Hacker News Reader

Modern TVs support "HbbTV", and it's enabled by default in many locales. It's essentially HTML-over-DVB (including javascript), which is absolutely terrifying when you realize that there's no encryption or authentication, and that it's something you can broadcast for yourself with a cheap SDR, and that TVs run outdated browser engines with root-equivalent privileges.

View on HN

Hbbtv only embed the URL into the stream. The rest of the JS part came from internet still.

Maybe it first worked like that, but it's certainly no longer the case in newer versions. I've personally compromised a not-network-connected TV using only broadcast signals.

HTML+JS can be pushed via the "DSM-CC object carousel"

Funnily enough my memory of trying to implement the DSM-CC specs is that they are broadly equivalent to a denial-of-service attack on your brain

Reply on news.ycombinator.com