Hacker News Reader

Comment by ryandrake | Hacker News Reader

To me, it's not even about why they're doing it (building an advertising profile). I don't want them doing it at all, for any reason.

When I buy something from the store, my relationship is between me and the store, for the 30 seconds it takes for me to pay for it. I don't want an ongoing relationship with the device manufacturer. I don't want to be tethered in any way to the manufacturer. I don't want to have an account with the manufacturer. I don't want the device sending anything to the manufacturer, advertising related, telemetry, or even a single bit "user has used your product." Do you get it, manufacturers?? I don't want any kind of relationship with you! I want to purchase my product and use it by myself not with you.

View on HN

> I don't want an ongoing relationship with the device manufacturer.

I think it depends on the device. If I buy an iPhone, I have the expectation of installing apps on it after purchase, and that necessarily involves a relationship with the app store provider (ie. Apple), not the store I bought the phone from.

With a TV, I suppose it depends on whether I want to install media apps like Prime Video or Netflix on it. I understand that there will be people who don't want that, in which case I agree with you. But others want to be able to run this stuff somehow, whether it's directly on the TV or via some HDMI device like a Chromecast or a Fire Stick. At that point, they _do_ want a relationship with some hardware manufacturer so that the third party app can be delivered to run on the hardware.

> If I buy an iPhone, I have the expectation of installing apps on it after purchase, and that necessarily involves a relationship with the app store provider (ie. Apple)

This is only true because Apple dictates it to be so. The manufacturer of the device should not have a say in what I choose to do with a device I bought. I should be able to install software on a device without asking the manufacturer for permission. Why do they think they should have an opinion? After I purchase the device, it's mine, not theirs. I can throw it off a cliff if I want without asking for Apple's permission, why can't I install software on it?

> At that point, they _do_ want a relationship with some hardware manufacturer so that the third party app can be delivered to run on the hardware.

The device manufacturer should not need to be involved with a user's decision to install software. There should not be this requirement to have a relationship with them. We should never have allowed this idea to be normalized that the device manufacturer needs to be somehow have a say, let alone be the sole path to using the device.

Device manufacturers should sell devices and then get out of the way of what the user is doing with those devices.

I mostly agree, although if the manufacturer has a catalog of software (which they have managed to check for quality, classification, etc) that you can optionally use for installing software (which others can also choose to do, e.g. in the case of Android there is also F-Droid), but that you can also install anything that you want to do by yourself (including software that you wrote by yourself) without needing to be able (or willing) to contact (or have anything further to do with) the manufacturer (for any reason), then it can be helpful.

Also, if someone provides a service (e.g. Netflix) that some might want to use and some might not, then you have the option to use that service might be helpful but even that should not require any relationship with the manufacturer unless they are also providing the service. If the manufacturer is separate then they should not have anything to do with it (e.g. they should not add a button on the remote control specific for Netflix; if they have user programmable buttons that you can add your own labels, then it would be possible to use such a thing like that if the end user decides to install Netflix). (There are other problems with Netflix too but I am ignoring them for now because that would be a separate discussion.)

When I buy a computer, I have the expectation of installing apps on it after purchase, and that doesn't necessitate any relationship at all with any app store provider of any sort (ie. Apple).

(When I buy a pocket supercomputer, I have that same exact expectation. It's often left unsatisfied, but I still have it.)

The trouble is that we haven't figured out a trust model that works when we do exclude that relationship. The traditional Windows "run setup.exe" model is terrible for modern expectations of security. The alternatives available today are still very far behind the safety that ordinary users get today when they do enter a relationship with the manufacturer. Unless you're an expert and not a typical consumer.

So there can only be one extreme or the other extreme?

There's no possible world in which a gate can be installed in the wall of the garden?

What does that gate look like in practice?

A sternly-written, notarized letter of indemnification? A bizarro-world sequence of events (like activating Developer Mode on Android)? A game of Galaga which, if played perfectly, unlocks the gate just as doing so unlocks the black car in Ridge Racer on the PSX?

I don't know. It's a gate that allows a person to leave the garden. It exists to be opened, and to be passed through, and also to be closed again -- or to be left open. :)

(The UAC prompt in Windows is also a gate, if existing work is to be studied.)

I know what a gate is for. My question was trying to get you to explain the middle ground between the extremes. That it is hard to visualize/imagine is kind of my point. The UAC prompt is an excellent example of a potential middle ground that is definitely a gate but a near useless one.

I certainly want the gate. I just acknowledge that some kind of relationship with the hardware manufacturer for the benefit of the ordinary consumer is the best that the technology industry can offer right now.

Skill issue. Especially these days. What a cop out.

