This is 100% also Microsoft fault and they are to be held accountable for this. With many drivers it can happen that one manufacturer goes rogue, but Microsoft needs to have a zero tolerance policy for this: do it once and your signature is permanently revoked for all your drivers
LG is on my permanent vendor shitlist for related reasons.
As much as I’d like a bigger TV with OLED, I’ll be sticking with my old Toshiba dumb TV. It’s good enough and doesn’t even know the internet exists.
This is because as soon as a monitor is connected to a Windows computer, it automatically installs both the LG Monitor App Installer and McAfee Scam Detector without ever asking the user for permission.
Is this not a felony under U.S. law? Computer hacking has HUGE criminal liability.
Name something you do as a corporation to avoid any laws or accountability with the current administration
BRIBE THE DOJ
let’s see if that answer’s on the board…survey says…!
DING
It’s actually windows doing it
Another win for Linux
The more I learn about windows the more I wish I would’ve ditched it a long time ago instead of last month…
No, no no. That’s only if you do it. If a huge corporation does it, see, that’s different. Corporations are “people” for the purposes of free speech (with money) or even voting (example), but when it comes time to throw somebody in jail for overtly criminal behavior, all of the sudden the legal system can’t find anyone to target.
It probably says somewhere in the ToS, which is still a fucking disgrace that those exists, without having to make clear and obvious bullet points you click “consent”.
Even having to make consent multiple times should be mandatory for every shit they try to do.
Solution if users shouldnt hit consent multiple times? Dont do shady shit.
Just a reminder that terms of service or any other contract never override law
I can’t remember the specifics right now, but in Gamers Nexus video from yesterday, according to LG ToS you must disclose something regarding spying and wiretapping laws to your family and anyone visiting your house
Literally insane that you can even put that in an agreement to being with.
I have a plan: we pass a law that any contract intended for the public (ToS, various other terms and conditions, privacy policies, etc) must be at the average reading level of the American public. We’ll either incentivize better education or better contracts. Maybe both!
Doesnt matter if it’s in kindergarten level reading, as long as it’s a few paragraphs long, people will accept it.
Or standardize agreements that can be agreed to with just clicks so you can tell what’s up from just seeing which agreement modules are included and what parameters they have (along with a bunch of sites that explain them in easier terms for the less literate, which will be useful because they are standards used by many agreements rather than needing a unique one for each version of each document).
Apparently it’s windows doing it. Not the monitor via the HDMI or something. I guess that’s what you get for using windows.
Yep. Windows installs manufacturer “helper” apps automatically like drivers. Got a Logitech mouse? You probably have a Logitech app in there you never asked for too because you plugged it in.
Stop using windows.
I had to go and find the Logitech app and install it myself. Otherwise it just used the minimal drivers that were built into windows.
Maybe wired mice and those without rainbow barf behave differently.
I’ve got a corsair rainbow barfer and I also had to install its control program manually. Mileage probably varies by manufacturer, most likely.
Soon-to-be-illegal-tooltip: openRGB is a thing.
OOOH! Can we manually add entries for unwanted software to windows defender?
I don’t use windows
I think that was more of a PSA for other people reading along.
Stop using Windows.
lol jk. I’m glad that we here all ditched Windows. amirite or amirite?..
Than this won’t affect you
Also, implied consent is not consent, and if there is no consent, the entire contract is unenforceable and therefore void.
Let me guess, proprietary drivers cause this and the open source or generic drivers lack “functionality”.
If it turns on, reaches its peek resolution and refresh rate that is good enough for me, I genuinely can care less for HDR or the nitty gritty features.
Monitors don’t need drivers. Your GPU needs drivers, and you might need color correction for your monitor.
Microslop decided that any device that is plugged in might need drivers. They allow device manufacturers to specify an arbitrary program to be downloaded and executed by Windows Update, any time a device they make is plugged in.
And if that driver/software does evil or is so poorly written it meets driver verification but exposes vulnerabilities, how is that Microsoft’s fault
Microsoft is the company that approved the software to automatically download and run as admin when a specific device is plugged in. The OEM submitted malware and Microsoft approved it. Both are at fault for letting malware download and run on your device.
