Hacker News Reader

Comment by simojo | Hacker News Reader

We purchased a Chinese-made projector from Amazon, which was surprisingly inexpensive (~40 USD). Upon connecting it to the internet, it placed a constantly running feed of ads on the corner of the screen, even while movies were playing. There was no way to disable it either. Even though it's not a stick, it's a similar principle.

View on HN

I remember reading an analysis on one of those projectors; the author found a residential proxy running on their device. I would recommend keeping these things off the internet.

Yes that’s what the article is about.

I'd be very interested to see it if you still have access to it.

Dunno if this is the same issue, but someone found malware in their projector. I'm not sure about the accuracy since the report is blatantly AI generated: https://github.com/jrm360seclab/aodin-vo1d-malware

If the hardware is good and cheap, it should be a fun project to replace the OS with a custom Android build that is clean of adware.

Do you have a link to the projector?

https://a.co/d/0fnDxZAG

You forgot to drink a verification can

I mean, did you have to connect it to the internet though? Did it not just have a dp/hdmi port?

I'm still trying to figure out why you didn't see that coming.

Upon connecting it to the internet…

I hesitate to blame the victim here, but why on earth would you do that? “$40 Chinese-made” didn’t give you pause?

To be fair, everything is Chinese made. I would be even the Apple TV and NVIDIA Shield are made in China and if a state actor is determined to get a malicious payload in....

To play devil's advocate, when someone says "Chinese made" they're usually well aware of your point, and are more using it as a common way to describe product mills spitting out countless devices with dubious quality or configuration.

Of course theres good products made in China, and plenty of entirely Chinese brands killing it doing their thing.

its pretty straight racism though.

its US software companies that are the worst of the worst in terms of adware and malware being shipped under monopoly control

It's not racism at all to be weary of (any) political system, its overreach and the incentives of the people living in it, be it China or America or Russia.

The word racism is vastly overused these days.

> its pretty straight racism though.

It's not. Firstly, because countries aren't races. Second, because it's just a leftover from a time where that was a good heuristic.

Its based on the most common heuristic people have developed in regards to the phenomenon. What do you think about 'alphabet soup company' instead, referring to the tendency for names to be a mix of random letters? Otherwise, you can try and create a better term for 'unaccountable third parties using US platforms to dodge liability for their product made out of the cheapest components and software possible' and see if that catches on.

Yes it is also the US companies that are a problem but these are two separate problems and need different terms.

There's enough evil malware provider blame to go around.

Made in China and random Chinese brands are two very different things

Often they're exactly the same things

Often the USA brand is just buying the random Chinese design from the same factory that brands it in random letters, and tripling the price.

if you think the Apple TV or Nvidia shield example applies to this then I don't know what to say

> To be fair, everything is Chinese made

Yes. Chinese manufacturing is quite a phenomenon, useful and everywhere

But to be completely fair, a $40 video projector has a warning label. The price

You can put a bigger price tag over it. It won't be any better.

This isn't about state actors though. There's a world of difference between a name brand (possibly even a Chinese one) versus what I would term "chineseum". It's nothing to do with China per se and everything to do with purchasing from the extreme low end of the market. It just so happens that the vast majority of that segment is manufactured in China at present.

I think normally when people say Chinese made in this way, what they're really communicating is that there's no (meaningful) brand. All they know about it is that it is from China.

My Samsung phone is made in Vietnam.

This is an age where even teacups demand internet connectivity to fetch firmware updates

Finally, a legitimate use case for HTTP 418…

and they thought it was an April Fools joke, hah!

And then what happens if someone accidentally pushes the saucer firmware to the cup update?

https://hackaday.com/2022/03/18/welcome-to-the-future-where-...

I believe the correct behavior can be inferred from the RFC:

https://www.rfc-editor.org/info/rfc2324/#section-2.3.2

You get a Saucerfull of Secrets :-)

I mean I get why my cups need frequent java updates, but still.

And yet, it is now still just as stupid to do it as it was before we arrived here.

...firewall it then?

> Upon connecting it to the internet,

I dare not ask why you would do such a thing, instead, I will simply ask if you now think the reason was good, and I will hint at you that if the reason was "convenience", then you should answer "No".

The streaming sticks the article is discussing basically need network access to function. They might support streaming from local media sources and file shares too, but that is also done over WiFi. Unless you have a properly firewall controlled home (very few people do, I'm pretty nerdy and most devices on my network can just NAT to the outside these days) then just giving it a WiFi connection gives it access to the wider network from your location.

You'll probably find the projectors are pretty much the same hardware and OS as the sticks except with the projection device added where the stick just has an HDMI output. It might have HDMI-in too so it can just be used as a screen for another device, but there are definitely some units out there that are network-play-only.

