6 ms·
Nearly half of LG smart TV apps contain residential proxy SDKs
- mfro 3mo agoTruly despicable shit from these manufacturers. Don't buy smart TVs, or block their network access if you must.
- bdcravens 3mo ago[dead]
- knollimar 3mo agoThis feels straight out of Silicon Valley (show)
- bigfishrunning 3mo agoIt also feels straight out of Silicon Valley (place)
- cj 3mo agoI imagine most smart TVs don't support multitasking or apps staying alive in the background, hopefully?
- microcode 3mo agoThe consent screens say that they "may continue running in the background after you close the app".
- dotancohen 3mo agoWhy would you imagine that? Which non-multitasking OS do you think these devices are based on?
- deleted 3mo ago[deleted]
- tumdum_ 3mo agoFor example OS running on Amazon fire stick 4K kills your background processes after ~20 minutes.
- cj 3mo agoSpecific to LG tvs: https://webostv.developer.lge.com/develop/getting-started/app-lifecycle?utm_source=chatgpt.com https://webostv.developer.lge.com/develop/getting-started/ap...
- dotancohen 3mo agoThank you. One of the app states mentioned is: > Suspended : The app is suspended in the background.
- cj 3mo agoAnd the next sentence says this: > The app can be suspended for a short time Short time, short lived, not long running. That doesn't make it okay obviously, just means the blast radius is limited.
- dotancohen 3mo agoI disagree. All it takes is one questionable HTTP request for CP or terrorist related materials to begin an investigation. Or, heaven forbid, pirate a Metallica album.
- cj 3mo agoI agree with your disagreement. Even though I’m the one you’re disagreeing with.
- andai 3mo agoI've always have a deep, instinctive revulsion for smart TVs, but every year I read of some new mandmade horrors beyond comprehension, and it escalates by a few more points.
- thewebguyd 3mo agoSame, but for "smart" anything in the home that requires an internet connection and does not let me set it up or run it LAN only. People forget the reasons TVs got cheaper is because smart TVs are heavily subsidized with ads and your watch data. I have the most "low tech" home of any of my peers, intentionally.
- drnick1 3mo agoThis. The only "smart" things allowed in my home are those under my control. This means devices that work over Zigbee, or that that run free firmware natively (like ESP32-based devices), or that can be hacked to run free firmware. Everything is orchestrated via Home Assistant and in its own VLAN. It's surprising how far you can get. For example, I recently set up a voice assistant by wiring together a few Home Assistant components and a small local LLM (Qwen 4B). Response times are basically on par with commercial solutions like Alexa, and all processing is done locally.
- microcode 3mo agoThe experience with this is so much better. Hacking most Tuya based devices has become extremely easy when you use https://docs.libretiny.eu/ https://docs.libretiny.eu/ Replacing MyQ with ratgdo was one of the best IoT decisions I have ever made.
- layoric 3mo agoComing for PC monitors as well, LG again leading the charge.. see "smart gaming monitor", same BS.
- 201984 3mo agoThis needs to be illegal.
- pocksuppet 3mo ago[flagged]
- 201984 3mo agoI cannot think of a legitimate purpose for residential proxies existing. They take advantage of people who don't understand what they're being asked to give "consent" to, and then offer up those people's internet connections to whatever actor wants to abuse it, including malware authors, aggressive scrapers, and anyone with ill intent. Why do you think this rampant abuse is a good thing? What benefit does this provide to society?
- wmf 3mo agoAlso these proxies are against the terms of service of every ISP.
- pocksuppet 3mo agoso are bittorrent, nginx, and tor - nobody actually cares. In some countries it's illegal to install nmap.
- pocksuppet 3mo agoThings don't become illegal just because you can't think of a "legitimate purpose"
- deleted 3mo ago[deleted]
- gruez 3mo agoWhy? The only thing that's vaguely objectionable is the fact the consent screen's wording of "download public web data from the internet" omits important information on what's actually happening and the associated risks. Otherwise I'm not sure how you can come up with a principled justification of the ban beyond just "AI scrapers bad" or "hiding identity". Tor relays and VPNs are basically doing the same thing, except with clearer disclosure about what actually goes on.
