4 ms·

> If you root or jailbreak your devices, you've, by their very nature, broken their security. Wow. Please stop spreading things like this. Not having root mea

by pmlnr 24d ago

> If you root or jailbreak your devices, you've, by their very nature, broken their security. Wow. Please stop spreading things like this. Not having root means not owning a device you paid for and have in your home.

p0lychromatic 24d ago
I know people here do not want to hear it, but it is a very two-sided sword. Of course root allows you to tinker with your device and make it run what you want, but: - Rooted devices make devices unpredictable. As shown in the video: How do you trust that your hotel/AirBnB is not using root on _their_ TV to use its microphone to spy on you? Or actually records your video output (instead of "just" ACRing it)? - Re-selling: How do you know that TV you bought is untampered? How do you know it does not have software with malware installed that steals your credentials?
- armadyl 24d ago
  Honestly in a lot of cases people here are too ideologically blinded to see the logic that you’re laying out. It’s the same mental gymnastics that let many here praise something like GrapheneOS yet turn around and screech over it not allowing root which is nearly central to its entire security architecture. But in this case… I don’t know. The OEM is so actively hostile you might be better off just taking the risk with root if you must purchase it at all (and physically removing the radio/microphone hardware not being an option).
  - mort96 24d ago
    Wait who are these people who praise GrapheneOS but complain about it not allowing root? It sounds like you're conflating two groups of people
    - armadyl 24d ago
      No, go to any large GrapheneOS post on here and you’ll inevitably see comments asking why they can’t have root and why it needs to be so strict, why can’t they have everything with the feature set of GOS + root. I’m sure in my comment history I’ve argued with people here over this.
      - mort96 24d ago
        I would also have been annoyed with that if I had to use GrapheneOS, security is a terrible argument to deny people access to their own hardware. But then I'm not a GrapheneOS user, just like I wouldn't have been a Fedora user on my desktop if Fedora made it impossible to gain root.
- cryptonym 24d ago
  With an on premise device, the game is already lost. They may plant a separate mic device inside the TV, or elsewhere. Rooted TV doesn't really impact BnB security model.
- like_any_other 24d ago
  > How do you know that TV you bought is untampered? Many rooted devices display during boot a warning that they have been rooted. This is a problem that has been solved for more than a decade, but manufacturers pretend not to know the solution, because they are actively hostile to user freedom. > How do you trust that your hotel/AirBnB is not using root on _their_ TV to use its microphone to spy on you? Or actually records your video output (instead of "just" ACRing it)? Let's pretend there aren't plenty other ways they could spy on you. If it's bad if a hotel does it, why is it okay if LG does it? Do you honestly trust LG, and the thousands of "partners" that they sell your data to, and every government whose warrants they have to honor? Your argument reduces to "if the warden lets us out of our jail cells, who will make sure we behave?"
  - p0lychromatic 24d ago
    > Many rooted devices display during boot a warning that they have been rooted. Usually, this happens after a bootloader unlock because then verified boot is disabled. You can still have a rooted device and not break verified, resulting in no warning. See: jailbroken iPhones. I wouldn't say it's a solved problem. Just have to find an exploit that works with verified / attested boot. And device manufactures are getting more and more restrictive here, too. Why do you think that is? > Let's pretend there aren't plenty other ways they could spy on you. Sure, of course there are other ways to spy on people. But as we see here: If the device itself does it, then we like to blame LG. If they used an exploit to do that, then we blame LG's shitty security. If a hotel owner installed a microphone inside one or their specific TVs, then we blame the hotel owner at least - not LG. > If it's bad if a hotel does it, why is it okay if LG does it? It doesn't seem like it is okay. We are discussing this right here. > Do you honestly trust LG, and the thousands of "partners" that they sell your data to, and every government whose warrants they have to honor? Do I trust LG more than a shady hotel / BnB owner or eBay seller? Yes. Do I trust them fully? No. It's not fully binary, I'd say. > Your argument reduces to "if the warden lets us out of our jail cells, who will make sure we behave?" I am just trying to say, it's really not that binary. You can extend that to other places whenever attestation is involved. Do I like Linux and open platforms? Sure! Tampering is fun! Do I hate people using open platforms to scrape my websites and constantly cause load, steal my content and use that for AI training? Also, yes. But how can I fight that? We run into CAPTCHAs, Cloudflare, Anubis and co. Now that issue is reduced, but the openness is also gone. And you always see in tech spaces we rather want "dumb" devices rather than smart devices, because we cannot trust them. Attestation buys you more trust, but at the cost of openness.
- sdcfgy 24d ago
  All of those things are: you don’t. If it’s a problem, unplug it. If it’s a problem, don’t buy it. Works for everything!
- pmlnr 24d ago