In the case of vulnerabilities, MS is fully aware of this happening frequently and has announced they want to do something about it, but hasn’t actually done anything about it.
Old monitors need it for absolutely nothing, like my 2020 LG. Every feature works out of the box, because it has to over display cables.
I think at most it adds an ICC profile, but it’s not matched to the panel anyway and you can just install that seperately.
Ironic
I wish we would stop using smart to describe surveillance technology. Smart sounds nicez but there’s nothing smart about it…
That is the neat thing about language, it adapts. Euphemisms wear off and something like “smart device” increasingly sounds like “nasty anti-consumer surveillance home appliance” all by itself.
you need popular public sentiment for that. most people just shrug it off if even that
Straight to the list of things “I will never buy in my life”.
Yeah, Same here honestly
For the PC Monitor issue: To prevent this sort of behavior. Open Group Policy Editor Computer Configuration>Administrative Templates>System>Device Installation Prevent automatic downloads of applications associated with device metadata = Set to Enable.
To get rid of it once installed you have to remove it from the Windows Store since it’s an app, not an installed program. For me, this was not possible as there was no way presented to uninstall it in the app store. I had to do it from terminal with this command, which could vary a bit depending on the exact app version:
Remove-AppxPackage LGElectronics.LGMonitorApp_1.2606.1601.0_x86__cfnzzhwkr8z5w
You can search for it by the appx name and then use a pipe to remove the package. Then you don’t need to worry about specific version numbers:
Get-AppxPackage -Name ‘LGElectronics.LGMonitorApp’ | Remove-AppxPackage
Keep in mind this will disable plug-and-play for other devices one plugs in.
Which is excellent, from a security standpoint, but something to be cognizant of.
Tried going through this with my grandma on video call. She asked: “why is there a police group in my computer?”
store apps can also be uninstalled from the settings app.
for the first setting, it’s easier to turn that and more off with o&o shutup10
store apps can also be uninstalled from the settings app.
Also using winget.
How can a monitor install stuff on a PC? Can you do that over hdmi/dp? Does it require usb?
Either way, this stuff should be illegal or at least require a much more explicit warning than hiding it in terms of service that nobody reads. And of course everybody would do well to avoid LG out of principle from now on.
Saw the video by Gamers Nexus and basically Windows auto installs an LG Driver utility that has ads.
Razer mice have some crapware that auto-installs on Windows now, through windows update. Their official driver that it downloads adds the crap and Microsoft just lets it do it all.
No such hassles on Linux though.
Windows update, by default, is set to automatically download and install the malware for them when the HDMI cable is connected to the computer, within less than a minute.
It’s pretty much impossible to buy a dumb TV nowadays. It’s much easier to disconnect a smart TV from the internet using a firewall.
Or don’t add it to your network
Jellyfin app works really well on LG TVs. I think it’s the app that gives me the least issues of all the ones I’ve used. I find it much easier to use than pluging in a laptop. In other scenario external computer may be the best option.
Not impossible, several options are still out there if you actually search for “non smart TV” on retailers’ websites.
Sceptre was one brand that made decent non-smart TVs but they seem to be vanishing off the market now. Many used ones still on ebay and other secondhand markets. Their website still shows a bunch of TV models but the retail links turn up empty.
I searched and didn’t find anything in Europe. And that was couple of years ago already. Maybe there are some sources I don’t know about but I didn’t find any in typical stores.
Does anyone make dumb TVs anymore? Seems like there’s a sizable market for it. I haven’t had a TV in 6 years and want one for local channels, but I really don’t want a smart TV.
I just never gave my smart TV network info. It’s at the factory settings and can’t connect to anything. If there isn’t a console connected to it then it is useless. Just like the good ole days.
They still have ways to connect, though they’re lower bandwidth and less reliable.
How?
You didn’t connect your Samsung smart TV, but your neighbor did, and they connect over a second separate Samsung™©® network that you and your neighbor both ‘consented’ to in the Eula’s, where media fingerprints and timestamps are exchanged updated, etc during downtime. Evil mesh networks, basically.
