Security quotes of the week

Even without the security concerns, it seems foolish to tie a large expensive piece of hardware that is going to be perfectly decent for a decade or more (a TV screen, a fridge, a car, etc) to a complex piece of software that needs to constantly evolve to keep up with current and future third-party services. Of course for TV manufacturers it's great, they can just stop updating the software and people will be pressured to buy entire new TVs.

I got a quite expensive Samsung Smart TV some years ago and it seems the smart software (which was fairly rubbish and painfully slow) has barely changed at all since it was released, apart from some of the apps disappearing. Samsung also helpfully sold an Evolution Kit, which was a piece of hardware you could plug into the back to upgrade it to the next year's version of the smart UI - but that was restricted to only the most expensive models of TV, not the merely quite expensive ones. And it cost around £250. (£250 for the Evolution Kit, not the TV). And that'd only extend the TV's useful life by about one year.

Alternatively you can get any TV with an HDMI input and add a Roku Streaming Stick or Fire TV Stick or Chromecast etc for under £40, which are decently designed and will probably be well supported for several years. When they become obsolete, or if they have unresolved security issues, you can easily and cheaply throw them away and get a new model, and you can keep the expensive TV screen forever.

So I kind of agree with the advice in Lauren Weinstein's post, except I think all the reasoning there is wrong:

> if you have one, don’t connect it to the Internet directly.

The leaked CIA wiki mentions USB installation of hacked firmware, not a remote exploit. Lack of internet won't stop it getting exploited, and once it's exploited it can silently connect to the wifi access point in the CIA van outside your house.

> "Well, what if the spooks are subverting both my smart TV and my external dongle?" [...] The solution though even for that scenario is simple — kill the power to the dongle when you’re not using it.

If they're both subverted, but (for some reason) the subverted TV isn't connected to wifi directly, it could simply buffer the recorded audio and send it over to the subverted dongle once it's powered on again.

> Buy a Chromecast or Roku or similar dongle that will provide your Internet programming connectivity via HDMI to that television — these dongles don’t include microphones [...]

Many versions of Roku and Fire TV have voice search via a microphone in the remote. (And the remotes are battery powered so in theory they could also record audio while your dongle is unpowered (though in practice they only have a tiny amount of storage)). Chromecast's 'remote' is your phone, which also has microphones (and at least two cameras, and a couple of internet connections, and a load of storage and local processing power, and known-insecure years-old software).