There should be a labelling standard for this where the manufacturer must disclose if any registration is required to operate the device to its full potential, if any app or special software is needed other than a system driver, if any phone-home data is being sent, and what data is actually sent, when and why.

"Buyer beware" but most of the time you have no idea what the experience will be like. It's usually not disclosed on the box, reviews rarely mention it and I'd like to have a sure way of being informed before I make my purchase.

It's a similar thing with software, software and apps that require registration for no other reason than add you to their marketing list, but it's particularly egregious with physical items.

"This device certified not to compromise your privacy" could be a good selling point for a printer, especially if half of the printers have it and half don't.

Of course it won't help when you are shopping and looking around in a store for some reason.

So, yeah, it is good advice if the outcome is important to you and you dont know a better way to protect yourself from accidentally buying something like that. Unless you know a better way and are holding out on everyone?

For printers, I also recommend pricing out five years of supplies. I bought a printer that cost 5x as much as one with similar specs, but ends up costing less in supplies.

Not everything is measured in dollars, and getting back the dollars spent as a result of deceitful advertising does not undo the damage caused by the deceit.

At the end of the day it's a team of psychologists, computer scientists, and super computers against one human. It's not a fair fight. There are plenty of dark patterns to make you not internalize the tracking. So while you're technically right, no one expects to see this happen in practice because your model isn't accounting for this.

In some cases, it does. In medical trials, you need "informed consent", and not just regular consent. It doesn't matter what papers are signed, if a patient isn't informed what the trial is testing, what known side effects there are, and what alternatives there are, it doesn't count.

More relevant to this issue, GDPR also uses the concept of informed consent. Under GDPR, tracking is legal only if consent is informed and freely given. The example printer fails both these conditions. It is not informed consent, because the tracking is not prominently disclosed to the user, and merely mentioning it in the fine print is insufficiently prominent. It is not freely-given consent, because a service being conditional on acceptance of tracking means that there is coercion to accept the tracking.

My viewpoint on the ethics tends to follow somewhat close to the GDPR's requirements. Even if somebody clicked through a 50-page EULA, that does not give informed permission to track somebody, and so it is still spying.

It doesn't necessarily mean that the app accessed your GPS location.

Depending on your device, actual access might be shown, I recently installed an Epson printer and while the app needed location permission, it did not access might coordinates, it only scanned for wifi networks.

This is why a wifi scan requires location permission.

One day, the camera permission will probably have the same problem. The time of day and position of the sun can give a coarse location, and perhaps future algorithms will be able to search Google Street View to find your exact location.

So actually intelligence organizations already do this. If they have a mundane picture of an adversary they will try to pinpoint where the picture was taken. Of course there's more clues that they have because they know things about the target, but I guess I'm saying it's not unreasonable to believe such a thing could exist today.

"Keep your secrets safe with Printer X".

Or would the state come down hard on any such manufacturer?

Remember what happened to the Quest CEO when he refused to allow his company to spy for NSA?

https://www.washingtonpost.com/news/the-switch/wp/2013/09/30...

  Just one major telecommunications company refused to participate in a legally dubious NSA surveillance program in 2001. A few years later, its CEO was indicted by federal prosecutors. He was convicted, served four and a half years of his sentence and was released this month.

It's hard to really buy with your wallet when you don't even know you have a reason to be cautious. Similarly, it's been suggested that boycotts and "vote with your wallet" are woefully ineffectual nowadays.

It's not that consumers don't care, it's that most don't have a choice or aren't even aware of such a need

Print heads are a more of a challenge, but you can buy manufacturer originals and build a printer around them.

The firmware is a big problem, but there's a lot of research in the public domain that could be repurposed.

After all of that, you need compatible ink. You'd be reliant on third party ink clones and cartridge systems.

It wouldn't necessarily be harder than a 3D printer project, but it's not trivial, and it would be hard to make it work financially.

