Hacker News Reader

Comment by spaceribs | Hacker News Reader

> If we could agree on a good, standardized capabilities model for software and everyone starts using it, we will have reached security Nirvana.

I want to get there, but I also don't trust anyone except (maybe) myself to determine what capabilities are "good" versus "bad".

I literally just spent most of today messing with my 2018 Samsung TV trying to get rid of the bloatware they pre-installed. I had to do that because the apps took up 96% of the storage within. These apps cannot be deleted normally.

If we're heading towards a place where vendors are the ones deciding what users are allowed to do, as well as what the software is allowed to do, and at what level of granularity, I have no reason to trust them any more than I trust a russian state-sponsored hacker.

View on HN

But capabilities are not good or bad, no more so than e.g. integers.

What the post talks about is "a good system" of capabilities, that is, a comprehensive, logically sound, lean way to describe capabilities that would be widely accepted and applied. With that, indeed a lot could be achieved.

I think you can already see the issue with that proposition in terms of Google's attempts to prevent ad-blocking in MV3. Google went so far as to design a brand new protocol for handling web requests in such a way as to make it difficult or impossible to do proper blocking. They "Reworded" the capability.

If we assume that the "owner" of this list of capabilities is the same party that's writing the software, you better believe they don't (or won't eventually) have the user's needs in mind. Enshittification makes a fool of us all.

We've seen this elsewhere. "Security" becomes not about protecting the user's data from malicious operators, but protecting the manufacturer's data from the user.

If we do agree a standard it'll need to be about actually protecting the user, but implemented by manufacturers who have no incentive to actually do that, and lots of incentive to protect their data, sorry, business model.

"I literally just spent most of today messing with my 2018 Samsung TV trying to get rid of the bloatware they pre-installed removed."

Can you elaborate?

I second this, please. I can't even update the preinstalled apps I use on my 2018 Samsung TV because they keep adding more default apps and there's literally zero free space with nothing but their default apps installed.

I combined a bunch of awful "tech tips" websites into a working approach:

1. Reset my TV to factory settings.

2. Go into the "apps" item while it desperately tries to update itself

3. Go into "Developer Mode" by pressing 12345 on the remote.

4. Restart the TV by holding down power button for 2 seconds.

5. Open "Apps" again

6. Open the cog.

7. Under the app you want to remove, press "Deep Link Testing" and then hit cancel.

8. If the "Apps" app hasn't been updated yet, your delete button should magically reactivate.

I was able to delete the product manual which is like 90mb, all others were reloaded after another restart though but it gave me enough wiggle room to update and install other apps.

Thank you!

this is madness

As a tech literate person, it was by far the most infuriating experience in recent memory, but achieving some level of victory was fun! Reminded me of hacking my xbox as a teen.

Buy a brand new TV.

TV comes with 5Gb hard drive

TV comes with 4.75 Gb of OS + bloatware apps.

Watch youtube and youtube caches .25GB for 2 hour long information video.

TV complains of no storage.

Rinse. Repeat

He did elaborate. "I had to do that because the apps took up 96% of the storage within." Literally the line right after the one you quoted...

> I want to get there, but I also don't trust anyone except (maybe) myself to determine what capabilities are "good" versus "bad".

The illusion of control and oversight is why Blueteams always lose in the Cyber Game.

It's not feasible, and you effectively don't have time for that. The sheer amount of millions of alerts per day are the result of people still trying to spin the hamster wheel because they don't take a break and think about how this is gonna end up.

Don't get me wrong, but I think this is a clustering and statistics problem. You can never be 100% secure and sure about everything, but you can always push the odds in your favor on a larger scale of nodes.

Nobody cares whether a system got hacked if there was no compromise of the database and if it can be rolled back easily afterwards. That's why I believe in a fully automated approach based on a strong(er) inventory and stronger communication between systems in regards to incidents and responses.

Offtopic tip. Buy a pc screen instead and attach a nvidia shield or your own box. I never return to normal tv screens again. I also like the more natural color feel of pc screens. Tv s are bloated with color filters, frame interpolators and more.