- refulgentis 3mo ago12 minute article. 70% AI. The only content not flagged? Copy and pasted PR comments. Invisible Unicode characters, triads, unnecessary markdown. Good work, obviated by bloviating. Readers dropping off near-instantly. A company leaving a slop trail behind its wake. AI DDOSing should be shameful. https://www.folklore.org/Saving_Lives.html https://www.folklore.org/Saving_Lives.html
- jonhohle 3mo agoIt’s exhausting. It’s like every article is written by the same author and that author is also your coworker and personal assistant and also moonlights as Brian, a waiter at Chotchkie’s.
- duckfruit 3mo agoExactly. This is like that Sci fi show where the whole world is taken over by an alien organism and everyone you meet is basically the same one person. The AI is also off-puttingly nice, just like the alien.
- Retr0id 3mo agoThe page has scroll hijacking, too.
- tantalor 3mo agoHere's a bookmarklet which fixes that: javascript:(function(){const e=['wheel','mousewheel','DOMMouseScroll','touchmove'];e.forEach(e=>{window.addEventListener(e,function(e){e.stopPropagation()},{capture:true,passive:true})});const t=e=>{if(!e)return;e.style.setProperty('overflow','auto','important');e.style.setProperty('overflow-y','auto','important');e.style.setProperty('overflow-x','visible','important');e.style.setProperty('scroll-behavior','auto','important');e.style.setProperty('position','static','important')};t(document.documentElement);t(document.body);const o=document.createElement('style');o.innerHTML='html, body { overflow: auto !important; overflow-y: auto !important; scroll-behavior: auto !important; position: static !important; height: auto !important; } ::-webkit-scrollbar { width: 12px !important; display: block !important; }';document.head.appendChild(o);})();
- cube2222 3mo agoI think it’s worth emphasizing that based on the article, those are third party apps, not first party LG apps. Based on the headline I thought it’s the built-in apps.
- mycall 3mo agoThis does raise the question if other Smart TVs with the same third party apps have the same issue.
- OkGoDoIt 3mo agoIn the article they mentioned that Amazon and Roku block apps from using these SDK’s, and specifically after Roku recently made a change to disallow this kind of thing, many of the affected apps were withdrawn from the Roku app store. The implication is that those other smart TVs don’t have the same third-party apps because these apps were specifically created to act as a foothold for these residential proxy networks.
- HDBaseT 3mo agoThe LG WebOS Store is a different beast. Just browsing the list of apps raises eyebrows for even the most non-tech audiences. 99% of it is spam, with maybe 1% being well known apps like YouTube. The rest are weird IPTV Players, Wallpaper apps. It feels like a portal into 2009 apps, but its not.
- wowczarek 3mo ago2009 indeed. Their app store was an absolute cesspit even in the early, pre-WebOS days and it hasn't changed much since, like, who would install any of this and why? Even the "official" app selection isn't the best. OS aside, they are pretty good TVs and quite popular, so I find this mind-boggling.
- MoonWalk 3mo agoVizio was caught taking screen grabs and sending them to a server a few years ago.
- gruez 3mo agoThis turned out to be more ethical than I thought. I'd thought there wasn't any consent at all, or the actual mention of proxying was buried in a 20 page EULA.
- OkGoDoIt 3mo agoYeah, this does seem somewhat reasonable. I get that most users will probably accept it without thinking twice, but if you’re going to do something like this, this is at least a fairly upfront and consenting way of doing it. For the TV platforms where this isn’t allowed, you have to wonder if apps are still doing it but just completely secretly, and trying to hide their tracks as well.
- lukax 3mo agoWell, that's how data for training LLMs is scraped.
- brikym 3mo agoAnd price comparison sites big companies don't like since they want to price discriminate. There are positives to it.
- handle584 3mo agoNot only this, it also enables sneaker/pokemon/5090 scalping, Chinese/Russian using ChatGPT/Claude. A residential IP in the US is very valuable elsewhere.
- doublerabbit 3mo agoWalked past a TV and it was advertising a security guard. Why does a TV need security software?