You aren't wrong about giving cheap crap like this access to your network (and via that the public network) is risky, but that convenience you (and I) would say no to is exactly what they are bought for.

You assume a lot of things, sometimes you have to connect it to the internet for it to work (such as robovacuums)

Why in the name of all that is holy would you need to connect a projector or vacuum cleaner to the internet in order for it to work?

Seriously, why do you think this is normal or acceptable?

This is bullshit needs to stop (and the scummy AdTech industry has a lot to answer for).

As far as I remember they mandate you connect to it in order for you to operate it.

We all know why, which is Adtech, but like cars or smart TVs, you as a customer either skip the entire segment or yield.

Vacuum for "convenience" of being able to turn it on with a phone.

I could actually see hooking up a projector to wifi to allow it to stream videos.

Capitalism!

At least in capitalism you have the choice to look for a malware-free alternative. 100% USSR, had it survived to the IoT era, would penalize you for not having a state-mandated surveillance device on at all times.

I agree fully with your assessment of USSR but basically any nation state with the power does such things.

Show me a COTS smartphone where the end-user can burn the OTP fuses for his personal public key, so they can have it boot their own custom signed firmware, and control exactly what runs in TrustZone's SW Secure World?

You can flash yourself GrapheneOS with your own keys for the bootloader. Then again "I can't make sure all manufacturers aren't in collusion" when FBI sues Apple and others (and fails) over suspects' phone access is quite different from "every device sold in the country must have government malware", as it is in China.

I can't find a device in the USA that doesn't come with government malware. Is this another instance of the USA accusing China of everything the USA is doing (like with the credit scores)?

You'd have to be a bit more specific of which government malware you found in Android/iOS devices, cause that would be interesting

Android comes with something called Google Play Services, and iOS has a thing called iCloud. You may have heard of them.

I have, I still have not heard how the US government uses these as malware, but I would love to learn something new

For instance, if you use an Apple phone and the government wants to see the pictures you took, they can just get a copy of them from Apple using iCloud.

Yes, using a warrant from a court. If the government wants to break into my house they can also do that with a warrant. Not exactly the same as having a key to my house though, and very far from a malware.

Also to be more specific, In apple ecosystem I can opt for encryption where they can't

In the UK you can't opt for encryption.

You still can install PGP/GPG and encrypt whatever you upload yourself.

Still waiting for anything comparable to what China does.

> Still waiting for anything comparable to what China does.

Social credit scores. The USA inspired China to copy them. But in the USA they aren't called social.

You're free to opt out of icloud/gcloud and the government will have a tough time extracting the pictures from your phone, as multiple lawsuits have shown.

Without my encryption keys, which Apple doesn’t have? Don’t think so.

Please tell me how with Advanced Data Protection on they can access my data. I’d love to hear it.

show me anyone outside of HN or XDA devs that would ever want to do that

> At least in capitalism you have the choice to look for a malware-free alternative.

In the US capitalism, can you find a mobile phone OS that respects owner freedom?

Chinese!

Chinese capitalism!

Communism with Chinese Characteristics

Absolutely, there's no scam outside capitalism!

Outside of capitalism is outer space, so your snarky comment is actually true.

I think he meant the other kind of "outside", not physically. Plenty of bad stories.

Of course, every socialist country is actually capitalism and that's why it fails.

Which country is socialist?

Get the sarcasm, but of course there is scam outside of capitalism. Its just that the capitalistic model almost turns it from an inconvenient bug into a mainline feature.

Not saying there is an absolute perfect alternative, anyone who says that is usually shoveling smoke, but there are flaws with this economic model to be addressed.

Not true at all. I'm from Poland which was occupied by communist for a long time, and I can guarantee you - the amount of scam we had under that rule was orders of magnitude larger than what we have now.

Yeah I did forget about that. When you flatten the pay structure across the board, it makes bribes and scams so much more desirable. But also, communist structure in practices is sort of the total opposite of capitalism at a distance.

It was said that Karl Marx was completely right about Capitalism and completely wrong about Communism. And that is fairly accurate, both have big flaws.

Most times, the opposite of one bad idea is another bad idea.

I think it's really far fetched to say capitalism is bad idea. It's great system, it has some problems, but the upside is so big and alternatives are so bad that it's really unfair to call it bad system.

I think that encouraging corporations to destroy our environment (e.g. climate change) as fast as possible to maximise profits is a very good reason to call it a bad system. Yes, some goods and services become much more efficient, but now we're all going to have to pay the price for it.

Like the current never-ending heat wave. It's predicted to go on for months btw and the ocean is 4 Kelvins warmer than it should be.

Yh, the end of civilisation is a good thing after all, so enabling greedy fuckers to accelerate all life on Earth ever more rapidly towards destruction has to be good ...

Civilization is thriving and we are living in the best times (thanks to capitalism).

Reply on news.ycombinator.com