This is unhinged? "What if LG submitted a driver for their TV to Linux and that driver had bad things in it?!? To prevent this, block the EDID so Linux can't tell what monitor you have."
I hate smart TVs as much as the next cat, but I think this article would be improved with a little less hyperbole.
Like a true tech-valley rapist
Does it violate user consent? Sure. Is it rape? No, and the overuse of the word cheapens the horror of it.
Malware, by definition, is software you never asked for and was installed without your permission.
I'd call this a PUP as opposed to malware proper. I think the mal- prefix is load-bearing here. Bundling sponsored software, while unethical, isn't as bad as distributing actual malware. Maybe these days McAfee really is malware though.
I also wonder how well these EDID blockers handle HDCP. My speculation would be "not at all", but who knows!
why would it not be? mobile os's had to block udid access and similar access due to spyware from advertising companies? Google was found to intentionally be using hardware IDs for tracking, they also used MACs for tracking. Apple had to block multiple uniqueness vectors to deal with advertising companies (again, that means google) spying on people. That's why apple (to appease third party spyware vendors) introduced the advertising id that could be reset, and google followed that.
For some inexplicable reason no platform now makes the reset UI particularly easy to find, nor supports auto-reset.
There was also "Carrier IQ" or the UIDH header injection that carriers did that was based on hardware IDs as well.
In addition to all these spyware companies - the vpn companies, all the ad companies (again, including google - I have a new car with android auto, and spying is the default, and cannot be turned off globally you have to go through multiple google specific spyware checkboxes before you get to the manufacturer spyware) - will use anything that they can to uniquely identify you, they've been caught using literally anything. They've even used security features to spy on people.
I think the real question is do you really believe that they wouldn't use the EDID if it was available? without even thinking? Most of these companies already just use third party libraries to do this for them, and these libraries do use anything and everything that they can to create a unique ID - they've used rendering differences, exact software versions, ASLR slides, etc.
Apple's pointer App Store rules even have to explicitly prohibit use of pointer authentication codes as a way to identify devices.
These companies are absolute scum. If there is a way they can spy on you, they do. If they're not already using EDIDs I'd be honestly surprised.
I always make sure to put queries like "will it work without an Internet connection and Android / iOS app" in writing, so when that turns out to be a lie, I have remedies under the Australian Consumer Law. Not sure how this would work for folks elsewhere, especially the US.
But what stops LG from convincing the Ubuntu maintainers to make an LG variant of their supposed driver to magically appear in your snap or apt package repository? You hope to God they don't, but the danger is always there.
This is why I'm sad for the state of Linux distros - the popular ones make no secret of their desires to be more like Windows, so while there was a time when this seemed unthinkable, it certainly doesn't feel that way today. We used to lump all the BSDs and Linuxen in to the category of free and open source. I think we're going to need to make a distinction soon between corporate and community projects.
There are many other places where similar philosophy is important: for example, what does your OS do when you connect a USB device? Does it literally search for instructions to run code, like Windows stupidly does? Does it scan block devices for filesystems, leaving open the possibility of poor filesystem scanning code being used maliciously? Does it immediately allow HID devices to start talking to the default console? I want to be on an OS where these things are known, and won't be changed behind the scenes for corporate interests.
Forty-Bot | a day ago
This is unhinged? "What if LG submitted a driver for their TV to Linux and that driver had bad things in it?!? To prevent this, block the EDID so Linux can't tell what monitor you have."
novedevo | 22 hours ago
I hate smart TVs as much as the next cat, but I think this article would be improved with a little less hyperbole.
Does it violate user consent? Sure. Is it rape? No, and the overuse of the word cheapens the horror of it.
I'd call this a PUP as opposed to malware proper. I think the mal- prefix is load-bearing here. Bundling sponsored software, while unethical, isn't as bad as distributing actual malware. Maybe these days McAfee really is malware though.
I also wonder how well these EDID blockers handle HDCP. My speculation would be "not at all", but who knows!
symgryph | a day ago
I just unplugged the damn thing from the network. No problems now. Beautiful picture.
sigmonsez | a day ago
I am just as paranoid as the other when it comes to internet connected TV but is op really claiming that EDID is being used to market to us?
olliej | a day ago
why would it not be? mobile os's had to block udid access and similar access due to spyware from advertising companies? Google was found to intentionally be using hardware IDs for tracking, they also used MACs for tracking. Apple had to block multiple uniqueness vectors to deal with advertising companies (again, that means google) spying on people. That's why apple (to appease third party spyware vendors) introduced the advertising id that could be reset, and google followed that.
For some inexplicable reason no platform now makes the reset UI particularly easy to find, nor supports auto-reset.
There was also "Carrier IQ" or the UIDH header injection that carriers did that was based on hardware IDs as well.
In addition to all these spyware companies - the vpn companies, all the ad companies (again, including google - I have a new car with android auto, and spying is the default, and cannot be turned off globally you have to go through multiple google specific spyware checkboxes before you get to the manufacturer spyware) - will use anything that they can to uniquely identify you, they've been caught using literally anything. They've even used security features to spy on people.
I think the real question is do you really believe that they wouldn't use the EDID if it was available? without even thinking? Most of these companies already just use third party libraries to do this for them, and these libraries do use anything and everything that they can to create a unique ID - they've used rendering differences, exact software versions, ASLR slides, etc.
Apple's pointer App Store rules even have to explicitly prohibit use of pointer authentication codes as a way to identify devices.
These companies are absolute scum. If there is a way they can spy on you, they do. If they're not already using EDIDs I'd be honestly surprised.
sigmonsez | 14 hours ago
I can see that in this light. I suppose it's just another few bits of entropy...
olliej | a day ago
step 1) don't use a smart tv?
ahelwer | 9 hours ago
Sure! I will just mosey on over to the commercial solutions page of $TV_MANUFACTURER and purchase one for the tantalizing price of “Contact us”
olliej | 5 hours ago
Or you can just not connect it to the internet?
avh-on1 | 3 hours ago
Increasingly often, new TVs refuse to display anything until they're connected to the internet.
duncan_bayne | 2 hours ago
I always make sure to put queries like "will it work without an Internet connection and Android / iOS app" in writing, so when that turns out to be a lie, I have remedies under the Australian Consumer Law. Not sure how this would work for folks elsewhere, especially the US.
johnklos | 12 hours ago
This is why I'm sad for the state of Linux distros - the popular ones make no secret of their desires to be more like Windows, so while there was a time when this seemed unthinkable, it certainly doesn't feel that way today. We used to lump all the BSDs and Linuxen in to the category of free and open source. I think we're going to need to make a distinction soon between corporate and community projects.
There are many other places where similar philosophy is important: for example, what does your OS do when you connect a USB device? Does it literally search for instructions to run code, like Windows stupidly does? Does it scan block devices for filesystems, leaving open the possibility of poor filesystem scanning code being used maliciously? Does it immediately allow HID devices to start talking to the default console? I want to be on an OS where these things are known, and won't be changed behind the scenes for corporate interests.