Well, this is new – but not at all unexpected considering the state of Windows and the wider technology industry. When you connect certain LG monitors to a Windows machine, Windows Update will pull in a bunch of adware promoting antivirus trash. Of course, all done without any consent, because Silicon Valley inherently does not understand nor respect consent.
Windows Update first installed LG extension and software component packages. Windows Reliability Monitor showed that LG Monitor App Installer appeared one minute later. The installation did not display a consent prompt or require the user to approve the download.
Gamers Nexus tested the application across 32 consecutive system boots. It displayed a McAfee promotion during 31 of them. On the remaining boot, it promoted one of LG’s own monitor utilities. The McAfee popup offered a 30-day trial that would convert into a paid subscription.
↫ WhyCry at VideoCardz
Don’t use Windows.
Yes, this is total, unadulterated crap.
The line between “driver” and “malware” had been blurred long ago with some printers. But at least you had a choice, and the basic one that came with Windows Update was good enough (maybe missed duplex printing)
Now, I had a Logitech mouse I’m not updating, since the new one pretty much forces the software for the basic features. I’m not against using the driver software, as it comes with some macros and additional functions. But it is always on, opens up ports, and more importantly collects my data. (This is not only logitech, my Corsair did the same)
Windows had a chance to sandbox things, but they were sabotaged by their own faults, and also external pressure (thanks to EU. Long story, but I could recommend looking up x86_64 kernel hardening/PatchGuard), and it is only getting worse.
Why would a monitor do this?
Because they can. Because we let them.
Microsoft definitely should have punished HP for using their driver to try to sneak their HP Smart app onto PCs. They didn’t, so now another company is using the same tactic to spread McAfee malware. Then there’s ASUS armory crate sneaking onto PCs because that’s a motherboard feature… Windows 11’s main reason for existence was to move to the zero trust model of hardware it’s running on, but they just allow big companies to do whatever they want anyway.
dark2,
To be fair, the one time they had a coordinated security push, those companies used the hand of EU to strong arm Microsoft to abandon locking the kernel down.
This was once in a lifetime opportunity, but EU bureaucrats of course sided with anyone who was against “big bad Microsoft”
https://www.telegraph.co.uk/business/2024/07/22/microsoft-blames-eu-rules-worlds-biggest-tech-outage/
(Of course none of those bureaucrats ever showed regret. Quite the opposite, they continued to blame everyone but themselves for the damage they caused)
And I don’t think we have the Microsoft of yesteryear now, and they are no longer interested in fixing these.
(Self reply)
I stand corrected
https://www.riotgames.com/en/news/vanguard-on-demand
Microsoft *did* use this opportunity to fix some crappy 3rd party kernel malware like “Vanguard Anti-Cheat”
So, one step forward, two steps back situation
In the meantime, Google recommends
Kind of dug their own grave on that one by trying to give only their own Windows Defender kernel level access while blocking all the other AV vendors out from it. Last I heard they were going to force everyone out of the kernel and make them use proper APIs, Not sure when that will be. Maybe Windows 12.
dark2,
Yes, it was not a good look from Microsoft.
But being an API designer, is not a simple task. What you put in stays for literally decades.
What EU should have done is giving them a hard deadline
“You have one year to redesign this with a public API, after that every day you’d pay $10 million”
Or similar.
It would be a reasonable compromise.
Or they could’ve copied MacOS API (Next/Sext), that works well enough for AVs. How do I know? I was developing one, for money.
sukru,
A recurring theme In our discussions has been to blame the government for everything under the sun. Even in a case like this where the fault was with a private corporation, you’re still determined to always blame the government instead. All the EU did here was give consumers the right to choose competing software. This is a feature and not a bug and this right is extremely important to our digital freedoms! Frankly the EU is one of the few governing bodies willing to stand up for our freedoms and I wish representatives in the US would do more to protect them too.. Yes it’s true that freedom gives us the right to install software that may have faults, even serious ones, but that’s our decision to make! Freedom means that neither the government nor private corporations usurp our authority on our own hardware. I know you are bent on blaming the government at every turn, but by Jove you should be blaming them when they take away our freedom and not when they are explicitly standing up for it.
Alfman,
Isn’t this a bit of a hyperbole? I mean just here I put at least some of the blame on Microsoft, and explicitly express I don’t expect their current attitude to be good (and… I was actually wrong on that)
If we are still talking about PatchGuard, I will still push back that they did this in the worst way possible.
I agree 100%
sukru,
The thing is this isn’t a one-off. you often go out of the way to shun the EU,. perhaps more than you realize. I only point this out because opposing the EU in this specific instance goes against customers having the freedom to install the software they want.
I agree companies put out bad implementations, but the EU never regulated the implementation – the blame goes to private companies. If I am wrong, then I’d like to see the regulation requiring that it be done this way.
As dark2 was saying the issue is microsoft building a privileged API for themselves and denying competitors access to it. This is what turns it into an antitrust issue.
Alfman,
Yes, I guess EU might be getting the blunt of my ire.
But that is not without cause, because their ill fated attempts cause more damage than the supposed benefits they bring.
