Do not buy a Hisense TV (or at least keep them offline)
cohost.org
cohost.org
Why is the TV pretending it’s a new device?
[0] https://arstechnica.com/security/2023/10/iphone-privacy-feat...
Fingerprinting is absolutely an issue for device-based trackers (whether apps or websites), but from the perspective of a passive network observer they're usually quite airtight and don't leak the collected data over insecure channels.
Ideally, Apple would randomize MACs within the same SSID too, but this would break a lot of "free wifi for X time, then pay up" schemes that rely on consistent MAC addresses, and despite the appearances Apple is still very much in bed with the establishment and doesn't want to rock the boat too much by giving that much control to the users.
That's a very uncharitable way to phrase that. It's not like Apple was lying or doing this on purpose. It was clearly a bug, a bug that was not wide known for 3+ years. It's not as if it was some open secret that everyone was taking advantage of. I'm not saying no one knew or that no one took advantage of it but I'd imagine the average consumer was complete unaffected by this bug.
UPnP is literally just a protocol that sits on top of HTTP.
This why I said in a different comment that both Windows and Hisense are at fault. Windows could have handled this kind of edge case much better but that doesn’t absolve Hisense TVs responsibility for behaving badly too.
However, as this incident demonstrates, there’s always an edge case that breaks things.
This looks like a trivial low-packet-count DoS on every Windows machine on the network.
My point is: it’s very easy to post on message boards like this about what best practices should be when reviewing fuck ups from other companies. While at the same time ignoring the fact that we fuck up plenty of times ourselves too. In an ideal world software engineering would be held to the same rigour as other forms of engineering. But when software fails people don’t (usually) die. So what happens is developers end up getting overworked, given unrealistic deadlines and have to fix problems with software updates. those kind of scenarios will breed bugs like the aforementioned. So yes, you’re technically correct — but only in a universe that doesn’t have our current tech culture.
This is why I’m a little more pragmatic about my criticism.
The correct way to look at this is that the OP has discovered a significant flaw in the windows network stack. The correct description is:
"A flaw in windows PnP discovery allows a denial of service attack against the windows networking stack. Windows PnP service track and caches the UUID and Mac address of all entities that appear in the local network and fails to purge old or outdated services until it deadlocks"
That isn’t remotely what I said though.
My point was: It’s both vendors fault.
If youd bothered to spend even 30 seconds longer to properly read my comment instead of knee jerk reacting to anything that’s even remotely sympathetic to evil Microsoft then you’d realise that I’m not letting MS off the hook for this. I’m just saying there’s enough blame to go round on this particular fault.
It's more similar to how you have a list of all paired Bluetooth devicees, even if they are currently not connected. Or a list of networks configs for every network you connected to, even if it was a public one.
But there are 2 issues:
- it's automatically set by "external" local network "events" (which isn't the case for the things I mentioned above, as long as you don't automatically connect to public networks, never do so)
- it's not bound, which is in general not the best idea but in context of the 1st point is really really bad. I.e. it should have some bound related to it's resource cost and expected usage. (If I have to widely guess a bound of 250 or so would be over the top enough to accommodate all edge cases and not lead to issues, most users would be more then fine with idk. 25 or so). Through what to do if the count is exceeded needs some careful considerations, i.e. you would need to drop the "oldest unused entry" but for that you need to determine and propagate what "unused" means here.
To be fair I wouldn't be surprised if that isn't just a problem for Windows. Like e.g. I have heard multiple times people arguing that UPnP shouldn't be enabled (by Windows/Linux/Mac) as it wasn't designed for a modern security context where you can't just trust your local network a lot.
Every software that saves something needs to have a way to deal with too many things being saved.
It's called testing software. Maybe Microsoft should try it.
We’ve all, yourself included, made plenty worse fuck ups in our career. So let’s show a modicum of pragmatism here please.
What we should be more critical of is how this gets reported and handled by Microsoft and Hisense. Do they choose to ignore this bug / close it as “Won’t fix” (working as intended)? Or is this something that will be patched in a relatively recent software update?
MS shouldn't have anything "unbound" which can increase due to external events, even if it's limited to the same local network (but MS (and probably not just them) has also a long history with security issues on local network exposed interfaces).
