as a foothold for these residential proxy networks.

MoonWalk

10 minutes ago

Vizio was caught taking screen grabs and sending them to a server a few years ago.

tadfisher

4 minutes ago

Basically all smart TVs do that. It is how they provide "contextual" features based on the content you're watching, like the names of the actors visible on screen.

gruez

an hour ago

This turned out to be more ethical than I thought. I'd thought there wasn't any consent at all, or the actual mention of proxying was buried in a 20 page EULA.

OkGoDoIt

42 minutes ago

Yeah, this does seem somewhat reasonable. I get that most users will probably accept it without thinking twice, but if you’re going to do something like this, this is at least a fairly upfront and consenting way of doing it. For the TV platforms where this isn’t allowed, you have to wonder if apps are still doing it but just completely secretly, and trying to hide their tracks as well.

LastTrain

29 minutes ago

I think the person you were responding to was being sarcastic.

stavros

11 minutes ago

I didn't read it that way. "Please allow us to use your IP to download data" is way more consenty than I thought these apps would get.

dupontcyborg

3 minutes ago

this is a way smaller deal than acr. i personally don’t connect my smart tv to my network and use an apple tv instead

TurdF3rguson

30 minutes ago

It's not Smart TV apps specifically, it's all free apps. They have to monetize those somehow, don't they? And you get upset when you see ads, don't you?

Basically it's either this or pay for your apps.

recursive

29 minutes ago

Not sure if this is ironic, but I know it's possible for apps to exist without being monetized. I'm using Paint.net right now.

owebmaster

8 minutes ago

Yes it's possible for the apps to exist but not the apps programmers if they can't make money to eat

zerobees

24 minutes ago

> Basically it's either this or pay for your apps.

And then paid apps show you ads and monetize anyway.

bigfishrunning

28 minutes ago

I pay for apps whenever possible, in some cases it just isn't. Also, you have to trust that paid apps aren't also doing this shit.

201984

an hour ago

This needs to be illegal.

gruez

44 minutes ago

Why? The only thing that's vaguely objectionable is the fact the consent screen's wording of "download public web data from the internet" omits important information on what's actually happening and the associated risks. Otherwise I'm not sure how you can come up with a principled justification of the ban beyond just "AI scrapers bad" or "hiding identity". Tor relays and VPNs are basically doing the same thing, except with clearer disclosure about what actually goes on.

bigfishrunning

25 minutes ago

This is why I don't run a tor endpoint; possibly objectionable traffic I don't control sourced from my network. All it takes is one horrible request to come from your IP and you're on a list

ff317

21 minutes ago

From the content hosting side (getting reamed by scrapers overloading infrastructure), the problem is that we have to be able to set "reasonable" ratelimits to share finite network uplink and server cpu resources between all of our real users and these scrapers.

When you can identify the nature of the traffic (quickly in realtime, based on simple deterministic rules), you can protect the resources: you can rate/concurrency -limit the AI scrapers in the name of saving resources for the real humans, effectively putting the scrapers in a lower priority band (which is how it generally worked for search engine scrapers before!).

The problem is they're using resiproxies to disperse and whitewash their traffic, making it extremely difficult to tell their requests apart from the legitimate human requests. They're basically lying to us about the origin, and thus denying us the ability to put them in a lower priority band than humans.

They may scrape us at, say, 25K reqs/second, but it's coming from 50K random residential eyeball IPs at an average rate of only 0.5 reqs/second/IP, and then they're intentionally lying with the UA and headers and other fingerprint details as best they can to "blend in" with the humans so that we can't differentiate.

Let's do an analogy: Imagine if there was a neighborhood grocery store you and all your neighbors rely on for food. It's cheap because they keep their margins low, and more importantly the next store down the road is like 50 miles further away. That store 50 miles down the road also charges double the price. Now they've decided to play arbitrage: they load up 100 employees in the back of an air conditioned semi, clothe them to look like local shoppers, park it 3 blocks from your neighborhood store hidden inside a fenced property, and have them all go in and buy out all the inventory in the store over the course of a couple hours. The store just looks like it's having a great sales day at first. All these customers waiting in line, each getting just a few things at a time. But two hours later, the store shelves are empty, the semi is loaded up, and they're headed 50 miles back to double the price and sell it to someone else. You go in to buy some veggies to cook dinner and there's nothing to buy.

We've been playing this game with AI scrapers and resiproxies for way too long, and someone needs to hold them accountable for their fraud.

gruez

6 minutes ago

All the arguments you made applies to VPNs or tor as well. I'm sure rightsholders would be very happy if VPNs are banned, because that gets rid of one avenue for pirating with impunity. Same goes with every ad network ever, which has to fight click fraud.

pocksuppet

29 minutes ago

What would be illegal about it?

lukax

an hour ago

Well, that's how data for training LLMs is scraped.

brikym

a few seconds ago

And price comparison sites big companies don't like since they want to price discriminate. There are positives to it.

captn3m0

34 minutes ago

Has anyone reversed their SDKs to run a swarm that captures enough traffic to see what requests are actually getting made?

pocksuppet

29 minutes ago

It'll be HTTPS but you might be able to know the website, if it proxies DNS or doesn't use ESNI.

ortusdux

29 minutes ago

Maybe Valve will make a TV next

wmf

4 minutes ago

Palmer Luckey said he might make a ModRetro TV.

pocksuppet

30 minutes ago

Good. Fuck Cloudflare and other internet gatekeepers. Confuse their signal as much as possible.

cj

an hour ago

I imagine most smart TVs don't support multitasking or apps staying alive in the background, hopefully?

microcode

an hour ago

The consent screens say that they "may continue running in the background after you close the app".

doublerabbit

38 minutes ago

Walked past a TV and it was advertising a security guard.

Why does a TV need security software?

wmf

a minute ago

Windows needs antivirus so why wouldn't a TV? Unfortunately there's a lot of placebo software out there.

dewey

36 minutes ago

Because most people (HN is not a representative sample set) are not willing to pay the real price of a TV if it wouldn't be subsidized by adtech.

bigfishrunning

25 minutes ago

It's been a very long time since they were given an option.

knollimar

an hour ago

This feels straight out of Silicon Valley (show)

bigfishrunning

24 minutes ago

It also feels straight out of Silicon Valley (place)

refulgentis

an hour ago

12 minute article.

70% AI.

The only content not flagged?

Copy and pasted PR comments.

Invisible Unicode characters, triads, unnecessary markdown.

Good work, obviated by bloviating. Readers dropping off near-instantly.

A company leaving a slop trail behind its wake.

AI DDOSing should be shameful.

https://www.folklore.org/Saving_Lives.html

Retr0id

5 minutes ago

The page has scroll hijacking, too.

jonhohle

an hour ago

It’s exhausting. It’s like every article is written by the same author and that author is also your coworker and personal assistant and also moonlights as Brian, a waiter at Chotchkie’s.