- dewey 3mo agoBecause most people (HN is not a representative sample set) are not willing to pay the real price of a TV if it wouldn't be subsidized by adtech.
- bigfishrunning 3mo agoIt's been a very long time since they were given an option.
- HDBaseT 3mo agoI'm not sure the adtech is even enough to subsidize the price in a meaningful way. Google’s global ad revenue equates to roughly $61 per user per year, most TV manufacturers would be unable to extract that much out per user, even with crazy levels of tracking, ads, etc. I haven't used a modern TV in a very long time, but I can't imagine LG is extracting over $20 in ad revenue/data revenue per year. It might move the needle on <$500 displays, but when LG displays costing over $5,000 still have this spyware its hard to defend.
- deleted 3mo ago[deleted]
- dewey 3mo agoWhat makes you think LG would not be hitting the Google numbers (Instagram ad-free is ~$6 / month for example, roughly the same ballpark)? A device that's connected to a high speed internet connection, often allowed to do background tasks and being able to track all data being consumed through it (Streaming services, gaming etc.) is extremely valuable.
- microcode 3mo ago
- captn3m0 3mo agoHas anyone reversed their SDKs to run a swarm that captures enough traffic to see what requests are actually getting made?
- pocksuppet 3mo agoIt'll be HTTPS but you might be able to know the website, if it proxies DNS or doesn't use ESNI.
- topranks 3mo agoA lot of web scraping. The ones that got KimWolf’d were/are doing a lot of DDoS (SYN floods etc).
- TurdF3rguson 3mo agoIt's not Smart TV apps specifically, it's all free apps. They have to monetize those somehow, don't they? And you get upset when you see ads, don't you? Basically it's either this or pay for your apps.
- tabwidth 3mo ago[dead]
- recursive 3mo agoNot sure if this is ironic, but I know it's possible for apps to exist without being monetized. I'm using Paint.net right now.
- TurdF3rguson 3mo agoNot ironic at all, and you want apps you use to be monetized because otherwise there's no incentive to support them. I feel like that's common sense.
- CursedSilicon 3mo agoTo parody the Arthur quote [1] Do you really think somebody would do that? Just go write apps for the love of programming and not to make money? [1] https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcRGIV3uj9NNbC3gn1aucYHvZPlC1tQir7WFnbcM9nAxFdlL2ZoSQAcYbm4&s=10 https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcRGIV3u...
- owebmaster 3mo agoYes it's possible for the apps to exist but not the apps programmers if they can't make money to eat
- bigfishrunning 3mo agoI pay for apps whenever possible, in some cases it just isn't. Also, you have to trust that paid apps aren't also doing this shit.
- zerobees 3mo ago
- pocksuppet 3mo agoGood. Fuck Cloudflare and other internet gatekeepers. Confuse their signal as much as possible.
- snowe2010 3mo agoHuh? This is almost assuredly being used for botnets… that’s not a good thing.
- pocksuppet 3mo agoBotnets to bypass Cloudflare. Nobody is using residential proxies for DDoS because incoming bandwidth == outgoing bandwidth.
- rustcleaner 3mo agoAgreed. Information wants to be free. I am sad nobody has a LOIC powerful enough to disable CloudF{lare,ront}.
- ortusdux 3mo agoMaybe Valve will make a TV next
- wmf 3mo agoPalmer Luckey said he might make a ModRetro TV.
- nekusar 3mo agoLOL I posted a few days ago with bullshit from LG smart TVs. https://news.ycombinator.com/item?id=48618246 https://news.ycombinator.com/item?id=48618246 I still do not know how the damned thing got internet.
- dupontcyborg 3mo agothis is a way smaller deal than acr. i personally don’t connect my smart tv to my network and use an apple tv instead
- rustcleaner 3mo agoNever ever connect your "Smart"-TV to your network, or if you have an incurable impulse to then make sure it's on a firewalled gateway-less VLAN. Take the money you save buying the thing (compared to what a profitable "dumb" version would cost) and buy a surplus corporate mini-workstation system, and slap LibreELEC/Kodi or whatever on it, and use that device as your "smart" device. No good for you can ever come from bringing the TV onto the internet... ever! (Also: never paypig, never subscribe!)
