5 ms·

A monitor cannot install software on your computer by the way. It's Windows installing this software automatically (for some reason), so the blame should be on

by gkbrk 2mo ago

A monitor cannot install software on your computer by the way. It's Windows installing this software automatically (for some reason), so the blame should be on Microsoft. Autorun of malware when you plugged in a USB drive was also a Windows issue, I'd classify this as the same security problem.

tantalor 2mo ago
[flagged]
- mosselman 2mo ago
  You are describing 'the blame should be on Windows'. The consequence of Windows having the blame is that one should not buy it.
  - deleted 2mo ago
    [deleted]
- grayhatter 2mo ago
  that's funny; because my root cause analysis didn't show the user as the person making the decision to show themselves ads? did yours, or was the victim blaming intentional?
  - k33n 2mo ago
    The word “victim” is honestly pretty funny in this context. Nothing really happened to anyone.
    - gkbrk 2mo ago
      I wouldn't classify getting random malware as "nothing happening".
      - frollogaston 2mo ago
        Because it spies on them and nags. But Windows itself already does that. LG could've done the same thing sans the mcafee popups and nobody would care, in fact Dell is probably doing that.
        ssl-3 2mo ago
        > But Windows itself already does that. So once an person is victimized in this way, it becomes a free-for-all where future transgressions cease to matter?
        frollogaston 2mo ago
        Yep. Not free-for-all, but silently installed crap collecting metrics is well within their expectations.
        ssl-3 2mo ago
        So... When people expect to be harmed because they've been harmed before, then it's perfectly OK when they get harmed again. Neato.
        deleted 2mo ago
        [deleted]
        grayhatter 2mo ago
        > Yep. Not free-for-all, but silently installed crap collecting metrics is well within their expectations. I don't expect software engineers to build stuff like this. I expect humans to treat other humans with dignity and respect. In fact, it makes me extremely angry when I see people do it, or advocate that others should tolerate it.
        frollogaston 2mo ago
        I don't think they should tolerate it, but they do. 0 people are going to leave Windows because of this latest scandal, because the ones who care have already left. At some point I accepted that this doesn't matter to a lot of people, which is their right and choice, and if Linux wants to attract users, it has to do it by being easier to use besides just being more ethical.
  - zajio1am 2mo ago
    Not making the specific decision (showing ads) but making the general decision (giving power to Microsoft). Blaming customers for buying MS products is not really much different than blaming Trump voters for voting for him. In both cases risks were obvious beforehand.
    - grayhatter 2mo ago
      > In both cases risks were obvious beforehand. Not everyone is able to accurately predict the future from past patterns. They still deserve dignity and respect. Just because you were able to predict it easily doesn't make it possible for everyone. The solution I'd like is instead of you making excuses for shitty behavior, instead maybe condemn the shitty behavior? You're allowed to say both, you can said I told you so, (to switching to not windows) while also being bothered when you see SWE at some company mistreat other people. You can complain about LG being abusive with the power they were given, while also offering alternative OS install instructions to that grandma who only wants to VC with her grandkids without being tricked into paying for trash-tier antivirus she doesn't need.
- mystifyingpoi 2mo ago
  Please do not blame the user.
  - deleted 2mo ago
    [deleted]
daveidol 2mo ago
The blame should be on Microsoft and LG, both.
felooboolooomba 2mo ago
> A monitor cannot install software on your computer by the way. I think everyone in the HN crowd knows that. > the blame should be on Microsoft No, they blame should ALSO be on Microsoft, they are the enablers.
- rsync 2mo ago
  “I think everyone in the HN crowd knows that.” I would think everyone in the HN crowd would be aware of HEAC, the hdmi Ethernet channel, etc. With full access to the hosts tcp/ip stack, we’d do well not to overlook the potential vectors for a monitor to install software on your computer… especially when the operating system is complicit.
  - account42 2mo ago
    Do any PC graphics cards support Ethernet over HDMI?
- frollogaston 2mo ago
  Ok, I don't use Windows and never will, so wasn't aware of this feature, and it would've been nice to have that context. Thought maaybe LG is exploiting a vuln in Windows via USB-C or over one of the niche HDMI features, but gathered it's not that.
- hx8 2mo ago
  > I think everyone in the HN crowd knows that. I actually did not. I know there is some degree of two-way communication over HDMI/DP, and was curious if this was how the software was installed. I think discussing the technical details is a great use of the HN comment section. (Wifi enabled display device -> HDMI -> Device) would be an incredibly interesting attack vector.
  - frollogaston 2mo ago
    Monitor could also be USB-C which opens up the USB attack vectors.
krige 2mo ago
The monitor should absolutely take the major part of the blame by being the source of the malware and poisoning the system for everyone else.
- frollogaston 2mo ago
  Ironically if Microsoft responded by just never signing LG software again, but kept this auto-install thing in, LG monitors would become the best to use with Windows.
- mcfedr 2mo ago
  its not the source though is it? its not like it's downloaded via the hdmi cable, it comes from Microsoft that offer the service of installing crap
  - krige 2mo ago
    now explain to the class who uploaded it to Windows Update service
Hizonner 2mo ago
Actually it frequently can, since a modern monitor is often on USB and in a position to impersonate a keyboard and/or mouse. I wouldn't put it past most of these companies.
- hedora 2mo ago
  Not sure if it was an LLM hallucination, but I was looking for a wifi dongle for linux. Apparently some of them now present as an autorun usb disk until the driver they auto install sends some magic unlock handshake. So, I avoided those.
MatejKafka 2mo ago
> Autorun of malware when you plugged in a USB drive was also a Windows issue, I'd classify this as the same security problem. Not really. AutoRun ran whatever was on the USB drive, with no oversight. This installs a driver from a company that's supposed to be reputable enough to get their driver signed by MS and pass validation. LG breached that trust here.
- chrisjj 2mo ago
  > that's supposed to be reputable enough to get their driver signed by MS and pass validation. LG breached that trust here. I think you overestimated how reputable is enough.
chrisjj 2mo ago
So how is this malware?

