Hacker News Reader

Comment by huhtenberg | Hacker News Reader

> If I paid 1000s of dollars for an "idiot box" that's supposed to reproduce faithfully the signal that I pass it

Just don't connect it to the Internet.

The bigger problem is that at some point there will not be any "idiot box" models at all. The TVs will refuse to work if they aren't seeing the Internet. Then we'll be truly fucked.

View on HN

This is not the solution. Adding a PiHole to your network is not the solution. Disabling features in other places of your network is not the solution.

What if Samsung decides that it will try to connect to open networks for updates or what not? What then? Ask your neighbour to install PiHole on his network? No. This is an example of a game of cat and mouse that shouldn't exist - you pay money for a TV and that's not enough? You giving them your money is not enough and so they decide to shove ads down your throat because profits.

Simple solution would be just not to buy Samsung.

Until they all start doing it.

Real solution is regulation. But that can only happen if the outcry is large enough. Having two revenue streams is always going to be better than one.

All starts with us accepting the idea that the device you paid for still isn't your property, and if tomorrow samsung decides to show porn on all samsung TV's, there is nothing you can do.

... or, you know, when you can't install a software you want on a smartphone that you own and paid $1000 for.

I’m concerned that in the future devices I do not want to be connected to the internet (let my TV) will come with 5g or some other technology and be able to connect itself. I think with IoT and a desire for ease of setup this might be possible if the price of mobile internet drops enough.

Automobiles already do this without your input.

I think the always-on IoT thing actually makes sense for life-and-death fields such as automotive/medical. There are cases where if an update does not reach the device in time human lives could be at stake.

It's definitely not for the consumer's benefit in most cases. No one is going to die because your Smart Keurig or 5G-TV goes unpatched for a month. Hopefully we can avoid the slippery slope and realize that these devices' internet capabilities are not for us - they are primarily for data collection/advertising purposes.

> actually makes sense for life-and-death fields such as automotive/medical.

I cannot imagine a worse idea.

IoT devices are the richest source of hosts available for botnet operators to compromise because they are numerous and famously insecure. Today it's lightbulbs and security cameras. Tomorrow you wish it to be pacemakers and Toyotas?

We already know it is functionally impossible to write bug-free code which is also useful. We also know that attackers relentlessly probe systems until (that is a _when_, not an _if_) a weakness is found to exploit to gain control of that device. It is possible to write provably-correct code, but so far only for somewhat trivial applications.

Until this fundamental problem of software security can be solved, an air gap is the _only_ reliable thing that can protect life-critical software from external remote attack.

>I think the always-on IoT thing actually makes sense for life-and-death fields such as automotive/medical.

But critical components should be designed as simple as possible, and be thoroughly tested before device release. Releasing garbage and then patching it OTA doesn't really work for safety critical things. Not so long ago cars didn't have capability to upgrade (firmware on mask ROMs) and I don't think something horribly bad happened.

Some Samsung TVs already try and connect to open WiFi networks if you don't connect them yourself.

see https://www.reddit.com/r/privacy/comments/bpr6xs/if_you_choo...

My next idea - Faraday cages for smart TVs

Or Faraday cages for entire rooms in my house!

Faraday cages around the property line. In LA some people already live in houses hidden behind 25 foot tall hedges. They need only a tin foil roof.

You could always try disconnecting the antenna that goes to the wireless module instead.

Disconnect may not be enough, best is to wire a resistor in place of the antenna, of the same resistance of the antenna, which will shed the attempt to use the antenna as heat.

(I disconnected the antenna on my OnStar, yet found it still connecting to cell towers successfully from time to time. The resister solved that.)

In practice, the samsung TV won't connect to your neighbors wifi if its already connected to yours. So you can firewall away and the TV will be none the wiser. For now, at least.

The NVIDIA Shield TV, which runs Android TV, can no longer be initialized without signing in with a Google account, the setup screen will refuse to get past that step, even if you don't have an internet connection.

The forced login is likely illegal, because there is no mention of a requirement for a Google account in their marketing materials or on their sales pages.

The device stays perfectly functional if the the network connection is cut off within seconds after signing in, and the account can be removed after the setup is complete. The only drawback is that you can't update apps from Google Play, unless you add a Google account again.

In Europe it definitely is illegal under the GDPR

iOS 14 now requires an account to enable the phone.

It literally just bricked my test iPhone SE.

Are you sure it's not the icloud lock?

No, it's a requirement after updating to have an icloud account in order to get past the out of the box screen.

That doesn't sound right. You do need an iCloud account to enable some functionality, for example to enable seamlessly switching AirPods between different Apple devices.

I started the phone, put the pin in and triggered the upgrade.

