Fine with Linux though :)
LG's behavior isn't fine, but their monitors don't install crapware on Linux.
Another win for the Linux security model (software installed and updated manually from vetted repos only).
Wait, you're saying a monitor can just advertise a URL over the video connection for its driver and then Windows will blindly install it, without user confirmation? I thought that LG had submitted these "drivers" (adware) to Microsoft and they approved it.
As far as I'm aware, the monitor does not transmit a URL. Windows is looking at the hardware's vendor and device IDs and using those to look up and download the "drivers" that LG has stated are for that device.
I think the point is that:
1. Yes Windows must have "approved" the drivers
2. Windows Update runs automatically and not (usually) manually
3. Automatic update can't even be disabled, only manually postponed a bit
At least 2 and 3 are different on virtually every Linux distro. Also, I find it very unlikely that they would accept such behavior.
To give MS the benefit of the doubt here, now that this happened and has been reported on they might decide to enforce stricter rules on manufacturers in the future. But as a Windows user you don't have a choice in case you don't like how they decide and how their decisions might change again later.
https://github.com/raphire/win11debloat
This has an option to disable downloading of auxiliary apps when a device is connected. Yes, it's a Windows Update thing.
> Prevent Windows from auto-installing device companion apps, like LG Monitor App, Alienware Command Center and more.
I believe you register your device with Microsoft so Windows can automatically obtain and install drivers for them when they are plugged in.
What LG sent in for installation is not a simple .inf or .sys/.dll file. They sent in a whole bag of software which does all the nasty things, and Microsoft doesn't vet or care about the software installed as the "driver" of the hardware.
This is actually a feature of the .inf by design, an AddSoftware directive. It can even link to apps from the store instead of bundling them with the driver. This is designed to install settings panels like the ones for GPUs.
https://learn.microsoft.com/en-us/windows-hardware/drivers/i...
I guess that from Microsoft's perspective, the driver itself wasn't suspicious, but it installs a questionable sidecar app they would have never vetted anyway.
Eh? No.
It's just a device attached to a computer.
But in a Plug-and-Play world, its addition is noticed by the operating system -- as has been normal for decades.
Microsoft's Windows operating system sees this new hardware ID and then goes forth to install whatever-the-fuck software it associates with that identification, presumably as a service to the user. (Did Microsoft approve it? Dunno. I'm just over hear eating popcorn.)
> Eh? No.
That's what I thought. It is vetted software, just like on Linux. Microsoft just doesn't care if it shows ads.
That's an excellent and terrific point. In this way, the dichotomy between Windows and Linux can be as if they're just two sides of the same "vetted" coin.
> software installed and updated manually from vetted repos only
So something most desktop Linux users don't do.
Virtually all desktop Linux users do. The biggest exception is AUR as its not vetted.
'desktop Linux' is a term used when the majority of Linux users don't support your argument.
Are you disputing that the repos are vetted or that users use them???
sudo dkpg -i FileYouDownloadedFromAnywhere.deb
Let's be real, in most cases it is:
curl -s script.random-guy.net | sh
It is such glaring security hole that there was an old submission about filling such install script with `sleep` commands and detecting it on server side, to send different versions for downloading (and reviewing) and for actual direct execution.
I use those scripts to improve the likelyhood it'll fail to do anything useful.
I even used uname as a fuzzing tool, and that broke builds spectacularly. There's now a more reasonable uname in the sandbox for builds.
the method you describe is clearly only done by people that are irresponsible and most probably stupid.
and no, this is not how most software is installed
most of my machines use unnatended-upgrades
Increasingly software is distributed by "curl dodgysite.com/get.sh|sudo bash -", no different to running "install.exe" on windows
Surely Windows Update is a vetted repo as much as arch or debian
Surely you mean Linux security model (not relevant enough to be targeted by big tech)?
Famously, the Linux kernel does not have a stable ABI for drivers. As a result, by far the majority of drivers are in-tree, maintained by the kernel folks as part of the kernel.
The Linux approach has the downside of not having the drivers if a vendor has not been working with the kernel community before launch (or for those who haven't upgraded to a kernel that has the driver, e.g. a LTS release).