At the same time regenerating a new UUID for UPnP every few minutes is buggy to a point it can be seen as a DOS attack. So ... also not okay. (It also doesn't add any relevant degree of privacy to "very frequently regenerate UPnP ids for devices always there in the same fixed local network AFIK.)
E.g. with IPv6 we have enough addresses to give every device in the world today and for decades to come unique addresses and using devices MAC you can reliably generate them collision free. So you don't need NAT so routers can well only route instead of routing and proxying IP Address/Port. Problem is that leaks a lot of private information. So a schema was added which while upholding the properties allows "randomizing" (and changing over time) addresses.
But coming back to the smart TV I don't think this is the case here as it changes the address _far_ to often and it's a UPnP i.e. local network only Id. Furthermore UPnP also advertises devices descriptions so de-anonymizing randomly changed IPs is more then trivial.
My guess is the UPnP software module is started anew every few minutes and generates a new uuid every time. This might be due to it not persisting the uuid. Weather that is because they just didn't bother implementing persistent device ids or weather it regenerates it after every time it crashes and it crashes every few minutes I can't say. But it looks a huge lot like a software bug.
What also is a 100% a but is that this external device misbehavior can mess up Windows (through I wouldn't be surprised if it isn't just Windows which has problems with that).
It means that there is a resource controlled by external events which isn't "bound" which from a security POV is always a terrible idea, even if it might at most cause a DOS attack (not just because DOS is bad but also because it's not rare that people find ways to use DOS attacks alongside other found attack vectors to more reliably succeed).
I am no Windows fan, but this behaviour by the TV seems to be unreasonable.
Most "smart" devices are utter garbage. I found a seller of non-smart TVs, which manufacture here in the UK, which made me particularly interested - Cello: https://celloelectronics.com/model/televisions/ (you can filter for non-smart TVs).
The problem? The picture quality and sound of the one I got (TBF, the cheapest medium-sized TV they sell) is not great. Fine for a spare bedroom for occasional use so a guest can watch something short, or in an office where I might want the news on, fine. But I couldn't watch a film on it, and it's nowhere near the level of my main TV.
Given that no smart TV manufacturer is ever going to get a single byte of data from me they can sell, I guess the joke is on them? I wish I didn't have to do this dance though: give me a smart TV where I can get the apps I choose, but the manufacturer is not ramming it full of spyware... that would be amazing.
Good news! HDMI supports Ethernet backhaul, which isn't widely used, but in theory your TV could access the internet through the HDMI source you have plugged into it.
In practice, I've never seen it used even for point-to-point links, let alone this kind of bridging/routing/NATing.
Well, you're lucky that your equipment doesn't use the Ethernet channel in HDMI 1.4 then :) you can put a piece of Kapton tape over the HEC pin to make sure that doesn't happen.
[1] https://github.com/home-assistant/core/issues/73643#issuecom...
[2] https://forum.openwrt.org/t/minidlna-creates-new-media-serve...
I wonder what to take of this. Use Linux? Or at least set your home network as "Public" instead of "Private" (clearly a workaround, not a solution, because then (s)he would need to enable RDP on Public networks.
(Btw, your parentheses are unbalanced: https://xkcd.com/859/. And the author uses they/she pronouns (not ‘(s)he’): it says so at the top left of the page.)
Or just buy a normal TV and never connect it to the internet, what's so hard about that? Cheaper than paying more and getting less for a digital signage screen.
These devices aren't at all exclusive or difficult to purchase.
Where would you live that they would be hard to find?
The point of a sign is that it shows what you want it to show. Whether that's an advantage depends on whether that's what you're looking for. But every feature of the display is going to be oriented towards that goal.
Notwithstanding the Amazon review that says "Yes it has wifi", you might find it noteworthy that this model does not have wifi connectivity. (As can be verified from its spec sheet, https://image-us.samsung.com/SamsungUS/samsungbusiness/pdf/s... , or from its page on CDW, https://www.cdw.com/product/samsung-qe43t-smart-signage-qet-... )
Your comments elsewhere in this very thread seem to indicate that this product is exactly what you want, a display that won't show ads and, in the general case, isn't connected to the internet. What exactly are you imagining will happen to someone who uses one?
Having gotten a 40" sibling that was sold as "desktop monitor" with otherwise identical panel (besides of course pixel pitch) spoiled me with it's "technically counts as HDR" native contrast from a burn-in resistant LCD, also suffering just barely perceptible loss of contrast with no significant color shift at all viewing angles that aren't already too extreme to comfortably read text due to distortion.
