Sennheiser headphone software installing root certificates onto users computers [pdf] | Hacker News Reader

Sennheiser headphone software installing root certificates onto users computers [pdf]

secorvo.de

77 pointsshrikant20 comments

From smart TVs to this. How awful.

Software is eating perfectly good peripherals and _totally_ ruining them.

Why the hell would a headphone need software?

I have a different set of sennheiser headpones, but they include software you can install to emulate surround sound without the headphones actually needing all the speakers for true surround sound.

It also supports firmware updates for Bluetooth headsets.

Something has gone wrong when you’re installing drivers for headphones.

When you use any USB based audio device (headphones, soundcard, mic) you are installing drivers to drive the product. Its just that 99.99% of the time the standard USB Audio Drivers supplied with your OS will work just fine.

The issue is what happens when the headphones want to offer more functionality beyond basic audio? Personally I try and stick with using "USB Composite Device" to support more than one device class and then use USB "HIDRAW" [0] to drive that extra functionality (But that's mainly because I can't be arsed to get drivers signed and it does what I need it to do, YMMV).

[0] https://www.kernel.org/doc/Documentation/hid/hidraw.txt

I always avoid any crap software that comes with accessories like this. This is why going away from 3.1mm audio jack was a loss.

But even if use USB or Bluetooth, can stick to open drivers and standards for sending audio, rather than mandating a proprietary implementation.

This is still bad, but it is important to note this is for a SDK.

I bought some wireless USB headphones from Corsair. The software takes 300mb of disk space. Why?

Assuming you are referring to the iCue Software:

About 72M comes from the directories plugins (some pngs), GameSdkEffects, driver and QtQuick[1]:

  ~/Downloads/Program Files/Corsair/iCUE  du -d1 -h | sort -rh
  421M    .
  28M     ./plugins
  19M     ./GameSdkEffects
  13M     ./driver
  12M     ./QtQuick
  5.4M    ./sounds
  5.2M    ./translations
  3.2M    ./System
  1.4M    ./imageformats
  1.2M    ./QtGraphicalEffects
  1.2M    ./platforms
  406K    ./predefined_data
  367K    ./QtMultimedia
  358K    ./mediaservice
  286K    ./QtQuick.2
  265K    ./scenegraph
  134K    ./QtQml
  130K    ./audio
  105K    ./Qt
  77K     ./legal
  33K     ./iconengines
  25K     ./playlistformats

The bulk comes from these files:

  ~/Downloads/Program Files/Corsair/iCUE  ls -shS | head -10
  total 333M
  158M cuedevres.bin
   51M cueres.bin
   36M iCUE.exe
   16M opengl32sw.dll
   14M vcredist_x86.exe
  4.8M Qt5Gui.dll
  4.8M efm8load.exe
  4.7M Qt5Core.dll
  4.4M Qt5Widgets.dll

The bin files are identified as:

  ~/Downloads/Program Files/Corsair/iCUE  file *.bin
  cuedevres.bin:   Qt Binary Resource file
  cueres.bin:      Qt Binary Resource file
  manifestres.bin: Qt Binary Resource file

So, it's mostly the QtQuick framework.

[1] https://en.wikipedia.org/wiki/Qt_Quick

Going further, the cuedevres.bin file seems to include at least 1 Photoshop file:

  hexdump -C cuedevres.bin | head -12
  00000000  71 72 65 73 00 00 00 02  09 d5 35 27 00 00 00 14  |qres......5'....|
  00000010  09 d5 15 35 00 04 10 9c  ff d8 ff e1 0f 39 45 78  |...5.........9Ex|
  00000020  69 66 00 00 4d 4d 00 2a  00 00 00 08 00 07 01 12  |if..MM.*........|
  00000030  00 03 00 00 00 01 00 01  00 00 01 1a 00 05 00 00  |................|
  00000040  00 01 00 00 00 62 01 1b  00 05 00 00 00 01 00 00  |.....b..........|
  00000050  00 6a 01 28 00 03 00 00  00 01 00 02 00 00 01 31  |.j.(...........1|
  00000060  00 02 00 00 00 22 00 00  00 72 01 32 00 02 00 00  |....."...r.2....|
  00000070  00 14 00 00 00 94 87 69  00 04 00 00 00 01 00 00  |.......i........|
  00000080  00 a8 00 00 00 d4 00 0a  fc 80 00 00 27 10 00 0a  |............'...|
  00000090  fc 80 00 00 27 10 41 64  6f 62 65 20 50 68 6f 74  |....'.Adobe Phot|
  000000a0  6f 73 68 6f 70 20 43 43  20 32 30 31 37 20 28 57  |oshop CC 2017 (W|
  000000b0  69 6e 64 6f 77 73 29 00  32 30 31 37 3a 30 39 3a  |indows).2017:09:|

It looks like cuedevres.bin is more of a source file for cueres.bin. It would be interesting if you would rename it and see if iCue is still working.

> include at least 1 Photoshop file

That’s not a photoshop file, it’s a JPEG file saved by photoshop. https://en.wikipedia.org/wiki/Exif

Right, I overlooked the "FF D8 FF"[1] part

[1] http://www.file-recovery.com/jpg-signature-format.htm

Why not? What rational person would care about 300mb of disk space? I swear HN folks are obsessed with "efficiency" to the exclusion of all common sense.

First thought is "it only needs a driver for USB -> sound for the wireless dongle it uses"

Second thought is "what crap is it installing that is going to slow down my machine"

Third thought is "what kind of tracking/surveillance is it going to attempt"

Im rational and i care.

It looks like this is software for headsets to be used with softphones, not headphones.

Earlier discussion still on front page:

https://news.ycombinator.com/item?id=18550760

WTF?

That said, why does the OS allow installing a CA cert without requiring explicit confirmation from the user?

Reply on news.ycombinator.com