Stop hooking up your LG tv to any network
LG's behavior isn't fine, but their monitors don't install crapware on Linux.
It's Windows Update that's installing LG crapware upon seeing relevant hardware IDs. That's why the problem affected older monitors too - it's the update side that suddenly started to ship malware.
This is also a misrepresentation. Microsoft has provided LG with a certificate to sign its driver packages with, and allows LG to upload packages to Windows Update, which includes a feature to install sidecar applications. Now, the spirit of this feature is that any application is meant to provide genuine configuration functionality or some graphical front end to the driver's configuration knobs.
LG then abused that feature to provide adware. Now, there are millions of hardware vendors. One can't expect that every driver package submission from every vendor is thoroughly vetted every time, this is a matter of trust and respect.
Sometimes one actually wants the app that comes with the device, like AMD's and NVIDIA's configuration trays.
Even so, I fully expect that after this debacle MS will disable this stuff. There is precedent for this. Synaptics/ELAN/Alps touchpad tray applications largely disappeared after MS implemented precision touchpads somewhere in 2015, and suddenly Windows touchpads became as precise as those on Macs. Likewise with RGB peripherals. Even GPU driver applications have increasingly become less useful as the most important features—power control, adaptive sync, HDR, etc have moved into native Windows settings.
Why not? Microsoft isn't a struggling startup. They can afford to do just that.
And if you really can't act responsibly "at scale" then you shouldn't be allowed that scale.
Maybe not, but LG has violated this trust and should therefore be either fined or severely restricted by Microsoft. Banning will likely cause more problems than solutions, but they shouldn't get away with this.
Adware was a huge problem during the Windows XP era, can't believe it's coming back now through Microsoft's official channels.
Also I doubt there's actually millions of hardware vendors. But that aside, Microsoft has a duty to vet everything that they offer through their channels. If it's too expensive for them to do, do like Apple did and have those that want to make use of their distribution network (and trust) pay them.
Almost certainly correct because there are only 2^16 USB manufacturer IDs, of which (warning, Google AI quick result...) only 3400 are used. Tiny vendors of e.g. USB drives often seem to use the vendor and device ID of the interface chip manufacturer, but that's probably a good filter for really unimportant ones. Of course not every device has USB, but most major hardware vendors implement USB somewhere and have an official USB vendor ID.
> after MS implemented precision touchpads somewhere in 2015, and suddenly Windows touchpads became as precise as those on Macs.
There’s still a world of difference between a MacBook touchpad and a windows one. My work laptop (18 month old dell XPS) can’t hold a candle to my 6 year old MacBook’s trackpad.
> Likewise with RGB peripherals. Even GPU driver applications have increasingly become less useful as the most important features—power control, adaptive sync, HDR, etc have moved into native Windows settings.
The peripherals still need the addons though; I have ASUS armory crate, Corsair iCue and MSI center for my Motherboard, cooler and GPU respectively. They all suck.
The latest Dell trackpads are quite bad. Price or the product being premium or not unfortunately does not tell you if it will have a good trackpad or not. And it changes over time (Dell XPS used to have really good trackpads)
Basically you have to go to a store and try or find reviews that actually pay attention to this.
Oddly I've found otherwise (Dell Precision notebook from 2021, and Surface Laptop). It might be macOS's animations and smoothing interfering here, but I've found that my Windows touchpads are much more responsive, especially when swiping between desktops.
> The peripherals still need the addons though
Ugh, this is annoying. Hardware vendors need to be banned from writing lousy, inefficient, unsafe software.
> Ugh, this is annoying. Hardware vendors need to be banned from writing lousy, inefficient, unsafe software.
Yeah, I commented on the McAfee LG thread but the stuff that comes bundled with hardware is embarassing. I don’t know how Razer, Logitech, nvidia, MSI, asus, etc get away with it. The stuff is awful, even their “good” software. I work in games and a few years ago the biggest correlation we had between unexplained crashes/performance problems in the wild was users having MSI Afterburner installed. Users thought it did great things and fixed a bunch of games but it absolutely thrashed everything we worked very hard to do and caused no end of issues doing so.
Well, this is the whole market on its own. It's entrepreneurship. No different than every web SaaS startup trying to capture some entry-level piece of computer use and then constrain it so it interoperates only with their "net of trusted partners".
They get away with it because everyone is happy and making money - the users, notably, are not part of the group here, and have no voice. The users are resources to be exploited. Same as on the web, and on most markets these days.
Other overlay apps like discord https://www.reddit.com/r/discordapp/comments/1jncrlc/new_ove... have similar issues - the way they work is by drive hooks and drawing over the application; depending on how close you are to the limit and how the game loop is coded this can very easily (and often does) cause micro stuttering, and in cases like discord causes massive performance problems regularly.