by gkbrk 2mo ago

tantalor 2mo ago

[flagged]

mosselman 2mo ago
You are describing 'the blame should be on Windows'. The consequence of Windows having the blame is that one should not buy it.
- deleted 2mo ago
  [deleted]
grayhatter 2mo ago
that's funny; because my root cause analysis didn't show the user as the person making the decision to show themselves ads? did yours, or was the victim blaming intentional?
- k33n 2mo ago
  The word “victim” is honestly pretty funny in this context. Nothing really happened to anyone.
  - gkbrk 2mo ago
    I wouldn't classify getting random malware as "nothing happening".
    - frollogaston 2mo ago
      Because it spies on them and nags. But Windows itself already does that. LG could've done the same thing sans the mcafee popups and nobody would care, in fact Dell is probably doing that.
      - ssl-3 2mo ago
        > But Windows itself already does that. So once an person is victimized in this way, it becomes a free-for-all where future transgressions cease to matter?
        frollogaston 2mo ago
        Yep. Not free-for-all, but silently installed crap collecting metrics is well within their expectations.
        ssl-3 2mo ago
        So... When people expect to be harmed because they've been harmed before, then it's perfectly OK when they get harmed again. Neato.
        deleted 2mo ago
        [deleted]
        grayhatter 2mo ago
        > Yep. Not free-for-all, but silently installed crap collecting metrics is well within their expectations. I don't expect software engineers to build stuff like this. I expect humans to treat other humans with dignity and respect. In fact, it makes me extremely angry when I see people do it, or advocate that others should tolerate it.
        frollogaston 2mo ago
        I don't think they should tolerate it, but they do. 0 people are going to leave Windows because of this latest scandal, because the ones who care have already left. At some point I accepted that this doesn't matter to a lot of people, which is their right and choice, and if Linux wants to attract users, it has to do it by being easier to use besides just being more ethical.
- zajio1am 2mo ago
  Not making the specific decision (showing ads) but making the general decision (giving power to Microsoft). Blaming customers for buying MS products is not really much different than blaming Trump voters for voting for him. In both cases risks were obvious beforehand.
  - grayhatter 2mo ago
    > In both cases risks were obvious beforehand. Not everyone is able to accurately predict the future from past patterns. They still deserve dignity and respect. Just because you were able to predict it easily doesn't make it possible for everyone. The solution I'd like is instead of you making excuses for shitty behavior, instead maybe condemn the shitty behavior? You're allowed to say both, you can said I told you so, (to switching to not windows) while also being bothered when you see SWE at some company mistreat other people. You can complain about LG being abusive with the power they were given, while also offering alternative OS install instructions to that grandma who only wants to VC with her grandkids without being tricked into paying for trash-tier antivirus she doesn't need.
mystifyingpoi 2mo ago
Please do not blame the user.
- deleted 2mo ago
  [deleted]

