Hacker News Reader

Comment by cobbzilla | Hacker News Reader

I never connect any “smart” device to wifi. If it doesn’t work without connectivity, I don’t want it. I use my TVs as display devices. They have HDMI-in and that’s it.

View on HN

I have a smart TV that's never spoken to the internet after exiting the factory, but it's a pretty tenuous state of affairs. I have this fear that someone staying over is going to see the "Services unavailable, press [menu] to troubleshoot" toast that shows up overtop the HDMI feed for a few seconds and think they're helping me by connecting it. 4-5 years worth of firmware updates all at once... half a decade of watch data somehow extracated from the HDMI feed and stored for precisely this moment... ads everywhere. Even if it doesn't happen instantly, I can only assume there's some flag deep in the OS called makeEverythingWorse just waiting to be flipped on the femtosecond The Beast catches a whiff of a slightly-higher patch number; now content in it's doomed state after having fufilled it's one true purpose of telling someone at samsung my favourite show is HDMI2.

I have had to back my mother down from dns.google [8.8.4.4] dns.google [8.8.8.8] athena.m3047 [10.0.0.220] mediaservices.cdn-apple.com [23.46.228.133] mediaservices.cdn-apple.com [23.46.228.134] mediaservices.cdn-apple.com [23.46.228.135] mediaservices.cdn-apple.com [23.46.228.137] mediaservices.cdn-apple.com [23.46.228.138] mediaservices.cdn-apple.com [23.46.228.139] mediaservices.cdn-apple.com [23.46.228.140] mediaservices.cdn-apple.com [23.46.228.142] mediaservices.cdn-apple.com [23.46.228.143] mediaservices.cdn-apple.com [23.46.228.144] mediaservices.cdn-apple.com [23.46.228.145] mediaservices.cdn-apple.com [23.213.34.169] mediaservices.cdn-apple.com [23.213.34.176] mediaservices.cdn-apple.com [23.213.34.178] mediaservices.cdn-apple.com [23.213.34.185] mediaservices.cdn-apple.com [23.213.34.186] mediaservices.cdn-apple.com [23.213.34.187] mediaservices.cdn-apple.com [23.213.34.188] mediaservices.cdn-apple.com [23.213.34.193] mediaservices.cdn-apple.com [23.213.34.196] mediaservices.cdn-apple.com [23.213.34.201] mediaservices.cdn-apple.com [23.213.34.203] nrdp.push.prod.netflix.com [35.81.198.46] ec2-35-86-100-253.us-west-2.compute.amazonaws.com austin.logs.roku.com [35.212.27.142] scribe.logs.roku.com [35.212.34.174] austin.logs.roku.com [35.212.72.105] austin.logs.roku.com [35.212.119.44] display.ravm.tv [35.212.178.254] logs.netflix.com [44.226.179.188] logs.netflix.com [44.228.67.58] nrdp.push.prod.netflix.com [44.229.50.4] logs.netflix.com [44.229.122.169] nrdp.push.prod.netflix.com [44.232.75.216] api.roku.com [44.249.213.211] nrdp.prod.ftl.netflix.com [45.57.40.1] nrdp.prod.ftl.netflix.com [45.57.41.1] nrdp.push.prod.netflix.com [52.24.26.117] logs.netflix.com [52.33.247.19] themes-service.sr.roku.com [54.200.214.141] occ-0-1009-1007.1.nflxso.net [198.38.112.135] occ-0-1009-1007.1.nflxso.net [198.38.112.144] occ-0-1009-1007.1.nflxso.net [198.38.112.145] occ-0-1009-1007.1.nflxso.net [198.38.112.165] occ-0-1009-1007.1.nflxso.net [198.38.112.169] occ-0-1009-1007.1.nflxso.net [198.38.112.170] occ-0-1009-1007.1.nflxso.net [198.38.112.172] occ-0-1009-1007.1.nflxso.net [198.38.112.178] mdns.mcast.net [224.0.0.251] 239.255.255.250 [239.255.255.250] that precipice on her own TV so I know it's worth worrying about. The siren call of an entirely empty TV homescreen beckoning us with a struck-out radio tower icon. "We have Disney+ and CraveTV too... press [menu]... pay no attention to the sticky note your son put on the coffee table"

> I have this fear that someone staying over is going to

This happened to me. After they left, I tried a factory reset, but I don't have confidence there's not some code to remember previously saved wifi connections because my tinfoil hat is firmly in place. However, as you've said I only use the TV as an HDMI receiver. None of the TV's apps are used again. So I'm not sure how much they can detect from just the use of the HDMI port as the only thing being used. The games we play to get the subsidized pricing.

HDMI is heavily used for ACR (automatic content recognition) in smart TVs:

"Our findings indicate that (1) ACR operates even when it is used as a “dumb” display via HDMI"

"For both LG (a) and Samsung (b)TVs, the scenarios with the highest ACR traffic are Linear and HDMI."

* https://dl.acm.org/doi/epdf/10.1145/3646547.3689013

Sure, but what can it do without a network?

It can store the data until it connects to one, though that's not going to be as useful for anyone selling it. Real-time auctions are where the money is, from what I understand.

Maybe if it can start colluding with my other devices over HDMI!

Can't you have your wifi/router blacklist the TV?

