> Nothing to do with some CEO's evil plans, but more to do with the hundreds/thousands of mid-level "not my job" or "doing my best" workers who are actually in charge of handling my data.

The CEO is responsible for what their company does. If a major breach can occur through the oversight or "incompetence" of one worker, the CEO has already failed, whether through negligence or malice.

> I think it's usually not malice, it's incompetence.

Sufficiently advanced incompetence is indistinguishable from malice, and should be treated accordingly.

Pardon my French but bull-fucking-shit! A CEO _should_ take responsibility for what their subordinates do. It's preposterous to simple throw up our arms and say "oh well, some employees were sloppy so we lost some 100 million user IDs and other sensitive information that we promised not to store but we lied. Oopsie, silly me, pardon my wee incompetence tee-hee". No no no NO NO!

At some level, and certainly at the level where you get paychecks of 10 million a year for the "huge responsibility you are bearing", then incompetence IS malice!

1. Interaction with Meta is virtually mandatory in many places in the world. Try opting out of Meta when your kid's daycare or your building's group chat is on whatsapp.

2. It doesn't really matter if you opt out, because _other people around you don't_: they take pictures in which you show, they tag you, they talk about you, they send you links, etc. Which means they (Meta) build a shadow profile of you anyway.

The "personal responsibility angle" is pure fiction.

It will be when enough people elect enough politicians who take action against this weaponized incompetence and strip-mining of the peoples' assets.

Or, if that does not happen, when enough people rise up in revolution and take the compensation for themselves.

Or, never.

If enough people vote enough or revolt enough, they cannot be stopped. But the incentives for too few people rising up are too costly. They work hard to keep the equilibrium in that balance.

You have a unique code, don't they already have a log of your coming and goings?

But I would absolutely not install an app for that.

You got lucky. If you've got an apartment in, say, a healthcare facility, they'll install those thermostats and whatnot. Usually the neighbours are clueless about technology so complaining doesn't get very far at all.

It's even worse if some staff wrote paranoid in your file, 'cause they'll argue it's good for "exposure".

Depends on jurisdiction, just because someone wrote something in a contract doesn’t mean it’s binding.

In Poland/EU we have an (ever growing) list of forbidden clauses that even when written and signed by consumer are null and void. And I think these can be enacted retroactively - when corporations invent new shady clauses, government steps in and tells them these are invalid.

This helps to even out the consumer-corporation field.

Interestingly, in Brazil and I'm sure in some other legislations, those contracts are essentially void because there's a presumption the average person does not have the time, patience, or ability to understand every clause—so they are by definition unable to agree to their terms.

I'd love to have a similar standard applied in the US but I'm not holding my breath.

>There is absolutely no reason to read those contracts any more

For another perspective, check out the comment you're replying to.

At the very least, you can be sure they'll never change the terms of the agreement to be more beneficial for you, though.

So just treat it as a best case scenario, knowing that it can get even worse.

PS, my technical means are keeping my TV off the internet.

Because it’s extremely profitable for them to serve ads and sell PI. Kind of like how the airline industry makes more money off credit card shenanigans than actual plane tickets.

I hear you. This is exactly the reason why I have a digital signage display rather than a Smart TV.

Because having the TV play from streaming apps out of the box is pretty useful.

The problem is we've not enforced any strong regulation against ads, downgrade rights or hack ability.

I don't need "better performance" from the system built into my TV I just need it to run Kodi.

Similar boat - Panasonic glass fronted TV. Circa 2013. None of the smart works anymore.

1080p, but the picture far outstrips most other TVs I've owned to this day.

I have zero plans to change it, and it's usefulness has outlasted the Chromecast that's connected to it.

Yes, I put the first ads on Smart TVs. Apologies.

It's so you buy a new one every few years instead of keeping the same TV for a decade or two. Capitalism cannot survive when products last a lifetime.

Zealous Autoconfig https://m.xkcd.com/416/

Really?

This exactly. Surely some sort of IoT mesh networking will allow exfiltration of data even without having configured your own device.

I'm hopeful that there will be sufficient distrust that "jailbreaking" or "rooting" TV controller boards will be turnkey enough to move to something like OpenWrt or GrapheneOS but for TVs.

"Watch this two hour long video" is not a particularly useful reply. If you think the TV can exfiltrate your data without an internet connection then you should be able to explain how it could do that in your own words.

This is because they rooted the TV.

They can just start a capture, record to RAM / storage, and retrieve it later when it is reconnected to the network.

Otherwise if it's disconnected, it is still hard to exfiltrate the data somewhere. Maybe they could get creative via Bluetooth, but then you would need a cooperating device in proximity of the device.

Apple TV is the best one. No ads, full OS updates for a long time.

You can always just connect your laptop (or some spare laptop) to the TV via HDMI. Not sure why you’d need to “hack together” something. A dedicated HTPC is nicer if you want to use IR remotes and the like.