My point here is simply that it's not the monitor that is installing this. Neither the malware nor the URLs to malware exist on the device - they get fetched as part of normal OS-side auto-provisioning, which is the part that was compromised.
They are downloading and installing something without the users consent.
It's nice to have drivers work without any intervention, same with "helper software" but along side the ease of use they also took on the responsibility.
If I download some random .exe from the net; I have to confirm that I want to run it, sometimes I even have to right click and unblock it to allow it to run, because it is "untrusted".
Their signature key, their auto-run system, everything done for ease of use means they own this.
Otherwise what does "trusted" mean?
And it's not like MS is too poor to do anything useful for their customers. They just don't want to unless the cost-benefit analysis pans out in their favor. The customer is worth as much as their wallet.
Isn't the debacle over? MS know about this by now. What's stopping them from killing it today?
A late resolution is barely a resolution at all. None of this functionality needs new Windows features.
Self signing a driver should mean just that, not a driver, and a load of other things we feel like foisting on the user.
Half the reason I moved to Linux is because I just wanted to print something without getting a load of advertising from a printer company.
If you're going to allow 3rd parties to install software on potentially billions of computers with far reaching privileges then you better have something in place other than 'just trust me bro'.
Hard to get worked up over "3rd parties" when even 1st parties cheerfully stomp all over the interests of their users. That ship sailed, caught fire, and sank to the bottom of the ocean the day Candy Crush appeared in the goddamned Start menu.
Apple seem to do a pretty decent job of just that
At least on Windows, the most you get is a scare screen saying 'this app is from an unidentified developer'. I know what I'd rather have.
Well that and side-loaded LG adware
Kinda agree but let's call it "misinformed" or something, instead of a lie.
Of course the details are important on some level. But that doesn't make everything else not matter and it doesn't turn an incomplete explanation into a lie.
This difference tells you that, for example, you cannot fix the problem by fixing the monitor, because the problem does not exist in hardware. It's actually entirely external to the hardware you own, because it exists entirely "in the cloud" (i.e. on MS and LG servers).
The hardware alone is not sufficient for this to happen, but if you were to modify or "fix" the monitor (specifically its firmware) so that it no longer identifies as an LG monitor, then it would no longer cause these ads to be shown.
In other words, if A causes B and B causes C then it is correct to say that A causes C.
The manufacturer implemented choices to deliberately install the software when the monitors are connected. The mechanism is not important to why this is outrageous.
1. Yes Windows must have "approved" the drivers
2. Windows Update runs automatically and not (usually) manually
3. Automatic update can't even be disabled, only manually postponed a bit
At least 2 and 3 are different on virtually every Linux distro. Also, I find it very unlikely that they would accept such behavior.
To give MS the benefit of the doubt here, now that this happened and has been reported on they might decide to enforce stricter rules on manufacturers in the future. But as a Windows user you don't have a choice in case you don't like how they decide and how their decisions might change again later.
This has an option to disable downloading of auxiliary apps when a device is connected. Yes, it's a Windows Update thing.
> Prevent Windows from auto-installing device companion apps, like LG Monitor App, Alienware Command Center and more.
Here's the thing it does: https://github.com/Raphire/Win11Debloat/blob/master/Regfiles...
What LG sent in for installation is not a simple .inf or .sys/.dll file. They sent in a whole bag of software which does all the nasty things, and Microsoft doesn't vet or care about the software installed as the "driver" of the hardware.
https://learn.microsoft.com/en-us/windows-hardware/drivers/i...
I guess that from Microsoft's perspective, the driver itself wasn't suspicious, but it installs a questionable sidecar app they would have never vetted anyway.
It's just a device attached to a computer.
But in a Plug-and-Play world, its addition is noticed by the operating system -- as has been normal for decades.
Microsoft's Windows operating system sees this new hardware ID and then goes forth to install whatever-the-fuck software it associates with that identification, presumably as a service to the user. (Did Microsoft approve it? Dunno. I'm just over hear eating popcorn.)
That's what I thought. It is vetted software, just like on Linux. Microsoft just doesn't care if it shows ads.
So something most desktop Linux users don't do.
It’s really only arch with the AUR and some others where completely untrusted packages are used. This is legitimately a better model than what windows does, although Microsoft has been trying to change this with winget.
Increasingly software is distributed by "curl dodgysite.com/get.sh|sudo bash -", no different to running "install.exe" on windows
Surely Windows Update is a vetted repo as much as arch or debian
I don't think this is the norm at all. I have seen curl/bash install scripts for tools like Claude Code, but they don't use sudo, and the expectation is that you deploy them in isolated user accounts or containers.
