Fine with Linux though :)

LG's behavior isn't fine, but their monitors don't install crapware on Linux.

TeMPOraL an hour ago | parent | next [-]

The monitors aren't installing anything. That headline was a lie.

It's Windows Update that's installing LG crapware upon seeing relevant hardware IDs. That's why the problem affected older monitors too - it's the update side that suddenly started to ship malware.

▲

delta_p_delta_x 36 minutes ago | parent | next [-]

> It's Windows Update that's installing LG crapware upon seeing relevant hardware IDs

This is also a misrepresentation. Microsoft has provided LG with a certificate to sign its driver packages with, and allows LG to upload packages to Windows Update, which includes a feature to install sidecar applications. Now, the spirit of this feature is that any application is meant to provide genuine configuration functionality or some graphical front end to the driver's configuration knobs.

LG then abused that feature to provide adware. Now, there are millions of hardware vendors. One can't expect that every driver package submission from every vendor is thoroughly vetted every time, this is a matter of trust and respect.

Sometimes one actually wants the app that comes with the device, like AMD's and NVIDIA's configuration trays.

Even so, I fully expect that after this debacle MS will disable this stuff. There is precedent for this. Synaptics/ELAN/Alps touchpad tray applications largely disappeared after MS implemented precision touchpads somewhere in 2015, and suddenly Windows touchpads became as precise as those on Macs. Likewise with RGB peripherals. Even GPU driver applications have increasingly become less useful as the most important features—power control, adaptive sync, HDR, etc have moved into native Windows settings.

	▲	maccard 5 minutes ago \| parent \| next [-]
		I agree with you on the precedent > after MS implemented precision touchpads somewhere in 2015, and suddenly Windows touchpads became as precise as those on Macs. There’s still a world of difference between a MacBook touchpad and a windows one. My work laptop (18 month old dell XPS) can’t hold a candle to my 6 year old MacBook’s trackpad. > Likewise with RGB peripherals. Even GPU driver applications have increasingly become less useful as the most important features—power control, adaptive sync, HDR, etc have moved into native Windows settings. The peripherals still need the addons though; I have ASUS armory crate, Corsair iCue and MSI center for my Motherboard, cooler and GPU respectively. They all suck.
	▲	denkmoon 9 minutes ago \| parent \| prev \| next [-]
		I can only imagine the meetings at microsoft HQ where they all sat around a table and crossed their fingers and hoped that vendors would act in the spirit of their design.
	▲	petesergeant 10 minutes ago \| parent \| prev [-]
		> One can't expect that every driver package submission from every vendor is thoroughly vetted every time, this is a matter of trust and respect. Apple seem to do a pretty decent job of just that

▲

felooboolooomba 32 minutes ago | parent | prev [-]

> That headline was a lie.

Kinda agree but let's call it "misinformed" or something, instead of a lie.

▲

drnick1 2 hours ago | parent | prev | next [-]

Another win for the Linux security model (software installed and updated manually from vetted repos only).

▲

gblargg an hour ago | parent | next [-]

Wait, you're saying a monitor can just advertise a URL over the video connection for its driver and then Windows will blindly install it, without user confirmation? I thought that LG had submitted these "drivers" (adware) to Microsoft and they approved it.

▲

stkdump 44 minutes ago | parent | next [-]

I think the point is that:

1. Yes Windows must have "approved" the drivers

2. Windows Update runs automatically and not (usually) manually

3. Automatic update can't even be disabled, only manually postponed a bit

At least 2 and 3 are different on virtually every Linux distro. Also, I find it very unlikely that they would accept such behavior.

To give MS the benefit of the doubt here, now that this happened and has been reported on they might decide to enforce stricter rules on manufacturers in the future. But as a Windows user you don't have a choice in case you don't like how they decide and how their decisions might change again later.

	▲	dmos62 32 minutes ago \| parent [-]
		https://github.com/raphire/win11debloat This has an option to disable downloading of auxiliary apps when a device is connected. Yes, it's a Windows Update thing. > Prevent Windows from auto-installing device companion apps, like LG Monitor App, Alienware Command Center and more.

▲

bayindirh an hour ago | parent | prev | next [-]

I believe you register your device with Microsoft so Windows can automatically obtain and install drivers for them when they are plugged in.

What LG sent in for installation is not a simple .inf or .sys/.dll file. They sent in a whole bag of software which does all the nasty things, and Microsoft doesn't vet or care about the software installed as the "driver" of the hardware.

▲

ssl-3 an hour ago | parent | prev [-]

Eh? No.

It's just a device attached to a computer.

But in a Plug-and-Play world, its addition is noticed by the operating system -- as has been normal for decades.

Microsoft's Windows operating system sees this new hardware ID and then goes forth to install whatever-the-fuck software it associates with that identification, presumably as a service to the user. (Did Microsoft approve it? Dunno. I'm just over hear eating popcorn.)

▲

voidUpdate 6 minutes ago | parent | prev | next [-]

sudo dkpg -i FileYouDownloadedFromAnywhere.deb

▲

delta_p_delta_x 39 minutes ago | parent | prev | next [-]

> Another win for the Linux security model

I swear, OSs have become sports teams.

Linux's 'security model’ has plenty of holes. The very fact the kernel and much of its user-mode is written in C almost guarantees that its security model is worthless. The Linux ecosystem operates on trust and respect that can and has been easily abused by bad actors to provide supply-chain pwnage.

There have been so many zero-click local privilege escalation CVEs I've lost track.

Arch Linux AUR malware: https://lists.archlinux.org/archives/list/aur-general@lists....

	▲	silver_silver 32 minutes ago \| parent \| next [-]
		AUR is an effectively unmoderated user repo. It’s not Arch Linux’s core repository, nor is it enabled by default or indeed even possible to use without manual downloads from outside the package manager.
	▲	opan 31 minutes ago \| parent \| prev [-]
		I think you can probably find a better example, even if less recent. The AUR is unofficial and not properly vetted in the same way as the actual Arch repos, Debian repos, etc.

▲

krige an hour ago | parent | prev [-]

Surely you mean Linux security model (not relevant enough to be targeted by big tech)?

	▲	dns_snek an hour ago \| parent [-]
		It's not a weakness that they targeted and exploited, it's a feature that was purposefully implemented by Microsoft.

▲

meta-level an hour ago | parent | prev [-]

yet?

I guess with more and more consumer devices running Linux based OSes (SteamOS, Android, Bazzite, Silverblue, ..) that becomes more and more interesting.

And unfortunately the "I'm safe on my non-windows-system" argument doesn't count for long, as the 99% muggle crowd justifies a shift to a world where our non-certified (=> 'insecure') systems are not supported by big companies anymore, as it's currently happening on Android.

▲

Gigachad an hour ago | parent | next [-]

The LG scandal specifically relies on the fact windows will auto install OEM crapware as soon as you plug it in. No other OS does that.

▲

rconti an hour ago | parent [-]

Huh? What does WebOS have to do with windows?

	▲	smackeyacky 21 minutes ago \| parent [-]
		LG monitors not TVs

▲

ahartmetz an hour ago | parent | prev [-]

"Fortunately", agent Poettering is on the case, implementing remote attestation for Linux so we can all be secure. Barf.