What was the saying “the road to hell is paved with good intentions”
Yes, I agree it would be nice if Microsoft magically contorted a public API for all security vendors.
But this is the primary fallacy of EU on tech regulation.
“The purpose of a system is what is does”
And they caused harm by giving an ultimatum with only 2 realistic options to Microsoft
1 – Implement PatchGuard, save the kernel, but give up on Microsoft’s AntiVirus
2 – Do nothing. Don’t implement PatchGuard, keep the Antivirus, but also keep the “free for all” access to the Windows kernel
One might think Microsoft would actually build that API, which I’m sure they eventually wanted to. But it is costly and time consuming.
And EU bureaucrats never negotiate in good faith terms. They always give ultimatums and very short compliance windows. Which forces companies to choose one of the bad options.
Again
“The purpose of a system is what it does”
They have to be more open, and they have to employ people who actually know software development and secondary effects.
===
(I googled it, they literally gave Microsoft a single month to comply. Do you honestly expect them to do anything other than these two options in such a short timeframe)?
Alfman,
Just to clarify, I actually want some regulation. There are plenty of topics were the consumers is actively harmed.
1 – Proliferation of loot boxes, gambling and extensive micro transactions, especially in software that target children
2 – Using psychologists, and neuroscience to target brain’s dopamine center to cause long term addiction patterns
3 – Dark patterns on subscription services and such
4 – Digital “purchases” where you only have an undetermined lease which can end anytime. (For example Sony bought Funimation, while also having Crunchyroll, the largest competitor, and invalidating all of our “purchases”, as they only “bought the content licenses not the obligations”, I’m still pissed to this day)
5 – Planned obsolesce, but the actual one, not those that come from natural reasons
6 – “Bait and Switch”. My LG TV starting showing ads, Ardroid TV, including premium ones offering promoted content top and center, Sony removing Linux from PS3 which was a feature they sold on the box, LG doing the same crap today with monitors, … In other words “enshittification” of already purchased products with “updates”
7 – Not being able to own your data
8 – Not being able to own “out of support” devices like old Xbox or PlayStation consoles which would make perfectly good PCs with an unlock
9 – Backroom deals that reduce competition, for example, again Sony, forcing “parity” on console games not allowing developers to utilize features on competition (like VRR on Xbox) until Sony implements them (look at early games)
10 – Weaponizing DMCA against repairs. To be fair this is entirely enabled by the US government themselves, and don’t seem to be keen on fixing it anytime soon.
sukru,
You are holding the EU accountable for engineering decisions they are not (and should not be) responsible for. IMHO it would be in your best interest that private companies own their engineering mistakes instead of blaming government. Think about what it means to truly blame the government. Every modicum of blame you place at the government’s feet implies more responsibility they have over the private sector. Blaming the EU for mistakes made by private companies only goads the government into taking on more responsibility to oversee private corporations rather than less.
I think Microsoft had free reign on engineering.
Antitrust regulators aren’t there to dictate the technology, only that competitors have access to the same APIs as microsoft.
Well, like dark2 said MS dug their own grave on that one. Rather than a good faith effort to bring themselves into compliance, they hire lawyers with the intent of dragging things out for years.. It most likely is their fault that they weren’t ready when the clock finally ran out.
Alfman,
But they DO dictate technology.
I would highly recommend reading the seminal book from IBM, “The Mythical Man Month”. One cannot accelerate software development by putting more resources into it.
And EU literally held Vista hostage, as at behest of Microsoft competitors, they asked them to fix this one month before launch of the new operating system.
Sorry, but even if Microsoft had actually made a mistake, asking them to completely design a new system in a month is not realistic.
So, in practice, EU forced them into choosing between two bad options,.
Even though none of the EU bureaucrats “intended” to do so.
Anyway, this is pretty clear, and on this topic, there is no reason to defend software development cycle illiteracy.
sukru,
There are many ways that consumer rights are being harmed. The owner’s right to install their own software of choice should be on that list as well. Freedoms keep getting chipped away slowly as companies test the waters and see what they can get away with.. Android could be next with new sideloading restrictions.
sukru,
Then I must insist you provide a citation for it. No hand waiving.
Well again they dug their own hole. Tech giants like to gamble with the law. Most of us don’t get the luxury of postponing compliance with the law. It’s their own fault they chose not to deal with the compliance issues they knew about more promptly.
Alfman,
1 – “Microsoft in EU Vista stand-off” http://news.bbc.co.uk/2/hi/business/5325690.stm
2 – “The Mythical Man Month” https://web.eecs.umich.edu/~weimerw/2018-481/readings/mythical-man-month.pdf
Again, the fact that EU commissioners do not know how software is actually developed does not absolve them from responsibility.
They are a political entity, and clearly not a technical one.
Alfman,
Yes, they are.
These were the things that came to tip of my mind, and I was personally frustrated with. And 10 was a good round number to stop.
Sukru,
We saw that movie with Android, didn’t we? That “saving the kernel” excuse will expand in scope with each iteration so that by windows 15 we’ll all be locked into microsoft store.