  > Rooted devices make devices unpredictable. you/we/me not having root while, for example, Google Play Services does on invalidates everything you said.
  - p0lychromatic 24d ago
    Isn't that more predictable though, if you know that Google Play Services does shady stuff? :) Compared to, say, random Magisk modules or some random crap the OEM developed?
rickdeckard 24d ago
True, but rooting the device de-facto means breaking the trust-chain of the OS. The inevitable outcome of this video is that TV vendors are pushed to harden the security and preserve the trust-chain, because part of the (valid) claim is that nefarious actors may break the security to use the device for spying on you. With support from an actual journalist, it could be reframed to also emphasize the importance of controlled root-access to monitor and control the devices behavior. But none of this was done unfortunately, and if I'm LG I don't want to see another video where someone reframes user-initiated voice-input for a web-search as spying initiative by showing some device-logs of the transcription process in parallel...
- deleted 24d ago
  [deleted]
- m4rtink 24d ago
  The trust chain is long broken since the TV is spying on you a the manufacturer is bragging about them "owning the glass and the living room".
- pmlnr 24d ago
  > True, but rooting the device de-facto means breaking the trust-chain of the OS. Like every single Microsoft laptop out there does so? Think a bit harder before sentences like this, please.
  - rickdeckard 24d ago
    I'm thinking very hard, yet still don't know what you're trying to say. You want a consumer TV to be like a Microsoft laptop, is that the benchmark? Did you read and comprehend the rest of my statement? I'm trying one more time. I'm not arguing against you, maybe read this again in a few hours: I believe you want to have full control over the device you own (like I do btw). For this you need to acknowledge that right now it is not in the interest of any party to provide that, because it requires additional effort, carries additional risks and doesn't create an economical benefit. You have to MAKE it the interest of ANY party in the chain (the manufacturer, the seller, the consumer, the lawmaker,...). Being an angry consumer is not getting you there, asking people to "vote with your wallet" is not getting you there. --> Why? Because you won't reach a critical-mass of consumers to move the needle for the manufacturer to notice and take action. Creating noise on security issues and potential hacking won't get you there. --> Why? Because IF it creates ANY reaction, the public reaction will be to hold device-manufacturers responsible, which (if it works!) will cause them to just spend more effort to lock down their products even more, secure the trust-chain in the OS and simply stop operation when it is broken at any point. Trying a mix of topics by mangling everything together, to create as much noise as possible? It will not get you there. --> Why? Because even if that noise is creating a critical-mass, if it's not based on a sober solid foundation with a clear demand, it is not actionable and will die down. Everyone knows that this will happen and affected parties will count on that. So. What GETS you there is "artificially" making it the interest of the involved parties, STEERING the manufacturer into the desired direction. How do you steer things if the sheer economics don't do it? (I don't know your experience, so YMMV from here) From my experience, the only sustainable way to achieve this is that you literally regulate it, by demanding a LEGAL requirement. e.g. Pushing for regulation to provide the user full control over the product if he wants it, acknowledging that the process reduces the responsibilities of the manufacturer for that device. You do that by finding as many reasons, as much evidence as possible that this is a solid direction: Security concerns, environmental concerns/waste elimination, "ensuring a free market",... -- So how do I know that? Because I LIVED through it already (with many other active people in the scene), trying to make bootloader-unlock and community OS a default thing on Android Smartphones. We amplified the topic when the industry was still new and growing, created more noise than there actually was, riled up journalists to act like this is a crucial buying decision for the market, lobbied the whole industry, to a point that they actually made it a competitive feature. Doing all that against a juggernaut of interests AGAINST it (in US e.g. Verizon, which never bulged, vendors with concerns about unjustified warranty-claims, journalists/users stating that this is weakening security, etc.) And what happened? It all died down because we didn't use the momentum to get it into a regulation when there was the chance. Some fruit-company demonstrated over years time and again that this doesn't matter, then even turned it into a marketing-feature to NOT give full control to the user. Meanwhile the momentum and interest in the market died down, and for the past years we started to lose bootloader-unlock again in many brands, without any notable impact on their sales. So if we have to do it again, in a matured market (like TV is), how do we do it now? Again, YMMV, but for me, having lived through that already, the only viable way is regulation. Regulation which demands a solid trust-chain in control of the vendor, AND the possibility for the user to unlock it to take control over the device. Anyway. Peace.
dugite-code 24d ago
Agreed the modern push against root access is a prime example of attempted enshitification lock-in. If you don't have root rights, you don't really own it. All other arguments are talking past this key point.