Given a choice between an official printer that costs $35 to buy and $60 for replacement inks, and an OpenPrinter that costs $60 to buy and $35 for inks, most people will buy the former.

There's still Trusting Trust, but that's rather harder to pull off.

our biggest client just wants a offline ios printer driver for bouncing previews to Acrobat via the share option. ios so far off our path.. this client would talk about any OSS driver deal for commercial rates in fact they definitely don't want any unique driver to profile... we're totally lost to find resources we can understand or resources at all. for a business to thrive with critical necessities hobbled I think there's always a central crime like how drugs and spectacles frames prices shown constant price for 30 plus years.. something artificial is happening with pressure applied.

I would really like to know if there's a good printer manufacturer that makes simple, high quality printers that just work, don't require all these needless hoops, and respect the customer. Sounds like there should be a market for that, and yet somehow all printer manufacturers seem to suck.

A lot of wifi problems are due to bad/flaky access point hardware. Notably, a lot of the internet recommended "good" consumer wifi gear actually sucks from a reliability point of view. It took me months to get my home setup reliable enough to take it for granted.

Solved

We're well into that era, but neither the technological protections nor the legal ones have kept up.

Tech laws are still barely on the level of requiring manufacturers of network devices not to use the same default password every time and manufacturers of kitchen appliances to accept some basic "right to repair" provisions. These are steps in the right direction of course but they are small steps at the start of a marathon.

I think a lot of political leaders fail to appreciate the danger here. This has somehow remained true even as tech crime is rocketing. We are seeing more and more headlines about how some aspect of critical infrastructure has been brought down due to some form of technological attack, businesses have lost money due to data losses, people have had their identities stolen after data breaches, etc.

Meanwhile, the tech firms best placed to defend ordinary people and businesses against these kinds of attack are often the ones carrying out the attacks. The fox is guarding the hen house.

Just yesterday, there was a news story in the UK[1] about some home car charging stations being vulnerable to simple attacks. These devices get connected to both home networks and electricity grids. The specific models in question were government-approved too.

I think typical open-by-default networking is fundamentally broken today. It's like software for non-experts that doesn't have the option to install security updates automatically, or a browser or mobile OS that doesn't sandbox web pages or apps individually. Professionals use many tools to lock down organisational networks, audit and manage connected devices, and deal with modern challenges like bring-your-own-device, and they still get hit from time to time. Meanwhile home users are basically expected to install a new Trojan every time they buy a new device. This is not going to end well.

[1] https://www.bbc.co.uk/news/technology-58011014

The Brother printer I have attempts to hit some static IP in Japan for firmware updates, unencrypted http. So while on some OSes, you can use it without installing a drive, on MacOS, your desktop will automatically download the vendor's software indirectly from Apple. That is why installing printers is a separate permission as it updates system level components.

The only immediate solution I see to this is to have a protocol level firewall say running on an RPi that firewalls the printer off and intermediates all communication between the devices on the local network and the printer.

It seems that on some Xiaomi models, VLAN can't be configured but its firmware is based on OpenWRT, so it can be enabled by hidden API. So maybe SoC itself supports it but manufacturer disable/don't enable it.

There is no way to force the business models to keep printing on a full cartridge that has met its page limit(per reviews on Amazon), and the salesman at a store told me brothers have replaceable parts in them now besides the toner carts that they force you to replace.

This is why I love Brother printers: I've never had to touch their software. Ever. Been buying their printers for over a decade. You pipe postscript to them on port 9100, they print it. Done. Their software could be 100% refined APT-malware, and I'm totally okay with that.

They often are not any more, at least on the software side.

Also, of course, if you need to produce really great colors (think 6-color inkjets), or really large printouts (say 3' wide), your choice is narrower.

One big question I have: "is it legal to sell a printer that requires the use of someone else's toner?". If so, then the concern about sourcing toner after the whitebox company fails can be addressed in the design stage.

What I really want to know is why there is no BYOPK whitebox TPM product. That should be easy to make and could dominate the market.