5 ms·

> If we could agree on a good, standardized capabilities model for software and everyone starts using it, we will have reached security Nirvana. I want to get

> If we could agree on a good, standardized capabilities model for software and everyone starts using it, we will have reached security Nirvana. I want to get there, but I also don't trust anyone except (maybe) myself to determine what capabilities are "good" versus "bad". I literally just spent most of today messing with my 2018 Samsung TV trying to get rid of the bloatware they pre-installed. I had to do that because the apps took up 96% of the storage within. These apps cannot be deleted normally. If we're heading towards a place where vendors are the ones deciding what users are allowed to do, as well as what the software is allowed to do, and at what level of granularity, I have no reason to trust them any more than I trust a russian state-sponsored hacker.

jk_i_am_a_robot 3y ago
"I literally just spent most of today messing with my 2018 Samsung TV trying to get rid of the bloatware they pre-installed removed." Can you elaborate?
- bimguy 3y ago
  He did elaborate. "I had to do that because the apps took up 96% of the storage within." Literally the line right after the one you quoted...
- c420 3y ago
  I second this, please. I can't even update the preinstalled apps I use on my 2018 Samsung TV because they keep adding more default apps and there's literally zero free space with nothing but their default apps installed.
  - spaceribs 3y ago
    I combined a bunch of awful "tech tips" websites into a working approach: 1. Reset my TV to factory settings. 2. Go into the "apps" item while it desperately tries to update itself 3. Go into "Developer Mode" by pressing 12345 on the remote. 4. Restart the TV by holding down power button for 2 seconds. 5. Open "Apps" again 6. Open the cog. 7. Under the app you want to remove, press "Deep Link Testing" and then hit cancel. 8. If the "Apps" app hasn't been updated yet, your delete button should magically reactivate. I was able to delete the product manual which is like 90mb, all others were reloaded after another restart though but it gave me enough wiggle room to update and install other apps.
    - c420 3y ago
      Thank you!
    - Lacerda69 3y ago
      this is madness
      - spaceribs 3y ago
        As a tech literate person, it was by far the most infuriating experience in recent memory, but achieving some level of victory was fun! Reminded me of hacking my xbox as a teen.
- xeromal 3y ago
  Buy a brand new TV. TV comes with 5Gb hard drive TV comes with 4.75 Gb of OS + bloatware apps. Watch youtube and youtube caches .25GB for 2 hour long information video. TV complains of no storage. Rinse. Repeat
holoduke 3y ago
Offtopic tip. Buy a pc screen instead and attach a nvidia shield or your own box. I never return to normal tv screens again. I also like the more natural color feel of pc screens. Tv s are bloated with color filters, frame interpolators and more.
- solardev 3y ago
  PC monitors are dramatically more expensive though. A regular 55 inch TV is like $300-$500, a monitor that size is gonna be thousands of dollars. (Edit: And you can usually tinker with the color profiles or just turn on Game Mode if you hate the enhancements. It'll never get as close as a properly calibrated PC monitor with ultra color range or whatever, but it's fine for entertainment.) Same with the Shield, it's like $150-$200 while a Chromecast with Google TV is $50 and does pretty much the same thing. Either would be a huge upgrade over integrated smart TV UIs.
  - TrainedMonkey 3y ago
    There are "dumb TVs" - https://www.tomsguide.com/how-to/how-to-buy-a-dumb-tv-and-why-youd-want-to https://www.tomsguide.com/how-to/how-to-buy-a-dumb-tv-and-wh... I have latest LG OLED and I would have hapilly paid more for to get it without smarts built in. Using it with attached Apple TV and the experience is sublime when compared to the builtin crap.
    - solardev 3y ago
      You can also just get any regular "smart" TV and never set up its wifi. I plugged in my Chromecast as soon as I got it, and never used the TV's built-in stuff. It works fine and has no ads or anything. It just boots directly into the Chromecast.
      - fyokdrigd 3y ago
        that's the only way. except using a chromecast is just undoing what you thought you had accomplished.
nine_k 3y ago
But capabilities are not good or bad, no more so than e.g. integers. What the post talks about is "a good system" of capabilities, that is, a comprehensive, logically sound, lean way to describe capabilities that would be widely accepted and applied. With that, indeed a lot could be achieved.
- spaceribs 3y ago
  I think you can already see the issue with that proposition in terms of Google's attempts to prevent ad-blocking in MV3. Google went so far as to design a brand new protocol for handling web requests in such a way as to make it difficult or impossible to do proper blocking. They "Reworded" the capability. If we assume that the "owner" of this list of capabilities is the same party that's writing the software, you better believe they don't (or won't eventually) have the user's needs in mind. Enshittification makes a fool of us all.
  - marcus_holmes 3y ago
    We've seen this elsewhere. "Security" becomes not about protecting the user's data from malicious operators, but protecting the manufacturer's data from the user. If we do agree a standard it'll need to be about actually protecting the user, but implemented by manufacturers who have no incentive to actually do that, and lots of incentive to protect their data, sorry, business model.
cookiengineer 3y ago
> I want to get there, but I also don't trust anyone except (maybe) myself to determine what capabilities are "good" versus "bad". The illusion of control and oversight is why Blueteams always lose in the Cyber Game. It's not feasible, and you effectively don't have time for that. The sheer amount of millions of alerts per day are the result of people still trying to spin the hamster wheel because they don't take a break and think about how this is gonna end up. Don't get me wrong, but I think this is a clustering and statistics problem. You can never be 100% secure and sure about everything, but you can always push the odds in your favor on a larger scale of nodes. Nobody cares whether a system got hacked if there was no compromise of the database and if it can be rolled back easily afterwards. That's why I believe in a fully automated approach based on a strong(er) inventory and stronger communication between systems in regards to incidents and responses.

