GamersNexus and LG: Or why rooting your TV is a bad idea

So even IF that would be a sufficient answer in a court of US, it would not be sufficient in a court of an EU country.

--> Hence my point on how the overall message was diluted too much.

See, you may look at all this as "nothing can be done anyway, so let's bunch it all together and rant about it as emotionally as possible". But I look at it as "this is all potential evidence that a law was either already broken or needs to have a loophole closed"

But you won't get any of this done by spraying all over how normal this is and how everyone does it anyway. You get this done with a precise shot at ONE of them, concise enough to pin them down while aiming at the next one.

So there's the angle that US is lacking the proper regulation, and the angle that LG may have violated its ToS in the EU.

But neither of this is going to get pinned down if everything is bunched together without focus and clear evidence...

May i suggest basic home repair? Two techniques that work in many cases are:

- "welding" with a soldering iron, using cable tie as a filler rod. You'll want good ventilation and a sacrificial tip - epoxy repair putty

Superglue (cyanoacrylate) tends to give disappointing results on its own, but can be a good first step before putty. Putty can be reinforced with some kind of fibre. Never use cyanoacrylate with the welding technique (cyanide).

I don't love the model profusion that makes spare parts markets inefficient, but free markets are inefficient all over the place. Price in the externalities.

But vulnerabilities that can be remotely exploited without user interaction (CVSS grade 9-10)?

Usually, this happens after a bootloader unlock because then verified boot is disabled. You can still have a rooted device and not break verified, resulting in no warning. See: jailbroken iPhones.

I wouldn't say it's a solved problem. Just have to find an exploit that works with verified / attested boot.

And device manufactures are getting more and more restrictive here, too. Why do you think that is?

> Let's pretend there aren't plenty other ways they could spy on you.

Sure, of course there are other ways to spy on people. But as we see here: If the device itself does it, then we like to blame LG. If they used an exploit to do that, then we blame LG's shitty security.

If a hotel owner installed a microphone inside one or their specific TVs, then we blame the hotel owner at least - not LG.

> If it's bad if a hotel does it, why is it okay if LG does it?

It doesn't seem like it is okay. We are discussing this right here.

> Do you honestly trust LG, and the thousands of "partners" that they sell your data to, and every government whose warrants they have to honor?

Do I trust LG more than a shady hotel / BnB owner or eBay seller? Yes. Do I trust them fully? No. It's not fully binary, I'd say.

> Your argument reduces to "if the warden lets us out of our jail cells, who will make sure we behave?"

I am just trying to say, it's really not that binary. You can extend that to other places whenever attestation is involved.

Do I like Linux and open platforms? Sure! Tampering is fun! Do I hate people using open platforms to scrape my websites and constantly cause load, steal my content and use that for AI training? Also, yes.

But how can I fight that? We run into CAPTCHAs, Cloudflare, Anubis and co. Now that issue is reduced, but the openness is also gone.

And you always see in tech spaces we rather want "dumb" devices rather than smart devices, because we cannot trust them.

Attestation buys you more trust, but at the cost of openness.

Compared to, say, random Magisk modules or some random crap the OEM developed?

Did you read and comprehend the rest of my statement?

I'm trying one more time. I'm not arguing against you, maybe read this again in a few hours:

I believe you want to have full control over the device you own (like I do btw).

For this you need to acknowledge that right now it is not in the interest of any party to provide that, because it requires additional effort, carries additional risks and doesn't create an economical benefit.

You have to MAKE it the interest of ANY party in the chain (the manufacturer, the seller, the consumer, the lawmaker,...).

Being an angry consumer is not getting you there, asking people to "vote with your wallet" is not getting you there.

--> Why? Because you won't reach a critical-mass of consumers to move the needle for the manufacturer to notice and take action.

Creating noise on security issues and potential hacking won't get you there.

--> Why? Because IF it creates ANY reaction, the public reaction will be to hold device-manufacturers responsible, which (if it works!) will cause them to just spend more effort to lock down their products even more, secure the trust-chain in the OS and simply stop operation when it is broken at any point.

Trying a mix of topics by mangling everything together, to create as much noise as possible? It will not get you there.

--> Why? Because even if that noise is creating a critical-mass, if it's not based on a sober solid foundation with a clear demand, it is not actionable and will die down. Everyone knows that this will happen and affected parties will count on that.

So. What GETS you there is "artificially" making it the interest of the involved parties, STEERING the manufacturer into the desired direction.

How do you steer things if the sheer economics don't do it?

(I don't know your experience, so YMMV from here)

From my experience, the only sustainable way to achieve this is that you literally regulate it, by demanding a LEGAL requirement.

e.g. Pushing for regulation to provide the user full control over the product if he wants it, acknowledging that the process reduces the responsibilities of the manufacturer for that device.

You do that by finding as many reasons, as much evidence as possible that this is a solid direction: Security concerns, environmental concerns/waste elimination, "ensuring a free market",...

--

So how do I know that?

Because I LIVED through it already (with many other active people in the scene), trying to make bootloader-unlock and community OS a default thing on Android Smartphones.

We amplified the topic when the industry was still new and growing, created more noise than there actually was, riled up journalists to act like this is a crucial buying decision for the market, lobbied the whole industry, to a point that they actually made it a competitive feature.

Doing all that against a juggernaut of interests AGAINST it (in US e.g. Verizon, which never bulged, vendors with concerns about unjustified warranty-claims, journalists/users stating that this is weakening security, etc.)

And what happened? It all died down because we didn't use the momentum to get it into a regulation when there was the chance. Some fruit-company demonstrated over years time and again that this doesn't matter, then even turned it into a marketing-feature to NOT give full control to the user.

Meanwhile the momentum and interest in the market died down, and for the past years we started to lose bootloader-unlock again in many brands, without any notable impact on their sales.

So if we have to do it again, in a matured market (like TV is), how do we do it now?

Again, YMMV, but for me, having lived through that already, the only viable way is regulation.

Regulation which demands a solid trust-chain in control of the vendor, AND the possibility for the user to unlock it to take control over the device.

Anyway. Peace.

That nuance is important if you value good journalism.

Otherwise if we're just our here throwing random allegations because "corp bad", might as well say LG 's TVs are turning the frickin' frogs gay.

And to be clear, I'm not defending LG here. Their terms and conditions are terrible, 'We know who's in the LG household… we own the glass' is not something that should be said by any appliance company and shows a clear lack of ethics. But if someone is going to make a video explaining what's happening it's better to stick to what LG is actually doing instead of listing potential issues without making it clear.

A rooted tv by definition has less security, if you show that you can record because you have full control over the device that only shows that there's no hardware block for the mic (which most devices in existence don't have, apple, Framework, pinephones are the exception there). It's not in anyway different from most phones and devices that people use in daily life.