After the upgrade completed there is an only an option to put in a email/password for icloud and there is no "skip" or "do later" button I could find.

I'm pretty derpy but I can tell you it is true.

Sounds like you picked up the SE used and it had an activation lock. One of the more annoying things Apple has done was to take down the page for checking that before purchase.

That or you put in an iCloud account at some point but it did not get removed successfully.

Nope, found it eventually.

iOS 14 merges the 'not now' from iOS 13 into a 'forgot my account or don't set up now'.

I didn't try 14, but on 13 on the "sign in to apple id" screen, you say "don't have one", then say set up later.

has this been removed? It might be getting into GDPR violation territory.

Okay, good call, they merged this into "forgot password or don't have one". It still tries to talk you out of it with a pop up with a highlighted button of "sign up now".

Dark patterns... I can see why the older generation is scared of the hardware.

> The bigger problem is that at some point there will not be any "idiot box" models at all. The TVs will refuse to work if they aren't seeing the Internet. Then we'll be truly fucked.

We're closer to that than you think. My Philips Ambilight television (purchased this year) throws a popup every few weeks already complaining that I've not completed setup and connected it to the internet.

As sold as I am on Ambilight (it is actually brilliant), I wont be buying another Philips television.

You may be able to connect it to your router but then use your router's parental control features to block the net for that reserved IP.

Then it'll just complain that it's not connected to the internet, wouldn't it?

Depends. Some devices just want an IP.

I should see what happens with my Philips TV if I block it from accessing the Internet. It's currently plugged in because it's also connected to my Hue lights but I don't really ever use any Internet features on it.

Also, if you really enjoy Ambilight, there's a (kinda expensive) solution to get it on any TV now: https://www.techradar.com/news/philips-hue-now-lets-you-turn...

This looks brilliant, thank you!

I’ve said it in the past: commercial displays are the new “dumb” displays. Unfortunately, they’re not full TVs — no speakers, no tuner — so they’re not as “idiot” friendly as a regular TV while being more expensive.

Got any recommendations for a good 4K panel in the 40" - 60" range that won't break the bank? I have my own speakers and I can buy an external tuner if I need one

Then I'll start selling a little $50 box to emulate internet and route all update / advertisement requests to /dev/null :)

Or maybe we (the tech community) just agree on one model and produce an open source firmware. If you look at MagicLantern for Canon, you'll see how amazingly far people will go to control their hardware.

That won't last long either if at all. They will just require an SSL connectivity to their servers with a custom CA root. The end.

so...

1. Order TV.

2. test if it works without agreeing to anything and without internet.

3. return if that's not the case.

I have yet to accept EULA on samsung on anything and it works...

Right now the ACR is troubling. Telling a remote server what you're watching... Only solution I found - not connected + hdmi to Linux box I control.

As an older comment mention, they can easily add an delay that makes it work without an connection only for the duration in which an return is possible.

It is very hard to win against hostile design.

I agree with you it's hard to win against hostile design but there are options for now.

If it stops working after return period I call under warranty that it stopped working (2 years), they are forced to fix the issue.

Explain the issue, explain you cannot connect to the internet.

If it doesn't work, forward the whole info to the customer protection bureau if you're in the EU.

Edit: I will test this out by setting a date far in the future when I buy new equipment (will also hopefully cause SSL failures due to expired certificates internally in the firmware)

This would be a known defect under EU warranty law, which means once it kicks in, you can get a full refund if you want to.

They can try and fix it 3 times then you get your money back.

That would easily cause lawsuits as it is clear that the other party is doing that solely to cheat against law.

You're assuming a level of technical skill on the side of TV manufacturers that it almost sounds like a joke to me.

In any case, all you need is one model with a decent screen and broken certificate pinning and I'm good for the 3-5 years that the TV will last.

And until then, I'd assume that Nvidia sees the market demand for big TV-like PC screens and outcompetes the TV manufacturers.

It is called a monitor. Works just fine for whatever and people use it for work.

The factory I work at had large one scattered around to show line information. Some of the information is safety critical and so if it is inyeruped with an ad there will be legal issues.

In a not so-distant future dystopia you can only get monitors without ad-overlays, when you pay for the monthly subscription ...

You'll get the first month for free, when you sign up for the 2-year plan for 19.99$/month right now!!

Oh no, you'll pay the subscription AND you'll get ads. That's what Amazon Prime feels like atm, preroll ads for other shows at the start of everything you play (even next episodes).

I've wondered about this. The TV I have (a Sony Bravia) is now almost a decade old (works fine). We got it specifically because it has a slot for a DVB-T module (terrestrial broadcast). DVB-T is now gone (replaced by DVB-T2, but I doubt this will remain in the air long), so we have no broadcast TV now, only our HTPC connected to it with Netflix, local media files, and a browser.