On the other hand, the driver is maintained by kernel developers, not created by the hardware developer who is not getting paid after they sell the device. This helps avoid abandoned / vulnerable drivers, or having the hardware dev search for... alternative revenue streams, as in this case.
It's not a weakness that they targeted and exploited, it's a feature that was purposefully implemented by Microsoft.
If you're trying to say that Microsoft implemented a method of delivering specifically malware executables to every PC, I've got a bridge to sell to you.
Let's not diminish LG's part in all this.
> Another win for the Linux security model
I swear, OSs have become sports teams.
Linux's 'security model’ has plenty of holes. The very fact the kernel and much of its user-mode is written in C almost guarantees that its security model is worthless. The Linux ecosystem operates on trust and respect that can and has been easily abused by bad actors to provide supply-chain pwnage.
There have been so many zero-click local privilege escalation CVEs I've lost track.
Arch Linux AUR malware: https://lists.archlinux.org/archives/list/aur-general@lists....
AUR is an effectively unmoderated user repo. It’s not Arch Linux’s core repository, nor is it enabled by default or indeed even possible to use without manual downloads from outside the package manager.
There's still a security there though.
You have confidence you are actually downloading the same foo as everyone else. And if there were an issue there would be pushback. Not so if you get some random exe from warez.com
Yes it isn't perfect, it's still a lot better than windows land.
I think you can probably find a better example, even if less recent. The AUR is unofficial and not properly vetted in the same way as the actual Arch repos, Debian repos, etc.
The monitors aren't installing anything. That headline was a lie.
It's Windows Update that's installing LG crapware upon seeing relevant hardware IDs. That's why the problem affected older monitors too - it's the update side that suddenly started to ship malware.
> It's Windows Update that's installing LG crapware upon seeing relevant hardware IDs
This is also a misrepresentation. Microsoft has provided LG with a certificate to sign its driver packages with, and allows LG to upload packages to Windows Update, which includes a feature to install sidecar applications. Now, the spirit of this feature is that any application is meant to provide genuine configuration functionality or some graphical front end to the driver's configuration knobs.
LG then abused that feature to provide adware. Now, there are millions of hardware vendors. One can't expect that every driver package submission from every vendor is thoroughly vetted every time, this is a matter of trust and respect.
Sometimes one actually wants the app that comes with the device, like AMD's and NVIDIA's configuration trays.
Even so, I fully expect that after this debacle MS will disable this stuff. There is precedent for this. Synaptics/ELAN/Alps touchpad tray applications largely disappeared after MS implemented precision touchpads somewhere in 2015, and suddenly Windows touchpads became as precise as those on Macs. Likewise with RGB peripherals. Even GPU driver applications have increasingly become less useful as the most important features—power control, adaptive sync, HDR, etc have moved into native Windows settings.
> One can't expect that every driver package submission from every vendor is thoroughly vetted every time, this is a matter of trust and respect.
Maybe not, but LG has violated this trust and should therefore be either fined or severely restricted by Microsoft. Banning will likely cause more problems than solutions, but they shouldn't get away with this.
Adware was a huge problem during the Windows XP era, can't believe it's coming back now through Microsoft's official channels.
Also I doubt there's actually millions of hardware vendors. But that aside, Microsoft has a duty to vet everything that they offer through their channels. If it's too expensive for them to do, do like Apple did and have those that want to make use of their distribution network (and trust) pay them.
> One can't expect that every driver package submission from every vendor is thoroughly vetted every time
Why not? Microsoft isn't a struggling startup. They can afford to do just that.
Because at scale, that doesn't work, I think, even money no object, because it's a task that requires a lot of domain knowledge, but also is monotonous and offers little in the way of satisfaction or looking good on your resume, so the candidates you're trying to hire aren't very junior, and also are not going to like the work.
Why not? "At scale" is not an argument on its own. This is something where scale helps you because the number of different hardware you need to support is independent from the size of your customer base.
And if you really can't act responsibly "at scale" then you shouldn't be allowed that scale.