jk_i_am_a_robot 3y ago

"I literally just spent most of today messing with my 2018 Samsung TV trying to get rid of the bloatware they pre-installed removed." Can you elaborate?

bimguy 3y ago
He did elaborate. "I had to do that because the apps took up 96% of the storage within." Literally the line right after the one you quoted...
c420 3y ago
I second this, please. I can't even update the preinstalled apps I use on my 2018 Samsung TV because they keep adding more default apps and there's literally zero free space with nothing but their default apps installed.
- spaceribs 3y ago
  I combined a bunch of awful "tech tips" websites into a working approach: 1. Reset my TV to factory settings. 2. Go into the "apps" item while it desperately tries to update itself 3. Go into "Developer Mode" by pressing 12345 on the remote. 4. Restart the TV by holding down power button for 2 seconds. 5. Open "Apps" again 6. Open the cog. 7. Under the app you want to remove, press "Deep Link Testing" and then hit cancel. 8. If the "Apps" app hasn't been updated yet, your delete button should magically reactivate. I was able to delete the product manual which is like 90mb, all others were reloaded after another restart though but it gave me enough wiggle room to update and install other apps.
  - c420 3y ago
    Thank you!
  - Lacerda69 3y ago
    this is madness
    - spaceribs 3y ago
      As a tech literate person, it was by far the most infuriating experience in recent memory, but achieving some level of victory was fun! Reminded me of hacking my xbox as a teen.
xeromal 3y ago
Buy a brand new TV. TV comes with 5Gb hard drive TV comes with 4.75 Gb of OS + bloatware apps. Watch youtube and youtube caches .25GB for 2 hour long information video. TV complains of no storage. Rinse. Repeat

holoduke 3y ago

Offtopic tip. Buy a pc screen instead and attach a nvidia shield or your own box. I never return to normal tv screens again. I also like the more natural color feel of pc screens. Tv s are bloated with color filters, frame interpolators and more.

solardev 3y ago
PC monitors are dramatically more expensive though. A regular 55 inch TV is like $300-$500, a monitor that size is gonna be thousands of dollars. (Edit: And you can usually tinker with the color profiles or just turn on Game Mode if you hate the enhancements. It'll never get as close as a properly calibrated PC monitor with ultra color range or whatever, but it's fine for entertainment.) Same with the Shield, it's like $150-$200 while a Chromecast with Google TV is $50 and does pretty much the same thing. Either would be a huge upgrade over integrated smart TV UIs.
- TrainedMonkey 3y ago
  There are "dumb TVs" - https://www.tomsguide.com/how-to/how-to-buy-a-dumb-tv-and-why-youd-want-to https://www.tomsguide.com/how-to/how-to-buy-a-dumb-tv-and-wh... I have latest LG OLED and I would have hapilly paid more for to get it without smarts built in. Using it with attached Apple TV and the experience is sublime when compared to the builtin crap.
  - solardev 3y ago
    You can also just get any regular "smart" TV and never set up its wifi. I plugged in my Chromecast as soon as I got it, and never used the TV's built-in stuff. It works fine and has no ads or anything. It just boots directly into the Chromecast.
    - fyokdrigd 3y ago
      that's the only way. except using a chromecast is just undoing what you thought you had accomplished.

nine_k 3y ago

But capabilities are not good or bad, no more so than e.g. integers. What the post talks about is "a good system" of capabilities, that is, a comprehensive, logically sound, lean way to describe capabilities that would be widely accepted and applied. With that, indeed a lot could be achieved.

spaceribs 3y ago
I think you can already see the issue with that proposition in terms of Google's attempts to prevent ad-blocking in MV3. Google went so far as to design a brand new protocol for handling web requests in such a way as to make it difficult or impossible to do proper blocking. They "Reworded" the capability. If we assume that the "owner" of this list of capabilities is the same party that's writing the software, you better believe they don't (or won't eventually) have the user's needs in mind. Enshittification makes a fool of us all.
- marcus_holmes 3y ago
  We've seen this elsewhere. "Security" becomes not about protecting the user's data from malicious operators, but protecting the manufacturer's data from the user. If we do agree a standard it'll need to be about actually protecting the user, but implemented by manufacturers who have no incentive to actually do that, and lots of incentive to protect their data, sorry, business model.

cookiengineer 3y ago

> I want to get there, but I also don't trust anyone except (maybe) myself to determine what capabilities are "good" versus "bad". The illusion of control and oversight is why Blueteams always lose in the Cyber Game. It's not feasible, and you effectively don't have time for that. The sheer amount of millions of alerts per day are the result of people still trying to spin the hamster wheel because they don't take a break and think about how this is gonna end up. Don't get me wrong, but I think this is a clustering and statistics problem. You can never be 100% secure and sure about everything, but you can always push the odds in your favor on a larger scale of nodes. Nobody cares whether a system got hacked if there was no compromise of the database and if it can be rolled back easily afterwards. That's why I believe in a fully automated approach based on a strong(er) inventory and stronger communication between systems in regards to incidents and responses.