Frankly, we don't miss the TV channels. Streaming works okayish for the public channels, but we rarely bother.

The TV is just a dumb screen connected to a receiver, which has the HTPC as input as well as record player.

So the only thing a 'TV' offers me is its screen. Is that any different from a high end computer monitor these days? Is there a difference based on the viewing distance perhaps?

Historically monitors has better pictures at the expense that you couldn't look at them off angle, while TVs you could look at from anywhere in the room. I think that is gone today but it might be something that comes up again... Though in the safety critical application I brought up off-angle viewing is a requirement.

Another difference between a typical TV screen and a typical monitor is many TVs will dynamically adjust brightness depending on what's displayed, and maybe other factors. Sometimes this is on by default and you can turn it off in a menu, but I've met TVs where you can't turn it off.

Using a TV which adjusts the brightness depending on what's displayed can be very unpleasant when trying to do computer work on it. E.g. opening or closing a window may cause other windows to abruptly change brightness. Scrolling through a document may cause the brightness to vary.

The problem with some monitors is that it gets tricky to get audio from hdmi that gets delivered to the screen

Sort of makes sense because a lot of people don't care about or plain don't want speakers on their monitor.

> Just don't connect it to the Internet.

One also has to be cognizant of HDMI Ethernet in case of "unintended" connectivity:

* https://en.wikipedia.org/wiki/HDMI#HDMI_Ethernet_and_Audio_R...

Maybe in about 10 years, or even sooner, when 5G is everywhere, and the IoT-chips are so cheap that it doesn't matter anymore, they are built into every appliance like in new cars now. Always connected by whatever means. What then? Faraday cage?

I bought a used projector some time ago. Couldn't be happier. I usually watch something after it's dark and I also have very good blinds. It probably warms up in similar, or better, time that many TVs boot up nowadays. I just have a Chromecast connected to a soundbar connected to the projector. VLC handles Chromecast, although somewhat buggy, so I can watch things from my computer in another room.

Also Netflix experience with Chromecast is mostly superior to smart TVs, because it will not play anything while you just try to find something worth watching.

Connecting Chromecast to the soundbar also gives ability to listen to music from Youtube, without running display. It wastes bandwith however.

EDIT: I wrote "beamer" instead of "projector" at first

What's a beamer? I thought you were talking about a BMW at first.

Another word for a projector.

The word "Beamer" is a German word that isn't really used (in that context) in any other language. Same as with "Handy" for smartphones.

Oh, must have been my time spent in Germany. As Wikipedia disambiguation page says:

> Beamer

> Video projector, a pseudo-Anglicism in a number of languages including German, Dutch, Latvian and Swiss French

I actually ran into one of these recently. I stayed at an AirBnB which had a super-cheapy small-ish TCL+Roku TV in the living room, with a super-cheapy thin antenna thing. The internet was "acting up" (95% of packets dropped, unusable) so we tried to watch some broadcast TV. You had to either sign in with a Roku account, or as "Guest", but "Guest" had to accept a couple long EULA, and it needed internet for that to work, but the internet was fubar ... I had to use my phone as a hot-spot for the TV to get it to display broadcasts! That left the TV's wifi config such that it definitely won't work for the next person, lol ...

> Just don't connect it to the Internet.

Haha, just wait until 4g/5g will become so cheap that TVs will have them built in for doing software updates and sending telemetry when offline :)

> just wait until 4g/5g will become so cheap ...

One of the perks of living in Canada is I am sure this would never happen here in my lifetime.

Nothing a piece of foil can't... foil :-)

I run mine on it’s own network so at least it can’t spy on my NAS and network infrastructure. If it tried this ad nonsense I’d filter it through a pihole or something similar. I will not go down without a fight with these snooping gadgets.

I just bought a gigantic computer monitor and connected it to my apple-tv, problem solved.

sure, the monitor was atleast 25% more expensive than a similar screen with a smart-tv function in it, but I think it's worth it.

My TV needed a firmware upgrade to get HDMI working. You need to accept EULA's before connecting and updating.

Can't you just yank the internet connection afterwards?

I did a firmware upgrade and just disconnected from the internet right after. I also don't use the built in apps, because let's be honest, compared to an AppleTV, all SmartTV apps are basically garbage. I understand that the AppleTV is somewhat expensive, but it's my baseline for the quality I'd expect from a SmartTV.

Netflix on the AppleTV, starts instantly, and you're browsing the content endlessly after 20 sec. Start Netflix on the TV it self, that will take a few minutes.

Yeah, I did. and at least it is an Ad-free TV.

return it?