>Even so, I fully expect that after this debacle MS will disable this stuff.
Isn't the debacle over? MS know about this by now. What's stopping them from killing it today?
A late resolution is barely a resolution at all. None of this functionality needs new Windows features.
My point is not to shift the blame to Microsoft; it's primarily LG that's at fault here.
My point here is simply that it's not the monitor that is installing this. Neither the malware nor the URLs to malware exist on the device - they get fetched as part of normal OS-side auto-provisioning, which is the part that was compromised.
Yes, and it's only possible thanks but no thanks to MicroSlop.
And it's not like MS is too poor to do anything useful for their customers. They just don't want to unless the cost-benefit analysis pans out in their favor. The customer is worth as much as their wallet.
I agree with you on the precedent
> after MS implemented precision touchpads somewhere in 2015, and suddenly Windows touchpads became as precise as those on Macs.
There’s still a world of difference between a MacBook touchpad and a windows one. My work laptop (18 month old dell XPS) can’t hold a candle to my 6 year old MacBook’s trackpad.
> Likewise with RGB peripherals. Even GPU driver applications have increasingly become less useful as the most important features—power control, adaptive sync, HDR, etc have moved into native Windows settings.
The peripherals still need the addons though; I have ASUS armory crate, Corsair iCue and MSI center for my Motherboard, cooler and GPU respectively. They all suck.
> There’s still a world of difference between a MacBook touchpad and a windows one. My work laptop (18 month old dell XPS) can’t hold a candle to my 6 year old MacBook’s trackpad.
The latest Dell trackpads are quite bad. Price or the product being premium or not unfortunately does not tell you if it will have a good trackpad or not. And it changes over time (Dell XPS used to have really good trackpads)
Basically you have to go to a store and try or find reviews that actually pay attention to this.
> There’s still a world of difference between a MacBook touchpad and a windows one
Oddly I've found otherwise (Dell Precision notebook from 2021, and Surface Laptop). It might be macOS's animations and smoothing interfering here, but I've found that my Windows touchpads are much more responsive, especially when swiping between desktops.
> The peripherals still need the addons though
Ugh, this is annoying. Hardware vendors need to be banned from writing lousy, inefficient, unsafe software.
On the trackpads - I only ever use my MacBook as a single screen device, so the experience may be different. A long time ago I used it with an external monitor and the experience was very poor compared to windows.
> Ugh, this is annoying. Hardware vendors need to be banned from writing lousy, inefficient, unsafe software.
Yeah, I commented on the McAfee LG thread but the stuff that comes bundled with hardware is embarassing. I don’t know how Razer, Logitech, nvidia, MSI, asus, etc get away with it. The stuff is awful, even their “good” software. I work in games and a few years ago the biggest correlation we had between unexplained crashes/performance problems in the wild was users having MSI Afterburner installed. Users thought it did great things and fixed a bunch of games but it absolutely thrashed everything we worked very hard to do and caused no end of issues doing so.
> Yeah, I commented on the McAfee LG thread but the stuff that comes bundled with hardware is embarassing. I don’t know how Razer, Logitech, nvidia, MSI, asus, etc get away with it. The stuff is awful, even their “good” software.
Well, this is the whole market on its own. It's entrepreneurship. No different than every web SaaS startup trying to capture some entry-level piece of computer use and then constrain it so it interoperates only with their "net of trusted partners".
They get away with it because everyone is happy and making money - the users, notably, are not part of the group here, and have no voice. The users are resources to be exploited. Same as on the web, and on most markets these days.
What part of Afterburner caused issues? I have it installed to undervolt an old GPU but not actively running.
I can only imagine the meetings at microsoft HQ where they all sat around a table and crossed their fingers and hoped that vendors would act in the spirit of their design.
If they aren't willing to vet, they should at least be keeping the update minimal. Ie no 'sidecar' apps.
Self signing a driver should mean just that, not a driver, and a load of other things we feel like foisting on the user.
Half the reason I moved to Linux is because I just wanted to print something without getting a load of advertising from a printer company.