Or Sony™, or rjfyjdokfdrlvdgjg™, or whatever.
That’s really interesting and very plausible. I’d never considered it.
Documented. Forget where.
I wish Lemmy had a ban list and post/thread removal list. It’d make it easier to know what’s allowed here.
just get a smart one and never connect it online
ok how can I watch anything then?
Plug your own devices in with HDMI.
assuming you have a coax cable connection on it, mount an antenna, go to settings and find a channel scanner to run
They still access and provide a route through your wifi.
What? How would they do that if they are never connected to WiFi in the first place?
They still talk and connect if you want them to or not. The “permissions” is mostly for the apps to talk back and forth. It is still usable by anyone who knows how.
Smart TVs do not magically connect to your WiFi without credentials.
Now if there is an open WiFi available, that might be a way or if the TV has a deal with a carrier to use all that open automatic WiFi.
A bit more technical details please. How do the connect to what? It sounds a bit like they can just magically connect via telepathy to their home base if you phrase it like that.
It sounds a bit like they can just magically connect via telepathy to their home base if you phrase it like that.
Its not that difficult, scan for open wifi, if detected, connect, phone home to spy central.
The more sinister, each tv that successfully detects a connection to spy central broadcasts a 2nd wifi that the tv can scan for and connect similar to mesh networking.
There are tons of reasons to want a network connected monitor, the problem is no-one seems interested in producing one without the spyware. I’d love a 40”+ device that supported rtsp, etc but until enough people step up and boycott all this spy crap it’ll never be worth producing better devices. 😞
Mh, yeah I see the possibility of using an open network in theory, but in practice I haven’t seen a open Wifi network in years (excluding business owned ones, but usually you need to confirm something there and can’t use them forever). So not sure how feasible that is. The more sinister option is done by Echo devices for example (that: https://en.wikipedia.org/wiki/Amazon_Sidewalk), but also requires a second device nearby. Much more possible possible though, if similar devices are nearby. But that can’t be hidden anyway and it should be possible to check for that.
I feel like the best option to get the monitor network connected is still a secondary device and never using the built in firmware (and first checking if said device got things like you described).
I’m confused; are you suggesting the TVs ship with an embedded SIM?
not if you dont connect it. of course my “smart” tv allows that, your’s may not. they all will bitch and moan about turning it on when first set up but you should be able to ignore it or set it up “later”
Sceptre seems to be the only company makinh consumer-grade dumb TVs.
There is, its called industrial tv “iiyama” for example is a brand of those
I’ve looked into these in the past. Unfortunately, they are extremely dated TVs that are visually and aesthetically unpleasing.
You should just get a smart TV which allows setting it up without wi-fi instead.
Bought a LG TV and a Monitor three years ago. Last time I will do that. Really happy about my decision not to let the TV have access to the internet.
deleted by creator
Good luck finding a brand NOT doing it by the time you’re ready for a new one.
A lot of bad ones out there, but some are worse than others. For example, I’m not going to consider a Samsung TV because of how many times they’ve done something sketchy
LG is also falling down the list with this incident
Yeah fist time I saw an ad on my smart monitor I reset it and never connected it to my wifi again
What’s the point of a smart monitor? It’s connected to a PC. The PC is smart.
I’d love to know who wants all that extra crap
About 90% of Society. If you told my mom she was going to have to plug in a device and use another button on her remote (input) she’d look at you like you were asking her to replace a CPU on a computer. Can I do that? Yeah, I can but it’s delicate work fraught with danger.
Yep, mine has never reached the internet, it is connected but is blocked at the firewall so I can still hook home assistant up to it.
deleted by creator
I was responding to his TV mention.
Not only that but my old LG smart TV (47LM8600, I think manufactured in 2012) has literal suicide timers in its built in apps. Mine has never been connected to any network and yet it mysteriously informed me after approximately three years of ownership that all of its player apps such as Youtube, Hulu, Netflix, etc. would stop working because they were “no longer supported,” all of them within the time frame of the same couple of weeks. It knew this somehow, apparently via magic, or quantum fluctuations, or psychic brain waves. Without internet connectivity.