Docker provides a convenience script at https://get.docker.com/ to install Docker into development environments non-interactively.
== Homebrew ==
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/inst...)"
Paste that in the macOS Terminal, a Linux shell or WSL. The script explains what it will do and then pauses before it does it. Read about other installation options.
== k3s ==
K3s provides an installation script that is a convenient way to install it as a service on systemd or openrc based systems. This script is available at https://get.k3s.io. To install K3s using this method, just run:
These scripts have lines like
> abort "Need sudo access on macOS (e.g. the user ${USER} needs to be an Administrator)!"
> # --- use sudo if we are not already root ---
Why are you lying right now? This is a norm across the dev tools world for businesses to distribute dodgy curl piped to bash scripts that users install without question, popular examples: homebrew, docker, nvm, bun, deno, k3s. There is zero "expectation" given by any of these install scripts that they are isolated. Can you even find a single source online that suggests doing what you said for you to think its a commonly held expectation?
Isn't it common sense? Do you want coding agents to read and possibly upload somewhere the contents of your home directory?
Also, the expectation on Linux is that you install tools like Docker from the distro's repos.
Clearly the Linux model is more secure, and Microsoft knows it. It's a good idea for Microsoft to take inspiration here. It's only a matter of time before they do containerization too, ala Flatpak. The biggest hurdle to that is Windows doesn't have native containers and the entire container ecosystem is build around Linux.
If Microsoft wanted my advice, which they don't, I think it would cost less at this point to just make Windows a Linux distro. Wine is already better at running older Windows software than Windows. Just expand Wine a bit, add in acceleration where it doesn't already exist, and boom you're done. Nobody would even notice.
And maybe then Windows on ARM wouldn't suck so much.
Apps like Chrome and Spotify have been doing it for almost 20 years, since they made their Windows apps back in 2008. Python updated their installer to install to the user profile in 2015 with version 3.5.0. VSCode started doing it in 2018. Discord did it at launch in 2015. Zoom and Teams and Slack do it and have for a long time. Its been a pretty common pattern for a long time.
> Windows doesn't have native containers
Windows supports Windows containers natively and has supported Windows containers for a decade.
> maybe then Windows on ARM wouldn't suck so much.
Windows on Arm these days really isn't bad. It definitely sucked a lot several years ago with tons of compatibility issues (along the timeframe you said you last used it seriously), but they've made massive improvements since.
I’m very cynical about windows. Mostly because windows is bad in almost every way software can be bad.
curl -s script.random-guy.net | sh
wget https://raw.githubusercontent.com/timofurrer/russian-roulette/master/russian-roulette -O - | sudo bashI even used uname as a fuzzing tool, and that broke builds spectacularly. There's now a more reasonable uname in the sandbox for builds.
and no, this is not how most software is installed
anyone doing this should really take a very very big look in the mirror
The Linux approach has the downside of not having the drivers if a vendor has not been working with the kernel community before launch (or for those who haven't upgraded to a kernel that has the driver, e.g. a LTS release).
On the other hand, the driver is maintained by kernel developers, not created by the hardware developer who is not getting paid after they sell the device. This helps avoid abandoned / vulnerable drivers, or having the hardware dev search for... alternative revenue streams, as in this case.
Let's not diminish LG's part in all this.
Nobody is diminishing LG's blame, LG is guilty of installing malware, and Microsoft is guilty of being grossly negligent and facilitating it. Microsoft implemented this feature knowing that it would eventually be abused for something like this, and it's bad enough to be indistinguishable from malice.
I swear, OSs have become sports teams.
Linux's 'security model’ has plenty of holes. The very fact the kernel and much of its user-mode is written in C almost guarantees that its security model is worthless. The Linux ecosystem operates on trust and respect that can and has been easily abused by bad actors to provide supply-chain pwnage.
There have been so many zero-click local privilege escalation CVEs I've lost track.
Arch Linux AUR malware: https://lists.archlinux.org/archives/list/aur-general@lists....
You have confidence you are actually downloading the same foo as everyone else. And if there were an issue there would be pushback. Not so if you get some random exe from warez.com
Yes it isn't perfect, it's still a lot better than windows land.
Implementation bugs are not holes in the security model. Linux has plenty of those, as does Windows.
Windows security model trusts, downloads, and immediately executes arbitrary software when a new untrusted device is plugged in, without asking the user.
I guess with more and more consumer devices running Linux based OSes (SteamOS, Android, Bazzite, Silverblue, ..) that becomes more and more interesting.