by pmlnr 24d ago

p0lychromatic 24d ago

I know people here do not want to hear it, but it is a very two-sided sword. Of course root allows you to tinker with your device and make it run what you want, but: - Rooted devices make devices unpredictable. As shown in the video: How do you trust that your hotel/AirBnB is not using root on _their_ TV to use its microphone to spy on you? Or actually records your video output (instead of "just" ACRing it)? - Re-selling: How do you know that TV you bought is untampered? How do you know it does not have software with malware installed that steals your credentials?

armadyl 24d ago
Honestly in a lot of cases people here are too ideologically blinded to see the logic that you’re laying out. It’s the same mental gymnastics that let many here praise something like GrapheneOS yet turn around and screech over it not allowing root which is nearly central to its entire security architecture. But in this case… I don’t know. The OEM is so actively hostile you might be better off just taking the risk with root if you must purchase it at all (and physically removing the radio/microphone hardware not being an option).
- mort96 24d ago
  Wait who are these people who praise GrapheneOS but complain about it not allowing root? It sounds like you're conflating two groups of people
  - armadyl 24d ago
    No, go to any large GrapheneOS post on here and you’ll inevitably see comments asking why they can’t have root and why it needs to be so strict, why can’t they have everything with the feature set of GOS + root. I’m sure in my comment history I’ve argued with people here over this.
    - mort96 24d ago
      I would also have been annoyed with that if I had to use GrapheneOS, security is a terrible argument to deny people access to their own hardware. But then I'm not a GrapheneOS user, just like I wouldn't have been a Fedora user on my desktop if Fedora made it impossible to gain root.
cryptonym 24d ago
With an on premise device, the game is already lost. They may plant a separate mic device inside the TV, or elsewhere. Rooted TV doesn't really impact BnB security model.
like_any_other 24d ago
> How do you know that TV you bought is untampered? Many rooted devices display during boot a warning that they have been rooted. This is a problem that has been solved for more than a decade, but manufacturers pretend not to know the solution, because they are actively hostile to user freedom. > How do you trust that your hotel/AirBnB is not using root on _their_ TV to use its microphone to spy on you? Or actually records your video output (instead of "just" ACRing it)? Let's pretend there aren't plenty other ways they could spy on you. If it's bad if a hotel does it, why is it okay if LG does it? Do you honestly trust LG, and the thousands of "partners" that they sell your data to, and every government whose warrants they have to honor? Your argument reduces to "if the warden lets us out of our jail cells, who will make sure we behave?"
- p0lychromatic 24d ago
  > Many rooted devices display during boot a warning that they have been rooted. Usually, this happens after a bootloader unlock because then verified boot is disabled. You can still have a rooted device and not break verified, resulting in no warning. See: jailbroken iPhones. I wouldn't say it's a solved problem. Just have to find an exploit that works with verified / attested boot. And device manufactures are getting more and more restrictive here, too. Why do you think that is? > Let's pretend there aren't plenty other ways they could spy on you. Sure, of course there are other ways to spy on people. But as we see here: If the device itself does it, then we like to blame LG. If they used an exploit to do that, then we blame LG's shitty security. If a hotel owner installed a microphone inside one or their specific TVs, then we blame the hotel owner at least - not LG. > If it's bad if a hotel does it, why is it okay if LG does it? It doesn't seem like it is okay. We are discussing this right here. > Do you honestly trust LG, and the thousands of "partners" that they sell your data to, and every government whose warrants they have to honor? Do I trust LG more than a shady hotel / BnB owner or eBay seller? Yes. Do I trust them fully? No. It's not fully binary, I'd say. > Your argument reduces to "if the warden lets us out of our jail cells, who will make sure we behave?" I am just trying to say, it's really not that binary. You can extend that to other places whenever attestation is involved. Do I like Linux and open platforms? Sure! Tampering is fun! Do I hate people using open platforms to scrape my websites and constantly cause load, steal my content and use that for AI training? Also, yes. But how can I fight that? We run into CAPTCHAs, Cloudflare, Anubis and co. Now that issue is reduced, but the openness is also gone. And you always see in tech spaces we rather want "dumb" devices rather than smart devices, because we cannot trust them. Attestation buys you more trust, but at the cost of openness.
sdcfgy 24d ago
All of those things are: you don’t. If it’s a problem, unplug it. If it’s a problem, don’t buy it. Works for everything!
pmlnr 24d ago
> Rooted devices make devices unpredictable. you/we/me not having root while, for example, Google Play Services does on invalidates everything you said.
- p0lychromatic 24d ago
  Isn't that more predictable though, if you know that Google Play Services does shady stuff? :) Compared to, say, random Magisk modules or some random crap the OEM developed?