PC monitors are dramatically more expensive though. A regular 55 inch TV is like $300-$500, a monitor that size is gonna be thousands of dollars. (Edit: And you can usually tinker with the color profiles or just turn on Game Mode if you hate the enhancements. It'll never get as close as a properly calibrated PC monitor with ultra color range or whatever, but it's fine for entertainment.)

Same with the Shield, it's like $150-$200 while a Chromecast with Google TV is $50 and does pretty much the same thing. Either would be a huge upgrade over integrated smart TV UIs.

There are "dumb TVs" - https://www.tomsguide.com/how-to/how-to-buy-a-dumb-tv-and-wh...

I have latest LG OLED and I would have hapilly paid more for to get it without smarts built in. Using it with attached Apple TV and the experience is sublime when compared to the builtin crap.

You can also just get any regular "smart" TV and never set up its wifi. I plugged in my Chromecast as soon as I got it, and never used the TV's built-in stuff. It works fine and has no ads or anything. It just boots directly into the Chromecast.

that's the only way.

except using a chromecast is just undoing what you thought you had accomplished.

I don't care about the tracking, if that's what you mean? The TV UIs are just so slow and bloated and terrible. The Chromecast is a little faster. Apple TV is even more performant, but their content hierarchy and recommendations suck compared to Google.

I think the Shield was nice for a while too but then Nvidia started adding their own ads.

The Chromecast with Google TV's as close to a "Pixel for TV" as we're gonna get, I think. Wish they'd make a version with a faster processor though. The current model is still noticeably laggy.

> then Nvidia started adding their own ads

It has definitely been paper cuts on my shield I've had for a long time (2018?)

Originally awesome, but then the last major Android update added the advert banner. It was defended because it basically only showed adverts for shows and movies.

In the past fortnight it has started showing other adverts, perfume I think.

People forget how much the cost of a SmartTV is subsidized with the data collection. PC monitors are not doing that, yet. I'm guessing refresh rates and some other features are playing into the pricing difference, but without them being subsidized with your analytics, it's unlikely they'll ever be as cheap

> People forget how much the cost of a SmartTV is subsidized with the data collection.

People keep saying this with zero proof or evidence.

We used to be able to buy TVs that were pretty nice and intelligent and didn't have all the data collection and they didn't cost that much more. I'd like to be able to buy those again.

Your honor, I'd like to show the jury this link we've marked as Exhibit A to counter the claim of the witness:

https://www.theverge.com/2021/11/10/22773073/vizio-acr-adver...

Yeah so Vizio made $502.5M in device revenue and $57.3M in Platform+ gross profit.

So if the devices cost 11.4% more that'd compensate for the elimination of Platform+ profit.

And depending on the accounting it could be much less than that since the cost of the devices would go back to being much cheaper if they were just dumb TVs with HDMI ports and no spyware/adware.

So that's about what I thought.

> People keep saying this with zero proof or evidence.

There is so much available data on this subject I assume at this point it is common enough knowledge people don't feel the need to cite sources.

https://www.washingtonpost.com/technology/2019/09/18/you-wat...

https://tv-watches-you.princeton.edu/

https://www.consumerreports.org/electronics/privacy/how-to-t...

I'd give them all my viewing data if they'd give me a free TV, lol. In this case it's actually helpful for generating recommendations anyway.

Yeah this was a bad purchase overall, but I figured if worse comes to worse, I can just hook up a media box of some sort and entirely ignore the rest of it. Definitely getting close to that call.

They're like $50 and DRAMATICALLY better than what the TVs offer. It makes a huge difference :)

There is still some bloat in them (bundled apps) but it's much less intrusive and crappy than the TV ones, IMO.

Everyone makes them now... Google, Amazon, Apple, Nvidia, Roku...

Luckily there are still some companies building dumb TVs, and with reasonably good quality.

I personally have been buying Swedx for 5 years or so.

Reply on news.ycombinator.com