And unfortunately the "I'm safe on my non-windows-system" argument doesn't count for long, as the 99% muggle crowd justifies a shift to a world where our non-certified (=> 'insecure') systems are not supported by big companies anymore, as it's currently happening on Android.
A tech YouTuber showing this off and all the anti consumer behavior. I’m assuming this threads article is for an LG PR piece trying to redirect anger at the app developers to hide the fact that they are engaged in the same behavior themselves.
No transcoding, no weird codec issues, just the raw files direct streamed from the underpowered Unraid box, into the back of the AVR where the audio is handled correctly and the video is sent to the screen.
But yeah external stick is much safer solution, then even tvs like TLC are a great brand.
The consumer demand was/is for cheaper, and data mining is how OEMs got there. The general public got what they want, and OEMs got to keep their margins: "win-win".
It's the same thing with (US?) airlines: people wanted cheaper, and that's what was offered and they chose.
Admittedly this doesn't stop the presumed screenshotting and microphone use and worse
You need to hook something up to a network, and another device would have similar risks.
Setting up a sandboxed VPC or auditing traffic is beyond the means of the average TV owner.
Do you think an Apple TV and a Walmart special TV have same risks? I don't. I give the Apple device my network credentials and the TV never sees them.
Another device might not give the free reign for all shitty malware like they do. Apple TV for one wouldn't.
No thanks, I prefer owning my media in a way that corporations can't just take it away whenever they feel like and where I can use (open source) players of my choosing.
But the replies are missing the point that most people aren't techies and won't go do this. They go to big box store, buy the tv, ask if it has netflix, done.
They won't (and shouldn't need to) install a ATV.
The other solution for those who have a flat white wall (or are willing to install a projection screen) and which I used for years and years: use a dumb projector. There are plenty of perfectly fine dumb projectors and they're very cheap too (compared to the equivalent TV). This also made for the largest diagonal I ever had, in a huge living room, which was really great: basically turning the living room into a mini home theater. I painted the walls etc. accordingly, including a special paint for the white projection wall and black for the side and back walls. This was a better experience than any $$$ TV.
Sadly atm I can't use my projector for my wall ain't flat and I can't install a projection screen and I've got nowhere to put my projector: I could use a short-throw one but the place ain't mine and I'm not allowed to drill holes etc.
So atm it's... Pressing the button on the power strip that powers the LG TV. I know, I know: doesn't help much when the TV is on.
Next thing to do is separate all the junk devices (TV, smartphones [the ultimate spying device btw, much more than your TV], smartwatches, tables, etc.) from your proper stuff (e.g. your important PC running Linux/FreeBSD/etc.). I use different physical LANs (and a bridge/router) but VLANs would do too.
Many cheap home routers also by default offer at least a "guest" network: a perfect place the TV and your relatives' devices when they visit and want access. Set usage quota on the guest network too.
At some point all these devices shall use other networks than yours, so you'll be sorry out of luck anyway. But as long as they don't come with their own battery, pressing the button on the power-strip is some kind of giant low-cost "hack this" middle finger.
- No Dolby Vision support, only HDR10+ - Issues with judder/micro stutter - History of nerfing TVs via OTA updates - HDMI ports randomly failing - Bad HDMI-CEC implementation - Selling completely different panel generations under the exact same model names.
That made a Samsung behave a little better. But giving it no network access is better.
Samsung is a complete mess, now charging $5/month to use smarthings with no local control. I'll never buy Samsung.
Android TV even has ads for Disney and Apple, which I never installed.
I haven’t looked at the stock Google TV home screen on any of my devices in years.
We don't need treats this badly.
Other than the TV, most people really have only one device (Roku, AppleTV, etc). Why do you need so many?
> I only need one remote for all the apps and sound,
True with Roku.
>>True with Roku
Can the Roku remote change the input source on the TV?
Is the NAS TV related? Why do you need these? My media is all on my PC, and I don't consider maintaining that as part of my TV burden. I have to maintain it anyway.
And what maintenance do you need for the PS and XBox? You just turn it on when you use it, and let it auto-update.
> Can the Roku remote change the input source on the TV?
Fair point.
Normally, I change the source only once during a whole session, so I do that right in the beginning if I need to.
https://old.reddit.com/r/pcmasterrace/comments/1v1pkbs/lg_sp... ← examples of others who ran into the same shit
The INNOCN knockoff is the INNOCN 28C1Q. Likely the same panel.
https://www.amazon.com/dp/B0BWDMYK83?peakEvent=4&dealEvent=1...
https://www.newegg.com/p/3D4-007R-00003
Out of stock on Amazon and Newegg