rickdeckard 24d ago

True, but rooting the device de-facto means breaking the trust-chain of the OS. The inevitable outcome of this video is that TV vendors are pushed to harden the security and preserve the trust-chain, because part of the (valid) claim is that nefarious actors may break the security to use the device for spying on you. With support from an actual journalist, it could be reframed to also emphasize the importance of controlled root-access to monitor and control the devices behavior. But none of this was done unfortunately, and if I'm LG I don't want to see another video where someone reframes user-initiated voice-input for a web-search as spying initiative by showing some device-logs of the transcription process in parallel...

deleted 24d ago
[deleted]
m4rtink 24d ago
The trust chain is long broken since the TV is spying on you a the manufacturer is bragging about them "owning the glass and the living room".
pmlnr 24d ago
> True, but rooting the device de-facto means breaking the trust-chain of the OS. Like every single Microsoft laptop out there does so? Think a bit harder before sentences like this, please.
- rickdeckard 24d ago
  I'm thinking very hard, yet still don't know what you're trying to say. You want a consumer TV to be like a Microsoft laptop, is that the benchmark? Did you read and comprehend the rest of my statement? I'm trying one more time. I'm not arguing against you, maybe read this again in a few hours: I believe you want to have full control over the device you own (like I do btw). For this you need to acknowledge that right now it is not in the interest of any party to provide that, because it requires additional effort, carries additional risks and doesn't create an economical benefit. You have to MAKE it the interest of ANY party in the chain (the manufacturer, the seller, the consumer, the lawmaker,...). Being an angry consumer is not getting you there, asking people to "vote with your wallet" is not getting you there. --> Why? Because you won't reach a critical-mass of consumers to move the needle for the manufacturer to notice and take action. Creating noise on security issues and potential hacking won't get you there. --> Why? Because IF it creates ANY reaction, the public reaction will be to hold device-manufacturers responsible, which (if it works!) will cause them to just spend more effort to lock down their products even more, secure the trust-chain in the OS and simply stop operation when it is broken at any point. Trying a mix of topics by mangling everything together, to create as much noise as possible? It will not get you there. --> Why? Because even if that noise is creating a critical-mass, if it's not based on a sober solid foundation with a clear demand, it is not actionable and will die down. Everyone knows that this will happen and affected parties will count on that. So. What GETS you there is "artificially" making it the interest of the involved parties, STEERING the manufacturer into the desired direction. How do you steer things if the sheer economics don't do it? (I don't know your experience, so YMMV from here) From my experience, the only sustainable way to achieve this is that you literally regulate it, by demanding a LEGAL requirement. e.g. Pushing for regulation to provide the user full control over the product if he wants it, acknowledging that the process reduces the responsibilities of the manufacturer for that device. You do that by finding as many reasons, as much evidence as possible that this is a solid direction: Security concerns, environmental concerns/waste elimination, "ensuring a free market",... -- So how do I know that? Because I LIVED through it already (with many other active people in the scene), trying to make bootloader-unlock and community OS a default thing on Android Smartphones. We amplified the topic when the industry was still new and growing, created more noise than there actually was, riled up journalists to act like this is a crucial buying decision for the market, lobbied the whole industry, to a point that they actually made it a competitive feature. Doing all that against a juggernaut of interests AGAINST it (in US e.g. Verizon, which never bulged, vendors with concerns about unjustified warranty-claims, journalists/users stating that this is weakening security, etc.) And what happened? It all died down because we didn't use the momentum to get it into a regulation when there was the chance. Some fruit-company demonstrated over years time and again that this doesn't matter, then even turned it into a marketing-feature to NOT give full control to the user. Meanwhile the momentum and interest in the market died down, and for the past years we started to lose bootloader-unlock again in many brands, without any notable impact on their sales. So if we have to do it again, in a matured market (like TV is), how do we do it now? Again, YMMV, but for me, having lived through that already, the only viable way is regulation. Regulation which demands a solid trust-chain in control of the vendor, AND the possibility for the user to unlock it to take control over the device. Anyway. Peace.

dugite-code 24d ago

Agreed the modern push against root access is a prime example of attempted enshitification lock-in. If you don't have root rights, you don't really own it. All other arguments are talking past this key point.