Chanced are, they would have "fixed" it for me. By accepting ALL EULA's. iirc, I could accept half before updating.

Edit: also, it was a gift.

On mine I was able to do an offline firmware update by loading the new firmware onto USB flash drive. Was hoping the new firmware would fix a bug in the built-in video player, but it didn't.

I think that will just create a market opportunity.

There was a company that made just a good tv, no smarts, but I can't find it right offhand. It think it was a european company

JVC does this for their video projector (which are also pretty damn good). I've seen people complain about that though so not sure how long that'll last.

Almost all projectors in "high end TV" price range and up have 0 "smart" features.

I've been running a BenQ w1070 since 2013 and couldn't be happier

Market opportunities are for companies to make more money, not less. If everyone is doing it, it’s because the market, us, told them they could get away with it, and therefore will, because two revenue streams will always be better than one.

This power of the market to vote with dollars is highly overstated. "We" have no say in a hypothetical nine figure, back room wine and dine deal between ad execs and TV execs, when the ad money can afford to be in every back room.

Sceptre TVs. They sell dumb 4K TVs.

I have one. Best buy I ever made.

How is the picture quality compared to the top Samsung/Sony 4K panels used in smart tvs?

Commercial TVs (and video/signage displays, if you don't actually care about the TV tuner) are out there from most of the major brands including Samsung, but they tend to cost a fair bit more than the equivalent consumer TV.

not an option for some recent samsung TVs - if you don't connect the TV to a WiFi AP, the TV "grows up" and will try and connect to any open WiFi APs itself.

see https://www.reddit.com/r/privacy/comments/bpr6xs/if_you_choo...

>Just don't connect it to the Internet.

Wait until they start including a cellular modem that can't be turned off.

just thinking what would happen if I block connection to Ads services in my router...

That's pretty much what a pi-hole is. According to my friends who use a pi-hole to filter their connection, it makes almost everything ad-free

Also https://nextdns.io/ on the cloud. I run my ios devices with no ads thanks to this honest service. Can i modify the DNS resolver on a samsung tv (i do not intend to have one ever)

you can but if it cant resolve it will fallback to googles resolver automatically. At least this is what happened on my model.

Yes, this happens. But then you make a firewall rule to route outbound port 53 traffic that doesn’t come from the Pihole to go back to the Pihole. It gets rather elaborate.

> you can but if it cant resolve it will fallback to googles resolver automatically. At least this is what happened on my model.

I built my own router with a raspberry pi. I installed pi-hole and use that as a dns resolver. I then use an iptables rule to NAT / forward all dns traffic on port 53 to the pi-hole resolver, similar to how ISPs often intercept dns requests. This prevents IOT devices from bypassing the dns server configured via my DHCP. Letting pi-hole block the requests helps prevent errors from dns request timeouts.

This method works really well.

DNS over HTTP has screwed this up.

I'm just waiting for smart devices to start doing that instead, forcing me to set up full SSL filtering until they start doing encrypted SNI :/

True, although then I’d lose trust in the devices and wouldn’t want to use them by that point anyway.

I set my router dns to use the custom values nextdns provides for my account, which enabled it for the entire residence. It was fun to see the flotsam in the nextdns logs. I love this service.

Ads on my Samsung TV is the entire reason I decided to finally pi-hole my entire home network. It's wonderful. No ads on my TV and much less on my tablet, phone and PC. Too bad pi-hole doesn't stop Youtube ads.

The only complaint is from my wife who sometimes Googles stuff and clicks on the top result, which is often an ad and will end up blocked. She now has to scroll down a bit to the real results.

The pi-hole will be bypassed by hard-to-kill DNS-over-HTTPS, however.

Yea force it to go through a proxy with your own ca and filter from there.

Key pinning and Expect-CT will prevent that.

It will not prevent firewalling... but the TV might not work.

my samsung tv always tops the charts on most blocked connections on my pi-hole, its not even close. it is disgusting.

Same thing on my Philips TV (Europe). It tries to make a lot of calls to *.imrworldwide.com https://better.fyi/trackers/imrworldwide.com/

A panasonic tactical technical response team is enroute to your house, ETA 15 minutes.

Now I have to fill my TV with Tannerite, too?!

It does exactly what you would hope, at least for Samsung TVs. Ads disappear, other functions are not affected.

Upon discovering the ads I was gonna return mine for a comparable LG, until I learned LG also have ads—at least this way I can pretend I'm not being taken for a ride.

At the time I didn't have any external devices capable of 4K Netflix or YouTube; now I do I should factory reset the TV and set it up without network access,

The article says LG removed the ad.

Damn, maybe I should have done the return then.

Reply on news.ycombinator.com