Obviously I don’t use any of those features so I didn’t give a rat’s ass and I still don’t. But I still find that deeply suspicious.
The only technical explanation that’s not malice would be that some certificate store on the device had expiring certificates and would need an update to continue to function (or rather connect to remote servers).
Are there ever certs that expire in 3 years?
Yes. Certs can expire after whatever time the issuer wants to set for them. That could be six months or 20 years. Some infrastructure has limits on max and min lengths (more max than min usually) but not all and there are best practices as well.
More importantly the certs could have been five years old by the time this person got the TV for a total age of 8 years.
It depends on their use. The most common certificates that you will “use and check” (implicitly) all the time are probably those, that get served by websites and the APIs that apps talk to. Those are usually quite short lived. Let’s Encrypt IIRC issues them with a default life time of ~90 days and there’s a push industry wide to reduce their lifespan generally to… IIRC something around 40 days. But there are more usecases and certificates and those may be valid longer. E.g. a developer that signs their code/compiled binaries.
Or - and thats more relevant - when you check a certificate you do not only check it’s content, you also check that it was issued and signed by someone “you” trust (or rather the software on your device trusts). Ususally there’s a central store on your PC managed by Microsoft (for Win), Apple (for Mac) or your Linux Distribution with a list of certificates that your device trusts. Those are usually quite long lived (often several years, probably even more than a decade). But will also end. And there will be new ones to replace the old ones. Or new vendors that get added to this trust store. If you do not update your device, this trust store won’t change.
There are now several versions how this can affect the apps in this case, e.g.
- They might not be able to talk to servers using “newer” certificates, as they cannot validate them. There might even be the problem, that the update mechanism breaks, as it wouldn’t be able to get updates from the server to get new certs effectively locking you out.
- They might only allow apps that are signed by them, but their old cert is running out and if it’s invalid, they might prevent the apps from running (as their cert is now untrusted) - note that you can provide ways around that (e.g. checking if the cert was valid when it was issued vs. checking if it would be valid now), but for a device that’s designed to be able to get updates, you might have forgotten that or didn’t think it was an issue or…
Planned obsolescence is one of those things that just infuriates me so much about capitalism.
Luckily for me at least, like so many of us dweebs here, I drive my TV with a little media center PC anyway. So I couldn’t care less which of their services they disable. The more the merrier, as far as I’m concerned. The real annoying part is that these don’t work (presumably), but you still can’t remove the icons from the thing’s home screen.
Same. My TV is a second monitor and really only gets use during football season. Who wants to watch TV in real time anymore anyway?
Need to fill the landfills.
There was some controversy a while ago about Samsung TVs finding and connecting to open WiFi networks autonomously if they weren’t connected to a network explicitly
Could be something as simple as a timeout. Three years of no connection, and it cuts you off.
I’ve used an LG monitor for about 5 years, and never install the manufacturer’s software unless it looks genuinely useful. When I saw the Gamers Nexus video I went to check my installed apps, and sure enough there was LG’s monitor app, installed silently without my knowledge. I used Bulk Crap Uninstaller to get rid of it.
To prevent this kind of thing in future, run gpedit.msc and enable “Prevent automatic download of applications associated with device metadata” under Computer Configuration → Administrative Templates → System → Device Installation.
Or you could just change to an os that doesnt piss on its users constantly
Indeed. I use Linux most of the time, and MacOS a bit of the time, but the old Windows desktop is still there for the infrequent times when I need it to work on old music projects. I have it too dual-booting into Linux, so even it spends most of its time in a more sane OS.
Unfortunately, dual gpu and ray tracing setups don’t work very well on linux.
Sounds like a hostage situation
I couldn’t tell you about ray tracing, but it’s been pretty painless for me to run specific apps on igpu/dgpu using switcheroo-control
Mine works, but I guess it depends on your setup. My main GPU is a 7800XT and my secondary is a 3090 I use for video encode/decode. OBS while streaming and recording simultaneously (if I ever have time), video editing and HandBrake conversions. It just works with EndeavourOS. I can do ray tracing on the 7800 XT but it’s not something I care about in games so I always turn it off.