- lysace 3mo agoSurely they will just make it mandatory, at some point?
- MBCook 3mo agoI remember seeing reports a few years ago about some TV that would constantly complain if it wasn’t connected. I don’t know what brand it was.
- popcornricecake 3mo agoThe only time mine were ever connected to the internet was to update the software, and for that the easiest thing I thought was to host a temporary wifi hotspot (using a phone).
- rustcleaner 3mo agoMy concern is your telemetry may have been stored up to that point, then forwarded upon connecting.
- drnick1 3mo agoThis, but LibreELEC or other Kodi distributions suck. They are too limited. Until recently, the best solution was to run a full Linux DE, but now there is Plasma Bigscreen[0] for that. This is basically a DE optimized for couch use with a remote. You can run Kodi as an app, but also stream from a browser, or play games with Steam, etc. [0] https://plasma-bigscreen.org/ https://plasma-bigscreen.org/
- lbotos 3mo agoI'll get on my high horse and say you can get solid "DID/Commercial" TVs for not that much more: https://www.bhphotovideo.com/c/product/1788343-REG/samsung_qm43c_qmc_43_4k_smart.html https://www.bhphotovideo.com/c/product/1788343-REG/samsung_q... I got this a few months ago -- 4k, solid brightness, and ok color. Is it the OMG BEST? no. But I Disabled wifi, and even the channel display. I use it with an apple TV with CEC on the TV -- I turn on the apple tv, TV turns on straight to apple interface. I turn off from the apple remote, TV turns off. It's effectively "an apple TV" -- I'm happy.
- p0wn 3mo agoBegs the question - why has apple never come out with a TV.
- MBCook 3mo agoWhy should they? It’s an absolute cutthroat business with next to no profit margin. All you gotta do is add an Apple TV and you got everything they would give you. And they make nice margins. Apple seems to have next to no interest in making displays at all. We are lucky whenever a new one gets announced.
- gruez 3mo ago>Is it the OMG BEST? no. But I Disabled wifi, and even the channel display. Why not just get a (presumably subsidized) smart TV instead, and skipping the premium? It'd also be not disconnected from the internet, and despite vague HN/reddit speculation that TVs have cell modems in them, that has yet to be confirmed.
- wmf 3mo agoThe concept of consent-based privacy has completely failed, first with GDPR then this.
- xnx 3mo agoWhat portion of Fox's acquisition thesis for Roku was activating residential proxies (distributed AI crawling!) across all the units?
- kristianp 3mo agoIs bypassing scraping blocks the main purpose of these residential proxy networks?
- duskwuff 3mo agoYes. For instance, Bright Data describes itself, on its home page, as the "all in one platform for proxies and web scraping".
- kristianp 3mo agoFrom the article it can be used by botnets as well, linking to https://krebsonsecurity.com/2026/01/the-kimwolf-botnet-is-stalking-your-local-network/ https://krebsonsecurity.com/2026/01/the-kimwolf-botnet-is-st...
- duskwuff 3mo agoOh, I'm sure there's all sorts of illicit use as well. But scraping is what the network is being actively marketed for, and it probably amounts to most of their traffic by volume.
- HDBaseT 3mo ago"Publishes with the most proxy flagged apps" 1. Desoline (based in Netanya (Israel) 2. Bright Data (based in Israel) Interesting.
- smashah 3mo ago[flagged]
- smashah 3mo ago[flagged]
- throw468358 3mo ago[flagged]
- ewy1 3mo agowe all know what they meant
- smashah 3mo ago[flagged]
- throw477522 3mo ago[flagged]
- ctippett 3mo agoI absolutely adore my 2018 jailbroken LG OLED, although it pains me that everything I love about this TV are features the manufacturer actively discourages and wishes I never had access to.
- throwawa14223 3mo agoSo is there a residential proxy blacklist I can run on my firewall? Any action I can take as an admin to put a stop to this?