Sure, I won’t be happy if my monitor driver begins to show ads, but the solution isn’t locking the kernel. Let me avoid “windows updates” I don’t want, and the issue will be settled.
sukru,
This article literally says it was a “Long Running Battle”, which is what I’ve been saying. Microsoft knew about the issues for years and the government’s position is that “it was it’s (microsoft’s) duty to comply with competition laws.”.. The antitrust cases were never about dictating the technology microsoft uses, only that the OS & APIs be open to competitors.
Of course you are free to disagree with the government’s agenda to make sure microsoft isn’t blocking competitors. But when you say “But they DO dictate technology.” I still don’t see the evidence for this.
I’m aware of the book. I searched and found nothing of the microsoft case…or evidence that the EU dictated the technology of a private corporation.
I still don’t see evidence that the EUoverstepped their regulatory functions in dealing with microsoft. Are you simply against them enforcing anti-trust at all? Because if that’s what this is about, that makes a lot more sense. It’s not that they’re dictating the technology microsoft must use, but that they’re forcing microsoft to provide access to competitors.
cevvalkoala,
This is a completely different discussion about Microsoft securing the kernel data structures after boot, and making them read only in Vista (2006/2007)
The “Store” was not even a thing until 2 versions later (Windows 8) in 21012.
Alfman,
But here is the problem.
There was no “API”, and neither did Microsoft “know” (or rather guess) EU would see PatchGuard as a bad thing.
They do not have a crystal ball, and EU usually works ex-post-facto.
This is part of the exact fallacy I’m talking about.
You won’t. This is a fundamental book on software engineering.
Microsoft was not founded when it was written.
Yes, and how do you think Microsoft can do that in that short time frame?
I’ll take a quote from the book:
This is the core concept regulators cannot understand, and that is what makes them extremely harmful in practice.
I’ll skip ahead to the point
I want the regulators to be powerful and technically competent.
If they are not powerful, they are toothless and ineffective.
If they are technically incompetent, they are dangerous and harmful.
This is It’s also what happens when lawmakers demand “secure backdoors” into end-to-end encryption, I think it is a good analogue here.
Does anyone here on this site even use windows? I have to at my desk at work, where, fortunately, the corporate environment is well managed, but it would seem unlikely that people that read OS news would do so by choice.
I use it to game sometimes. Linux does just fine for most of my games but i do like playing games with some friends and for those ones its just easier cause updates can break linux compat easily enough and my inability to get it running is a roadblock to having fun
At home? No. At work, yes because of the software we use, but I am the sysadmin so I get to decide how the machines are configured and set up. Of course, “with great power comes great responsibility” so I go out of my way to make sure our servers and workstations are set up correctly, securely, and usable by our employees. My boss also knows how I feel about Windows (and shares my concerns) so I also have a Linux box and an OpenBSD box on my desk. He and the owner have both said in the past that if the time ever comes when we could ditch Windows, I have their blessing to make it happen.
I sometimes do. Like a fool I built a machine with an RTX5060, and so I’m stuck with Windows for probably another year.
“Don’t use Windows.”
Gentle reminder that manufacturers could just as easily abuse any linux distro’s native update system.
In no way is that true, though
It is. Laptops that ship with linux usually have custom repositories enabled for drivers and so on. Once you’re there you have to concede than a manufacturer could bundle any dependencies they want. You could disable that behavior on Linux if you were so inclined, but — then again — you can also disable it on Windows.
The better point is that while manufacturers like System76, Tuxedo, Slimbook, or even Apple COULD allow their update systems to deliver a pile of crapware, they DON’T. I suspect that if another hardware manufacturer tried to do this with e.g. Apple, the behavior would be shut down in short order.
Look who is naive enough to believe that if Desktop Linux became popular, the average Desktop Linux pre-install wouldn’t come pre-loaded with 3 metric tons of OEM bloatware, crapware, and adware, as is the case with Android.
I wonder what kind of backroom deal stops places like Adobe from releasing their software for Linux. The only things stopping me from being Windows-free full time (besides the need to support my Windows-using colleagues) is the fact that I can’t operate my film scanners to their full capacity under Linux (and Flight Simulator).
Another friend needs Adobe, another needs Excel.
I don’t think Microsoft will ever release Office for Linux but what is stopping Adobe (and others)?
Probably the support nightmare due to all the different distros out there running all the different desktop environments and kernel versions and so on. They could probably target one commercial-friendly distro like Ubuntu or Red Hat, but they would still be bombarded by downstream users (Mint and Fedora respectively for example) expecting support for their commercial product.
The only reason Macs are even officially supported by Adobe today is historical inertia; starting in the mid 80s through the early 2000s Macs were the desktop publishing platform of choice thanks to an early partnership between Apple and Adobe over PostScript, and the DTP applications that followed were always Mac-first with Windows as an afterthought, until the latter exploded in popularity in the DTP scene around the turn of the century. I’m sure Adobe would love it if they could focus on either just Windows or just macOS, but they are stuck with both due to Windows’ market share and the aforementioned inertia with Apple. A third OS just isn’t on their radar, especially given Linux on the desktop has yet to catch up with macOS in market share.