Sure, it's slow and thus not suited for competitive counter strike, code editing and SDR-mastered visual media look about as good as an LCD can. They do though seem to not consider factory/nominal color calibration for the panel with the signal processor and a regular operating system on an attached PC something they want to offer on these, which is annoying because with 8 bit and the nominal 5000:1 static contrast mild banding isn't even unexpected. So it'd be preferable to just drop an ICC profile onto the computer that's valid for when the screen is set to native gamma and native white balance (I.e. dumb panel mode) and get to make full use of the panel without the excess expense of individually calibrating devices to do digital proofs ahead of actual production/view the material during actively ongoing color grading work. A decent color managed (but not individually calibrated) screen will suffice happily for most tasks, to the point where further calibration won't be perceptible in a double blind test with the screen isolated from reference light sources for most untrained eyes.
Most of these are resold by niche small businesses but I don't see any incentive for them to reject a private individual buying it? In the UK I got mine from https://www.projectorpoint.co.uk/displays (no affiliation beyond being a satisfied customer) and after wiring them the money I got it next day.
I've had good experience with Sony professional displays (model number FW-65BZ35F) - they are reasonably priced and come with stock Android TV with very little bloatware. My understanding is that these Sony units are not billboard displays or optimized for high-brightness/24H runtime, they're what looks like standard consumer hardware just running a different firmware - the upside is that the price is actually competitive with consumer-grade TVs.
If you're never gonna use the built in OS anyway, there's no reason to risk it. Most TV manufacturers are engaged in a brutal race to the bottom and they have to enshittify the software to make money.
It didn’t. Fixed some other bugs, introduced some new ones. Not my best bet, not my worst. Still no ads, luckily, though.
End users and consumers can buy digital signage and commercial displays without any trouble.
Here is one on Amazon:
https://www.amazon.com/NEC-Commercial-Public-Display-Speaker...
I've done that with last 3-4 TVs and never had an issue. And the $50 dongle is much cheaper than paying $1000 more.
Never happened. It’s just a thing we know can happen, but doesn’t for myriad reasons like humans flying in drones.
Vizio for exmaple in 2021 made 85% of its revenue from selling the TV, just 15% from the "platform". If the $400 TV was instead $470 they would make the same. These scam companies just see it as "free profit" on top of a captive audience.
PC manufacturers used to do this, with Microsoft's consent. Buy a laptop 20 years ago and you would get tons of shovelware from Dell which made them a few extra pennies. Nowadays I believe Microsoft themselves got into the game.
Companies aren't happy with making a product for $50 and selling it for $60 (or $200 or whatever), they have to make a little more by double-dipping. This is of course partly the consumer to blame -- they just look at the headline price. Buy the plane ticket for the lowest price on the middleman interface, but then it's $15 'check-in fee', $50 'landing-fee' etc, but that doesn't matter because look at the shiny advert for $9.99*
What percentage of their profit comes from that 15% of their revenue ?
I suspect it's a lot.
It shouldn’t be creating a new UPnP UUID every few minutes. That’s clearly not good behaviour. However it does also highlight a denial of service in Windows.
> I manually backed up everything important from my main PC drive (as I could not access the windows backup program because it lived in settings!!!!!!!!)
Son #3 hates that System Settings is restricted to ≤1 instance by design. Windows only unchanging feature is that it is impossible to work with 2 Settings Windows simultaneously.
Working with multiple windows was kind of the point of Windows in the first place.
MS doubles down on that problem by continually pruning-away legacy settings options. Their end game seems to be limiting all system option access to just one app - an app that can be downed by janky TV firmware.
#3 is right.
While all software is buggy to some extent, Hisense TV is probably maliciously changing their UUID so users cant block their telemetry, or their ads, etc.
On the side of TV, it is also bad.
Therefore, both the TV and the OS have blame in this.
I'm not sure it will. If this was a scenario that caused DHCP to continually issue new IPs - this will likely cause operational issues. Two I can think of are DHCP exhaustion and routine loss of device connectivity.
If you use router level AdBlock -- that is, DNS filtering -- lots of ads and telemetry go away by themselves, and what UUID is used is irrelevant. Of course, most people don't do that, but still I don't see how changing the UUID helps prevent blocking telemetry/ads.