Obviously, as an advertising company, Google should have your utmost scrutiny. But as far as I know, their TV boxes don't ACR your content. If they were the only two options, sticking with your smart TV software instead of using a Google TV box would be a privacy mistake.

Any SBC like Radxa Rock (cheap) to Orange Pi (powerful). 4k output, a linux you control, play retro games or stream torrent movies.

> Some open source hacked-together box, then?

I've just used an old Intel NUC with Debian stable, a remote mini-keyboard and an automounted Samba share on the network forever. It's no more hacked together than any other computer. I do make the mouse pointer and the fonts real big. No apps required. Don't really need the keyboard except for mplayer hotkey presses - just the touchpad on it; if I need to do something that involves typing other than typing a password, I usually ssh in.

I think people are lowkey addicted to having shit sliding in and out and constantly being advertised to. How do you know what to watch unless somebody is constantly bombarding you with options? If it doesn't look like a star trek control panel, is it really TV?

If you like that, you can install Kodi. I haven't tried it since it was XBMC because I found the interfaces annoying and it had trouble dealing with networks, but I'm sure it's better.

> I've yet to hear of a reasonable recipe to isolate and secure such connected TVs

I don't even try. I overpay for dumb tvs in the present, or underpay for 10 year old tvs pre-Applefication. I've never owned a network capable television, or one with apps. I wouldn't.

edit: if your NAS is a separate box that can sit in proximity to your television, you could probably just run all of this stuff directly from the NAS. They spend most of their time doing nothing at all.

Just hook up a PC to it?

No idea what NAS you’re using, but I would recommend the Apple TV box.

Surely it still needs to be connected to something that has a network connection, though? Doesn't really mean much here.

Yes, but support in devices and cables is very limited.

Did you know that no one has implemented it? You might as well talk about packet-carrying fairies in your TV. And of course the Apple TV box it’s connected to will be quite happy to share its network connection with arbitrary crap you connect to it.

But I guess like an xkcd comic, someone is obligated to raise the issue every time TVs come up.

LG’s AirPlay requires internet access.

Yes tv makers were caught doing HDMI fingerprinting. There was a story some years ago about how basically all smart tv makers were sending data to an ad network based in China.

Samsung were openly bragging about this on their website some years ago (for the benefit of their advertising partners) but have recently muddied the waters when I check their site again, couching it in language mentioning privacy and other evasive language:

https://www.samsung.com/us/support/answer/ANS10010616/

It's (mostly) a US thing; basically subsidizing TV prices with ad revenue. It's how the entry-level companies like Vizio operate, though the "big brand" TV makers are certainly just as guilty here. It's much less of a thing in the EU, where data privacy laws are stricter and TVs are hence (comparatively) more expensive.

As far as I know, they don't literally scan your media libraries; they screenshot whatever you're watching through HDMI (most often cable / satellite boxes), as those devices don't provide the telemetry that normal apps do. This info is used for audience measurement (thing Nielsen ratings), as well as showing you ads that are actually likely to match your interests.

https://www.ftc.gov/business-guidance/blog/2017/02/what-vizi...

"Starting in 2014, Vizio made TVs that automatically tracked what consumers were watching and transmitted that data back to its servers. Vizio even retrofitted older models by installing its tracking software remotely. All of this, the FTC and AG allege, was done without clearly telling consumers or getting their consent.

...

"Vizio collected a selection of pixels on the screen that it matched to a database of TV, movie, and commercial content

https://arxiv.org/pdf/2409.06203 shows LG and Samsung doing something similar

https://en.wikipedia.org/wiki/Automatic_content_recognition

https://www.youtube.com/watch?v=IvFu343KNek

We don't really have alternatives, period. LG is the one in the news today, but pretty much any TV this decade has been doing similar things. Computer monitors max out at 32 inches and the idea of a modern dumb TV is non-existent.

Its a 2+ hour video. Do you have a timestamp for this?

You can spoof MACs all you want, but your MAC is tied to the address I give out. What happens if you spoof addresses? FAFO...

[citation needed]

>If you're only using it as a screen for the AppleTV, why connect it to the network at all?

Not GP, but I do so to make sure my TV doesn't try to connect to a different network. I provide specific IP addresses to the ethernet-connected interface and then block those IP addresses.

I suppose I could also move the TV to an isolated VLAN, but I spent months (the device was purchased nearly, or perhaps even more than, a decade ago) monitoring network traffic to determine to where (via DNS queries and packet captures) my TV was trying to phone home and blocked all egress for the TV and ingress from the sites/IP addresses to which the TV tried to connect.

I suppose that newer TVs might be sneakier (with the kind of WiFi surfing mentioned in TFA and/or installing cellular modems) in their attempts to bypass user control and when I need a new TV, I'll burn that bridge when I come to it.

But for now, my TV can't phone home. Or I'd have thrown it away years ago.