Find the TV’s MAC address and block it on your router. My brother home network had this system where your MAC address had to be whitelisted on the router to communicate with the network, as the days go by I see how in hindsight how this might be for the best in the end.

I’m paranoid that actually blocking internet access to the TV will result in filling up the TV’s disk with all of this intrusive data they have collected waiting to be uploaded, eventually run out of space and brick the TV. This could be just bad software or actually malicious where they intentionally break something if it loses connectivity for too long and they can see you using it with other connected devices.

We really need normies to care enough about this to the point manufacturers will need to think they need to advertise on their TVs that they are privacy-friendly and don’t collect anything as a selling point. Until then, they don’t really care. I just wish someone like Apple made a TV with their Apple TV functionality baked in that I could trust.

Lot's of people do it and I haven't seen nobody reporting this. Given the miser hardware specs most smartvs have, if this was a problem, it wouldn't take years to fill up the small storage space most of those TVs come with.

Allow list is the best approach. Soon TVs will randomize their MAC just like our phones do.

Indeed, but some scoundrel is probably scraping this page and having an LLM prepare their pitch as to how manufacturers could improve Ad / Data collection revenue by bypassing these suggestions :/

I split my network(s) into subnets (sharing the same wire, not to be confused with the actual subnets which don't share the same wire) which correspond to routability policies. This in turn involves firewall rules, routing table entries, and DHCP configs corresponding to those subnets.

I give away the software which does the following. I get this (and a lot more) for every host on my network, and I know what every host is.

    # peers upstairs-roku.m3047 +addr +serv domain [53] domain [53] domain [53] https [443] https [443] https [443] https [443] https [443] https [443] https [443] https [443] https [443] https [443] https [443] https [443] https [443] https [443] https [443] https [443] https [443] https [443] https [443] https [443] https [443] https [443] www [80] [35.86.100.253] psbserver [2350] https [443] https [443] https [443] https [443] https [443] https [443] https [443] www [80] https [443] www [80] https [443] https [443] https [443] www [80] https [443] https [443] www [80] www [80] www [80] www [80] www [80] www [80] www [80] www [80] mdns [5353] ssdp [1900]

> after having fufilled it's one true purpose of telling someone at samsung my favourite show is HDMI2.

It is able to identify content directly from the pixels, they will know what you've watched even if it was from a pirated .mp4 served from your PC:

https://en.wikipedia.org/wiki/Automatic_content_recognition

I fear the same but made sure I block basically everything at the network level. First thing I do is hook the tv to the network and black hole its mac.

Or open up the TV and disable its wifi hardware.

That is the only solution, otherwise there is no guarantee that someone just won't connect the TV to their phone's hotspot.

I get this policy in theory but don't see how it works in practice in a modern life where you want some device that runs Netflix, YouTube, of similar to show on your TV. It can be the TV or an android box - but somewhere you end up trusting a third party and a software that may end up running other this party apps. The alternative is a local jellyfin server but that means you very likely have to break some laws to put content that the family wants to see on it.

Personally I'd just not want any TV in my house, but convincing the family of that is not easy ;-)

I drive my TVs with a locked-down mac mini.

On my TCL TV, you have to connect it to read the Google policies you are agreeing to. If you don't, you agree to policies unread.

Thankfully, the blast radius of this is nothing without connectivity.

But it lets you continue without reading them? There's a lot of questionable terms of service rules but this one has to be unenforcable.

You must check a checkbox in agreement to continue. To read the policies one agrees to, an internet connection is required. You may check the checkbox without reading.

As far as I have found from a lot of menu spelunking, this agreement is irrevocable. If I ever go online, it will be used.

That's the kind of thing that doesn't always hold up in court.

The reality is, no one is going to take the companies to court over things like this.

Disney eventually walked it back due to bad PR, but this did happen: https://wdwnt.com/2024/08/disney-dismissal-wrongful-death-la...

That has very little in common with 99.999+% of people who don't experience a tragedy like that and just have their data used against them.

Sounds like a great reason to return a TV. It isn't like you must have a TCL TV.

If I don't connect to the internet ever, my agreement to Google policies is probably a moot point.

If you don't connect, sure. If a visitor connects the TV, all bets are off.

I have had to tell people not to connect the TV. It yearns for release.

If it has an Ethernet port I would use that then unplug it. It still gets to phone home once but you don't have to worry about it maliciously saving your Wi-Fi password for later

You can create a guest wifi with temporary password, I do that when I need to connect devices that might store the password like kindle or such.

Frustratingly I do want some of the functionality that comes with connecting my TV to the network - specifically the ability to control things like turning it on and choosing which input its set to via an API it exposes. That's manageable by putting it on a VLAN which isn't allowed access to the outside world, but its also really annoying to me that I have to do that.

You don't need an api for that. You can do that with a 30 year old CRT if you wanted. Copy IR signals from remote. Put IR blaster in front of IR receiver. Make whatever tool you want to control the IR blaster. Done.

Yes. I could do that. I could also hook something up to the debug serial port and reverse engineer that, or use HDMI-CEC, or make a tiny robot that pushes the buttons on the back of the TV. I'm using the API though, because I already have a Home Assistant server on my network and that can communicate with the API without me having to faff about making tiny robots.

It's annoying because I would definitely like for some internet-enabled functionality, such as youtube. I would also like to connect it to the LAN and not to the internet for other things, such as streaming from my NAS...

Reply on news.ycombinator.com