- topranks 3mo agoIt’s very tricky because the IPs are all on normal user ranges you can’t block without blocking those users. The company behind this blog - spur.us - offer some paid services I think. There is also this project from Wikimedia which uses that data to produce more manageable lists: https://gitlab.wikimedia.org/repos/sre/CIDERGRINDER https://gitlab.wikimedia.org/repos/sre/CIDERGRINDER
- whalesalad 3mo agoI have a few LG OLED tv's. I do not ever connect them to the internet - I just treat them as dumb hdmi/dp displays. One is driven by an Apple TV, the other is connected to a Linux gaming pc. Haven't had any issues at all.
- cullenking 3mo agoI just implemented bot and crawler detection as well as ASN based blocking for our website, because I’ve seen a massive rise in scraping coming from VPNs and other networks that mix legit and illegitimate traffic to our service. My theory is that small companies are scraping the shit out of everything and selling results to llm creators. It’s going to be interesting to see this expand into residential internet providers through holes like this… wild new world!
- 72027372920 3mo ago[flagged]
- NordStreamYacht 3mo agoI have my smart tv on a separate router and it's powered off most of the time. An accident of wiring.
- h4kunamata 3mo agoI have a 2018 Samsung QLED SmartTV, I use Pihole to block data collection and since it has Google DNS hardcoded in it, I use OPNSense Firewall rules to enforce any DNS request to Pihole. My TV has only one AD that no longer shows for years now, LG is ADs all over the place. My home setup allows me to have a smartTV without compromises it. Since it runs TizenOS, I can use my Linux PC to install remove apps from it like installing Jellyfin App so I do not depend on Samsung releasing it to the app store.
- hnburnsy 3mo agoTV never connected to internet, streaming box, and streaming box on its own isolated vlan (or guest network)
- londons_explore 3mo agoThis is a good thing. If you could anonymously proxy from anywhere to anywhere else, the internet would be region-lock-free and anonymous again, just like it was to support it's boom in 1999. Good on these guys I say. When it becomes normalized, we can integrate these 'privacy proxies' into desktop and mobile OS's too.
- jhartikainen 3mo agoGood point, hadn't thought at all of this kind of perspective. Though the fact it's some dodgy residential proxy provider that runs this stuff makes me feel like it isn't going to become available for something good.
- ThePowerOfFuet 3mo agoSo you think until someone breaks your door down because of something sent from your connection.
- topranks 3mo agoNah it’s messing up peoples home internet, and massively abused to perform denial of service attacks and scraping of web content by large AI companies who are otherwise blocked. Your vision of a randomly-routed mesh internet overlay is also not very scalable bandwidth or latency wise.
- tulio_ribeiro 3mo agoLG’s guidelines state: - “Your app should only collect the minimum user data required for providing service and should avoid collecting unnecessary data.” - “LG performs security reviews on submitted apps before distribution, using the vulnerability analyzing system.” - “All app developers must complete and submit well-defined and comprehensible data safety information detailing collection, usage, and sharing of user data.” They explicitly classify the "IP address" under Device Identifier Information. https://webostv.developer.lge.com/develop/guides/privacy-guideline https://webostv.developer.lge.com/develop/guides/privacy-gui... Blatant lies.
- memcg 3mo agoIs there enough 4K content available to justify replacing an older Samsung 1080P LCD? I still find free TVs on Craigslist. When I see 4K TVs running in demo mode at Costco I'm impressed, but at home watching World Cup over the air or on Fios at 1080P looks good enough. I don't pay extra for Netflix 4k and most Fios content is not 4K.
- manbart 3mo agoAnkther example of why "Smart TVs" are peak enshittification
- shellwizard 3mo agoYep, never connect them to the Internet, ever
- mikestew 3mo ago”The researchers recommend that TV platform operators adopt clearer policies for proxy SDKs, require more prominent disclosures, and provide users with greater visibility into how their network connections are being used.” “Recommend”, eh? I’m sure they’ll get right on it. As the old saying goes, there ought to be a law. And here is where my disappointment lies: ”For consumers, reviewing installed smart TV applications, limiting downloads to trusted developers, and removing unnecessary apps can help reduce exposure.” I mean, I guess they can’t come right out and say, “don’t connect your TV to the Internet”. But they should.