Hacker News Reader

Comment by dastx | Hacker News Reader

> needs constant firmware updates

Firmware updates are good. They can patch security issues and they can improve different aspects of the device. The security being the best plus obviously.

Wholeheartedly agree that there is no reason for a company like Samsung to track your every move despite you paying them hundreds for said devive. I'd be very surprised if they don't make a hefty profit from such devices. So why then, do they need to track us in addition to making us fork over our money.

I understand Google tracking us. I don't agree with it, but I understand it. Same with Facebook. But Samsung? Apple? No. They're even going to certain lengths to prevent you from fully enjoying your devices (such locked bootloader, making it hard to repair etc).

View on HN

Firmware updates are good. They can patch security issues and they can improve different aspects of the device. The security being the best plus obviously.

The point is that there are no "security issues" in a dumb media player like the DVD player I have. Suppose an "attacker" (and that is stretching the definition a lot...) can create a disc that can overflow a buffer somewhere and crash the player or cause it to do something "interesting", and I have been somehow tricked into attempting to play this disc --- so what? It's not connected to the Internet, the firmware is read-only, there's literally nothing of value to attack. I'll just eject the disc (manually if necessary) and not play it again.

Instead this stupid "update culture" has created horribly buggy software that's barely functional "because we can always change it", and now we somehow need an Internet-connected media player,along with all the downsides --- including security --- that brings, just so they can (try to) silently attempt to fix some bugs that should never have gotten out in the first place? My experience tells me that they will fix one thing and break something else in the process, so there's overall no real improvement.

>there are no "security issues" in a dumb media player

There is also no Netflix playback, which is a very common use case for consumers.

BTW, the internet connection can be used for key revocation as a way to combat piracy and consumer choice. So, it's "worse" than "just" tracking.

I agree with the upgrade sentiment, it’s mostly a disaster and a step backwards for the consumer.

> Firmware updates are good. They [[can]] patch security issues and they can improve different aspects of the device.

Emphasis mine - updates also remove features and introduce security issues. It's not cut-and-dry "updates are good"

I am pretty sure my Samsung fridge update removed 3 of the limited ~12 or so apps it had in the first place.

If im not waiting for a big fix i avoid upgrades when possible for the reasons you mentioned above, thers nothing more annoying than an upgrade that downgrades features that were working just fine.

Im also doing some research before upgrading. Never the first to upgrade, i hate autoupdating software

What security updates would you foresee being necessary for a traditional BluRay player? Perhaps I'm not being creative enough, but I can't think of what a hacker would accomplish.

Other than allowing the player to read pirated BluRays, I guess, but that's not the user's problem.

Maybe making the player part of a DDOS botnet? That's all I can think of.

The only consumer electronic in my house I allow to talk to the internet is the AppleTV. Nothing else is allowed on the router. Not the TV. Not the disc player. Not the refrigerator. Not even the "smart" thermostat.

> Maybe making the player part of a DDOS botnet?

This only works if the player is connected to the internet, which shouldn't be necessary to begin with.

I don't know about security per se (as others have mentioned a dumb player doesn't need internet), but I could very easily see a decoder bugfix or something to do with i/o error conditions or mishandling some particular kind of disc...

Firmware updates can be good, but only the user with physical access should be able to install a firmware update. An example of how this might be done may be: There is a ROM firmware (always read-only) and EEPROM firmware (read-only except during firmware upgrade operations); the ROM firmware only checks a switch (which is a physical hardware switch can be set only by the user) and if set, will load the data on the DVD (or CD or CompactFlash or whatever other media it uses, but specifically not internet) as a firmware upgrade into the EEPROM; if the switch is not set, then the EEPROM is read-only and nothing can upgrade it, not even a custom firmware. (The user could also physically open it up and replace the EEPROM chip themself, if wanted, but this would normally be unnecessary.)

This, but removable microSD card instead of EEPROM.

I can’t vouch for Samsung but Vizio have said in the past that they make very little profit off their TVs and this is offset by data that is collected from usage.

https://www.techdirt.com/articles/20190114/08084341384/vizio...

Now I’d imagine that Samsung are making a hefty profit on the 75” 4K all singing sets (and still spying on you) but the cheaper ones seem to be priced so there isn’t much profit.

Reply on news.ycombinator.com