The commercial software landscape more and more reminds me of a civil war torn town. Everyone shooting at everyone, a dark forest through and through
It’s more a tragedy of the commons, we are the commons.
> One can't expect that every driver package submission from every vendor is thoroughly vetted every time, this is a matter of trust and respect.
If you're going to allow 3rd parties to install software on potentially billions of computers with far reaching privileges then you better have something in place other than 'just trust me bro'.
> One can't expect that every driver package submission from every vendor is thoroughly vetted every time, this is a matter of trust and respect.
Apple seem to do a pretty decent job of just that
The situation is very different on Macs. Apple control almost the entire hardware stack of the machines that macOS runs on. They make it an absolute pain in the neck to run any application not blessed by attestation. This attestation server is also frequently offline. They've also made it very difficult to write things like filesystem drivers, having completely pulled that functionality from more recent versions of macOS. In fact, if I recall correctly one cannot ship a third-party kext on more recent Macs, especially ARM ones. As such, hackintoshing has basically vanished as a hobby.
At least on Windows, the most you get is a scare screen saying 'this app is from an unidentified developer'. I know what I'd rather have.
> At least on Windows, the most you get is a scare screen
Well that and side-loaded LG adware
> That headline was a lie.
Kinda agree but let's call it "misinformed" or something, instead of a lie.
I would say it's neither a lie nor misinformed. It 's a punchier headline that can be justified by what the user experiences. The user connects a monitor which causes ads to appear. The rest of this Rube Goldberg contraption is a mere detail.
Those details are the only thing that matter. Without them, all you have is superstition.
I disagree. It matters that LG makes ads appear on their customers' screens as a deterministic consequence of connecting one of their monitors. It's not superstition.
Of course the details are important on some level. But that doesn't make everything else not matter and it doesn't turn an incomplete explanation into a lie.
The headline isn't a lie, even if you can technically nitpick it.
The manufacturer implemented choices to deliberately install the software when the monitors are connected. The mechanism is not important to why this is outrageous.
yet?
I guess with more and more consumer devices running Linux based OSes (SteamOS, Android, Bazzite, Silverblue, ..) that becomes more and more interesting.
And unfortunately the "I'm safe on my non-windows-system" argument doesn't count for long, as the 99% muggle crowd justifies a shift to a world where our non-certified (=> 'insecure') systems are not supported by big companies anymore, as it's currently happening on Android.
The LG scandal specifically relies on the fact windows will auto install OEM crapware as soon as you plug it in. No other OS does that.
Huh? What does WebOS have to do with windows?
"Fortunately", agent Poettering is on the case, implementing remote attestation for Linux so we can all be secure. Barf.
Never once had a problem with an LG because I've never given it internet access. A trustworthy set top box handles everything instead. Concerned that might not be an option in the future.
That is my problem. What can you trust anymore? Is there an appliance out there that can do the basics and not be a malware gateway?
Smart TVs replaced dumb TVs not out of consumer demand, but out of subsidy from commercial databrokers and streaming services. Despite adding $100 of hardware they were priced $100 cheaper.
> Smart TVs replaced dumb TVs not out of consumer demand […]
The consumer demand was/is for cheaper, and data mining is how OEMs got there. The general public got what they want, and OEMs got to keep their margins: "win-win".
It's the same thing with (US?) airlines: people wanted cheaper, and that's what was offered and they chose.
Is there still any specific brand known for dumb tv's that features the quality and 'non smart' options of the smart variants?
I'm always wondering how hard it would be to just remove the hardware for spying. Just keep enough hardware to make it a dumb panel, remove the webos logic boards, wifi antenna, etc.
Consumers will happily sell their data for a $100 discount. Hell they'll waste 20 minutes watching adverts to save $1.
You could give it a vpn to a public cloud provider so that even if they run residential proxies they still get a dirty vps IP.
Admittedly this doesn't stop the presumed screenshotting and microphone use and worse
LG now installs adware when you merely connect one of their monitors to a Windows PC.
I'm mostly very happy with my LG C4 as a home theatre centerpiece, and I did have it online so that I could use the apps for YouTube and Jellyfin. However, the lack of support for modern 4k rips (HEVC+DTS) ended up being a dealbreaker and I finally ditched the built in software for a fire stick instead.