I’m sure if I ran dual 3090’s in SLI it would be a pain in the ass but that’s why I didn’t try for that when upgrading my system, plus the power draw.
Multiple GPUs work fine in Linux. You can have one playing a game while you wait for the others to finish the real work.
Great; what OS has the equivalent of Group Policy and Active Directory besides windows?
The funny thing is, the people who care about Group Policy and Active Directory are the same people who aren’t happy about their network potentially being compromised because someone hooked up their work laptop up to a monitor at their home.
Still didn’t answer the question.
This is the one thing holding open source back, and the thing Linux users keep pissing on without understanding it.
The CTOs inept nephew can manage your fleet of windows machines and you get all the checkbox security you need for compliance (and some real security):
- Centrally managed
- Logs that are fairly hard to manipulate
- SecureBoot + Bitlocker
That same feature set on Linux will cost you a ton of money in skilled staff if you want to check the same compliance checkboxes. (As for real security, who cares, no one is doing that anyway)
Kind regards: someone who has managed Linux fleets.
THANK YOU!
So many people just don’t get it; happy to see someone rational who does.
I WISH Linux had something like this, but it’s like NT 4.0; it doesn’t have it.
It’s getting there, slowly.
- Clevis can do network and TPM pinned disk decryption.
- With Linux UKIs you can do self signed secure boot, we still need the mechanisms for central signing. This would actually be better that windows, you control your own PKI and Microsoft can’t sign garbage your machines boot.
- Logs is a somewhat bogus argument - log falsification on Windows has been done too. But linux is rather unprotected in comparison.
But the biggest issue is the mentality of ”I own my computer”. Sure, you own your private machine, but your company owns the computer you use for work and the data on it and has an interest in protecting that data from you. That particular threat model is hard to communicate, as Linux users normally don’t think of themselves as a threat vector.
I didn’t watch the video, but maybe they said how this done.
If it installed silently, it must be getting pulled in via Windows update right? Where Microsoft just sees this a regular old driver for a device I would imagine?
I have an LG monitor, maybe about 5 years or older. But I don’t have windows so I assume it knows nothing.
EDIT: Nevermind. I went and watched the section at the beginning, and yep that is exactly how it is done. Does windows not even vet what a vendor hands them as a driver? Perhaps they don’t care, but this seems like an easily exploitable route.
I suspect the thoroughness of the vetting is inversely proportional to the size of the kickback to Microsoft.
Got me curious. Quick search and I found three windows drivers that had keyloggers hidden in them. Go figure it was HP!
-
HP Notebook Keyboard Drivers: Keylogging code was discovered in the SynTP.sys file, which was part of the Synaptics Touchpad driver shipped with certain HP notebook models.
-
HP Audio Drivers: Researchers found keylogging features within the Conexant HD Audio Driver (specifically version 1.0.0.46 and earlier) used in various HP laptops and other Windows systems.
-
That’s what I thought was happening here. The headline is a bit incorrect… the monitor didn’t install the bloatware, Windows did.
Now the drivers/software that Windows installed is likely from the MS store/update path and was made and signed by LG, but still. Plug this monitor into linux and it’s not going to do it because linux doesn’t have that mechanism.
Same. I noticed earlier this month when I got a popup to install Mcafee, out of nowhere. I was mortified.
Oh my God, I just checked and me too.
My lg TV is late 2024. When I first got and was setting it up, asked me to connect to the internet, something about benefits, AI. I was like are you insane TV? you will NEVER have access to the internet, this is exactly why my nvidia shield is locked in a old 8.9 version and pihole block all the things.
You should update the Shield. You’ll get security updates and the Pihole will remove ads.
After the dashboard change on my shield, I simply installed projectify as the new launcher. Now I only see what I want without ads.
yeah I have it as well
You can root it and disable the updates. If you don’t accept the terms, the ai tool isn’t working.
There’s a new root way released recently that most likely works with your model.
Never buy a “smart” appliance that you want a dumb version of.
The problem is that this is about normal LG screens, nothing smart about them.
Simply put, Microsoft detects you’re using an LG screen, it downloads the appropriate drivers released by LG, and those drivers are in fact just nagware.