I'm not defending Hisense and I'm not saying that this can't be the intention but it's a good idea to keep Hanlon's razor in mind in situations like this.
- Slow/laggy UI
- Ads on the home screen
- Sends a shit ton of telemetry home
This is why all of my TV are never connected to the internet and only serve as output for my Apple TV. Sadly, I gave up on the cheaper Android TV boxes, because they all have the same issues with crappy software and even started to show ads.
But for those who need a 65" wall of advertising, the Invisible Hand will provide.
I laugh every time I see a livingroom with all furniture focused toward a fireplace. It truly reminds me how holdovers from out-of-touch lifestyles two+ generations ago still dominate some norms of interior decoration. Larger screens are objectively better in every way if you have the space.
Commercial "dumb" TV screens are available but are harder to find, and as I said, it's only recently that large computer LCDs (not TVs) have become available. But these are still not as large as recent gigantic smart TVs.
So when most people want a bigger screen, they see little choice but to accept telemetry. The more privacy-aware people take measures against it.
This is mostly because Roku/etc are subsidizing the cost of the device so far down the line that it becomes impossible to argue for the better ones, especially from companies like NEC/Sharp who make Damn Good displays for business.
My pet pieve with my current Samsung QLed 4K 65" (2016) is just how sluggish changing input sources is - when wanting to go between the Xbox and the PC. Have never tried any of its other features, can't imagine they'd be anything other than horrible.
The display is a very nice monitor otherwise! Still very good colours. Windows with a Logitech media keyboard is awesome. Zwift, Spotify, Internet media all plays back very nicely.
My LG TV is completely offline, but I can still say “Hey Siri turn off the TV” and it works.
2) IR learning remote Beware, amazon link. This is just an example, not a quality product https://tinyurl.com/yks7kmxv
3) I dont have a non-smart solution to that
I have one of those tvs (kdl##w####) and yes, the youtube app is becoming unusable. I am quite sure someone might be telling us the party is over (that they want us to use a new tv)
The reason it's slow is because "growth & engagement" wants that slow CPU to be doing more ("suggestions" aka ads, telemetry, garbage overdesigned UI, etc) than actually necessary.
For years now, actually more than a decade, we just use a home-theater projector (Epson, fwiw). Audio goes into our stereo system. Set up a media center to feed the projector. If you still have cable (or equivalent), hook up the box from your cable company.
What are you even talking about???
It's a bit of a squeeze for a smallish bedroom. Or an 1000 sqft home w/ 3+ kids, a single wide, a 5th wheel, a shotgun home. Ya know. Places people live.
I don't watch TV unless I'm with my wife, but when we do, we get stunningly accurate 4K HDR video at any time of day, faithful color reproduction because the panel is QD-OLED (I had to tune it a little beforehand; I still need to color calibrate it), and the ability to tilt the display based on where we're sitting.
You can get those with a projector, but you need space, a good panel to project against, and, most importantly, a REALLY GOOD projector (Epsons that can do this are $2k+, which is how much our TV was).
That said, a projector can't be beat for watching stuff outside (though, again, you need a really good projector to watch anything during the day)
https://www.statista.com/forecasts/1283880/global-television...
The average TV costs $333. Put another way, the average consumer is spending $333 on their TV (I think that's a correct inference?). At that price you can get a pretty large 4K LCD panel supporting HDR.
I think you'd be hard pressed to find a competitor at that price point, and I'm guessing you spent significantly more than that on your setup. I'm sure that choice made sense for you, but you're not the average consumer.
But why and how?
https://learn.microsoft.com/en-us/answers/questions/1339707/...
Sorry, flashbacks to the debates in The Old New Thing where Raymond would claim people blame Windows when it breaks broken software...
> The root cause is the TV generates random UUIDs for UPNP network discovery every few minutes. That means it poses as a new device. This caused windows to add it to the device list (Device Association Framework, aka DAF) as a new device. This means now 1000s of devices (which is the same device) filled the device tree causing it to enumerate forever. Thus the "deadlock".
> TaskManager uses DasHost to enumerate devices for some reason, so that hangs.
> Bluetooth relies on device discovery, so that also hangs, and Settings app along with it.
> Network discovery in file explorer obviously also needs Device discovery, so that also hangs.