> I think it depends on the device. If I buy an iPhone, I have the expectation of installing apps on it after purchase, and that necessarily involves a relationship with the app store provider (ie. Apple)

I bought my Pixel from Google and don't want any relationship with Google whatsover. In fact, I wiped the stock OS and installed Graphene for this reason. My apps come from various sources, none of which is Google.

> If I buy an iPhone, I have the expectation of installing apps on it after purchase, and that necessarily involves a relationship with the app store provider (ie. Apple), not the store I bought the phone from.

That's because Apple supplies both the hardware and the software. Being a software supplier - the only such supplier - they need to keep being involved. This wouldn't be the case if third-party OSes existed for the iPhone - it doesn't need to be the case for M1/M2 MacBooks, for example, thanks to Asahi, or for any x86-based hardware.

They don't need to be involved. They force it on people and people are making a judgement call and a trade off that the upsides outweigh the downsides. That doesn't mean it's right or that people are happy about it or that it needs to happen. That would just be an appeal to the status quo.

Wait your saying it’s not cool if you buy carrots from the grocery store that have embedded sensors so that when you eat them and they pass through you they build a health profile and determine what types of supplements are best to advertise to you?

Then what about all the cloud enabled spyware? How would that work? (/sarcasm)

Truly though, smart-home stuff runs the whole gamut of privacy and device manufacturer relationships. eg: I have used three different smart/room AC units:

- one requires its own cloud-enabled app for any remote connectivity, no HomeKit integration - one integrates with HomeKit but then leaves an upgrade hint that can only be done through an app with a login - one integrates with HomeKit and pretty much just works

HomeKit then allows me to remotely control via HomePod/AppleTV acting as a router ... of course this is just a different cloud connectivity but with on-premises devices controlling other on-premises devices.

For each manufacturer of smart devices, there is potentially a separate cloud where data is being funneled through. Some devices support multiple upstreams.

I get that Matter should be a way to fix it but the reality feels more like https://xkcd.com/927/

Part of me just wants dumb devices back. Get rid of buttons on a microwave (just give me a knob for time and maybe another knob for power setting.) Remove touchscreens from cars (mine glares at me with certain sun-angles.) Bring back the desktop/computer hutch and phones that don't live in your pocket. However, having the ability to start cooling my bedroom 45 minutes before I arrive home is ... pretty compelling too.

Manufacturers just need to realize that LANs exist and allow their devices to be used with the Internet turned off.

When I'm sitting in my home and I want to turn off the AC unit in the other room or close my garage door, there's no reason I should have to do an IP roundtrip to the manufacturer's server. Both devices are on my LAN. They should just talk to each other. This has been a solved problem for decades.

I have been toying with the idea of building some kind of "home cloud" that hooks into all of your smart devices (at least all of the open devices that it can), allows photo backups from mobile devices, idk. Stuff like that.

Something you can just scan a QR code with your phone and it hooks it into your backups so your "cloud backup" is sitting in your utility room at home instead of being "someone elses computer"

Obviously this is all achievable by a savvy techie, but I'm thinking along the lines of a black box any idiot can use.

The idea is very appealing to me, I would love to decentralize "the cloud" for your average person.

And if it were possible to get one of these in every house and apartment, then the idea of a "smart home" starts to really click in ways it doesn't right now. Your smart home would have a "home cloud" box that acts as the brain

Idk. I think there's a product idea here somewhere but ultimately it's just something I'm kicking around now and then.

Lowest common denominator? They have to round trip due to various NAT/router/firewall/App BS.

Your average ‘idiot’ can barely get a managed App to work, and that typically requires some kind of cloud endpoint to co-ordinate.

Other stuff is the land of prosumer.

You only need an external server if you want to make it so the end user can access their device remotely. Otherwise, an app can very easily just scan the network for the device. Heck, the app itself could be the thing that sets up the device on the network in the first place.

Remote access should also be do-able without having a manufacturer-run server. We over-complicate things with NAT and with ISPs sabotaging inbound connections to our networks. At least with IPv6 every device on my network is addressable by the outside world, and I can (and should be allowed to) make the decision about whether they are accessible. The device manufacturer should not have to insert themselves into this conversation.

I guess the question is, better or worse?

Remote access without the central server seems to make direct attack easier?

users sometimes end up with some combination of the above:

1) multiple wifi networks 2) ‘guest mode’ wifi networks (you can’t communicate to other devices on the same network) 3) various airplane mode type scenarios where they have cellular but not wifi connections semi-randomly, even on the same property/area.

these all happen with out of the box ISP setups pretty regularly, btw.

and they’ll just blame you for the flakiness.

also, for most of them, they love remote access anyway and don’t want to consider the security implications.

I have a Vizio TV that was advertised as a Chromecast TV, and I got it because of that. It was HDMI and Chromecast only. A few years later they did a silent update that added apps and generally made the UI much slower. I mainly use it with an AppleTV or game consoles, but it still irks me that they completely changed what was in my mind a nearly perfect TV.