daveidol 2mo ago

The blame should be on Microsoft and LG, both.

felooboolooomba 2mo ago

> A monitor cannot install software on your computer by the way. I think everyone in the HN crowd knows that. > the blame should be on Microsoft No, they blame should ALSO be on Microsoft, they are the enablers.

rsync 2mo ago
“I think everyone in the HN crowd knows that.” I would think everyone in the HN crowd would be aware of HEAC, the hdmi Ethernet channel, etc. With full access to the hosts tcp/ip stack, we’d do well not to overlook the potential vectors for a monitor to install software on your computer… especially when the operating system is complicit.
- account42 2mo ago
  Do any PC graphics cards support Ethernet over HDMI?
frollogaston 2mo ago
Ok, I don't use Windows and never will, so wasn't aware of this feature, and it would've been nice to have that context. Thought maaybe LG is exploiting a vuln in Windows via USB-C or over one of the niche HDMI features, but gathered it's not that.
hx8 2mo ago
> I think everyone in the HN crowd knows that. I actually did not. I know there is some degree of two-way communication over HDMI/DP, and was curious if this was how the software was installed. I think discussing the technical details is a great use of the HN comment section. (Wifi enabled display device -> HDMI -> Device) would be an incredibly interesting attack vector.
- frollogaston 2mo ago
  Monitor could also be USB-C which opens up the USB attack vectors.

krige 2mo ago

The monitor should absolutely take the major part of the blame by being the source of the malware and poisoning the system for everyone else.

frollogaston 2mo ago
Ironically if Microsoft responded by just never signing LG software again, but kept this auto-install thing in, LG monitors would become the best to use with Windows.
mcfedr 2mo ago
its not the source though is it? its not like it's downloaded via the hdmi cable, it comes from Microsoft that offer the service of installing crap
- krige 2mo ago
  now explain to the class who uploaded it to Windows Update service

Hizonner 2mo ago

Actually it frequently can, since a modern monitor is often on USB and in a position to impersonate a keyboard and/or mouse. I wouldn't put it past most of these companies.

hedora 2mo ago
Not sure if it was an LLM hallucination, but I was looking for a wifi dongle for linux. Apparently some of them now present as an autorun usb disk until the driver they auto install sends some magic unlock handshake. So, I avoided those.

MatejKafka 2mo ago

> Autorun of malware when you plugged in a USB drive was also a Windows issue, I'd classify this as the same security problem. Not really. AutoRun ran whatever was on the USB drive, with no oversight. This installs a driver from a company that's supposed to be reputable enough to get their driver signed by MS and pass validation. LG breached that trust here.

chrisjj 2mo ago
> that's supposed to be reputable enough to get their driver signed by MS and pass validation. LG breached that trust here. I think you overestimated how reputable is enough.

chrisjj 2mo ago

So how is this malware?