No transcoding, no weird codec issues, just the raw files direct streamed from the underpowered Unraid box, into the back of the AVR where the audio is handled correctly and the video is sent to the screen.
There is always android VLC app to decode anything, you just need enough power in chipset to handle that. Not perfect, had some quirks unseen on desktop VLC but generally fine.
But yeah external stick is much safer solution, then even tvs like TLC are a great brand.
I had a TCL TV unrelated to the programming language, and the ghosting was awful.
Want to stream Netflix? Disney+? Hulu?
You need to hook something up to a network, and another device would have similar risks.
Setting up a sandboxed VPC or auditing traffic is beyond the means of the average TV owner.
> Want to stream Netflix? Disney+? Hulu?
No thanks, I prefer owning my media in a way that corporations can't just take it away whenever they feel like and where I can use (open source) players of my choosing.
Apple TV is the usual recommendation.
>You need to hook something up to a network, and another device would have similar risks.
Another device might not give the free reign for all shitty malware like they do. Apple TV for one wouldn't.
> and another device would have similar risks
Do you think an Apple TV and a Walmart special TV have same risks? I don't. I give the Apple device my network credentials and the TV never sees them.
You have 3 replies all saying the same thing, install a ATV...
But the replies are missing the point that most people aren't techies and won't go do this. They go to big box store, buy the tv, ask if it has netflix, done.
They won't (and shouldn't need to) install a ATV.
Press the button to turn off the power strip when you're not watching it.
The other solution for those who have a flat white wall (or are willing to install a projection screen) and which I used for years and years: use a dumb projector. There are plenty of perfectly fine dumb projectors and they're very cheap too (compared to the equivalent TV). This also made for the largest diagonal I ever had, in a huge living room, which was really great: basically turning the living room into a mini home theater. I painted the walls etc. accordingly, including a special paint for the white projection wall and black for the side and back walls. This was a better experience than any $$$ TV.
Sadly atm I can't use my projector for my wall ain't flat and I can't install a projection screen and I've got nowhere to put my projector: I could use a short-throw one but the place ain't mine and I'm not allowed to drill holes etc.
So atm it's... Pressing the button on the power strip that powers the LG TV. I know, I know: doesn't help much when the TV is on.
Next thing to do is separate all the junk devices (TV, smartphones [the ultimate spying device btw, much more than your TV], smartwatches, tables, etc.) from your proper stuff (e.g. your important PC running Linux/FreeBSD/etc.). I use different physical LANs (and a bridge/router) but VLANs would do too.
Many cheap home routers also by default offer at least a "guest" network: a perfect place the TV and your relatives' devices when they visit and want access. Set usage quota on the guest network too.
At some point all these devices shall use other networks than yours, so you'll be sorry out of luck anyway. But as long as they don't come with their own battery, pressing the button on the power-strip is some kind of giant low-cost "hack this" middle finger.
My LG DualUp monitors (with no internet access) recently triggered some LG Adware Bullshit to install on my Windows laptop. So I'd say stop using LG anything (or Windows anything since they're voluntarily in on the scam too lol). If you want the 2560x2880, maybe buy the knock-off INNOCN vertical monitors.
https://old.reddit.com/r/pcmasterrace/comments/1v1pkbs/lg_sp... ← examples of others who ran into the same shit
I would probably have a DualUp by now if I could find one available anywhere: it's a very appealing form factor. I looked at the INNOCN site, but only see normal-looking monitors there; do you have a model name or any pointers I could search for?
The problem I have is....it just works. I'm tired of having to manage 50 different devices to let my son watch some Gabbys Dollhouse on the TV. Our LG CX is now 6 years old and it just works. I only need one remote for all the apps and sound, and I don't need to worry about another device. I've tried both Apple TV and Amazon Fire Stick, and both were (subjectively) worse experiences than just using the apps built into the TV. So.....in the interest of making my life feel less like an IT admin of my own house....I think I'll just use the built in apps and keep my TV connected to the internet.