Can you factory reset it to the prior state and turn off updates?

(I know this doesn't change what Vizio did, but it might get your perfect device back)

Why was it connected to the network?

Chromecast requires a network

They realize. They hate it and wish it would go away. LAN connectivity makes it really hard to spy on you, inject ads, require subscriptions, and brick perfectly functional devices so you have to buy new ones.

No it doesn’t? They can do all these things just fine over a LAN connection (assuming it routes externally).

If you can firewall your LAN - you can also firewall your WiFi.

Except some of the TVs try to connect to unprotected hotspots, or piggyback through ISP's routers' hidden secondary SSIDs. Which even opens people's data and ambient conversations finding their way to the manufacturer or advertisers through war-driving.

name one.

I think it’s currently a theoretical issue, not a proven one. Do you have any concrete examples?

IMO, the moment a device starts doing that, I’m setting it on fire.

“If you can firewall your LAN - you can also firewall your WiFi.”

Huh? Your WiFi is (part of) your LAN.

That’s what I’m saying, yes.

Ok, I don’t understand your point, then. If a device works locally then you can firewall it and block any nasty stuff phoning home. If it runs everything through the manufacturer’s servers then you can’t firewall it without disabling it entirely.

Read the thread. People are saying ‘if it connects to the LAN it’s safe’.

I’m pointing out safe or not has nothing to do with it being on a LAN or not.

I’m completely lost. I’m not talking about safe, I’m talking about how routing everything though a server gives a lot more control to the manufacturer and they’re loathe to give that up.

I’m pointing out that has literally nothing to do with LAN or Wifi. It’s a problem with having literally any (unfiltered) network access at all. Though even filtered, you’re susceptible to bypass attacks.

Notably, a device can even route all command and control through a cloud service, including sending copies/hashes of all accessed content AND also serve just local (as in physically connected) media/content, if it has a network connection.

This has been an issue since BluRAY at least, where players have the capability to check physical media licensing and deny/brick BluRAY media based on network updates of the keys, and could run Java apps which had network access. So at least 20 years? It is a big reason why there was resistance to BluRAY vs DVD, as DVD was a relatively dumb player.

The only way to prevent that is to firewall off or physically disconnect any network access. Which is getting harder to do with cheap LTE modems.

In this example, for instance, I bet these LG TV’s will happily send all this info even if no one is using any network or app based media streaming at all.

And if everything goes through the manufacturer’s servers then you have to give it internet access for it to work at all. If it works over then LAN then you at least have the option to block it without disabling the functionality.

Again with the ‘works over the LAN’. What do you think that actually means, because I keep explaining that doesn’t mean what you seem to think it does, and then you keep repeating it in a context which doesn’t make any sense.

It means that my device at e.g. 192.168.123.45 can be controlled by my phone or computer at 192.168.123.46 on the same LAN without any of the traffic going over the internet. And since none of the traffic goes over the internet, the device can be completely blocked from internet access without disabling the ability to control it.

I'm not really sure what the disconnect is here. This seems like the obvious meaning of "works over the LAN" and it means, by definition, that you can control the device without letting it access the manufacturer's servers.

You’re saying ‘works behind a firewall’, or ‘works without an internet connection’. Maybe ‘works on a fully isolated LAN or VLAN’?

A LAN (or WiFi) typically has routability to the Internet (though doesn’t have to, of course!) which is why what you are saying is confusing. It has for at least 20 years, and is especially true in residential, but also true even in commercial.

Those some IP addresses could also be NAT’d, and often are.

Most modern products have also spent significant R&D figuring out how to bypass NAT and firewalls and even hide from packet inspection (tunneling DNS and command and control over HTTPS, for one example).

Very few people are able to handle or setup actual air gapped LANs now (or isolated VLANs), but anything besides that is risky in these scenarios.

I was replying to “Manufacturers just need to realize that LANs exist and allow their devices to be used with the Internet turned off.” If it took you this long to figure out what I was talking about, I don’t think it’s really a problem with my description.

So weird, it’s like you refuse to read my comment and keep replying with the part of your comment which ISN’T that part, and then act like I’m the problem when I point out you aren’t making any sense.

Are you real?

Your comments consist of two parts. 1) telling me that I’m wrong because you insist on not understanding what I’m saying 2) a bunch of irrelevant stuff based on not understanding. So yeah, I’m replying to part 1 and ignoring part 2.

So what, praytell, does LAN have to do with your comment. Since I was pointing out, that it was the ‘turn off the internet’ part, not the LAN/Wifi that mattered. And that was the part that you kept ignoring.

What does LAN have to do with my comment about why companies don’t like to let their devices talk directly to my phone/computer when they’re on the same LAN?

Jesus. I give up.

Reply on news.ycombinator.com