The block rates seem to correlate with watch time increasing to ~1/second, so it's definitely trying to phone home with something. Too bad it can't since all its traffic going outside LAN is dropped with prejudice.

If your network allows to see stuff like that, look into what PS5 is trying to do.

Firewall is based on hand-rolled nftables rules.

[1]: https://www.nlnetlabs.nl/projects/unbound/about/ [2]: https://vector.dev [3]: https://dnstap.info/Examples/

Doesn't require running anything locally and supports various block rules and lists and allows you to enable full log retention if you want. I recommend it to non-techies as the easiest way to get something like pi-hole/dnscrypt-proxy. (but of course not being self-hosted has downsides)

edit: For Roku, DNS blocking like this only works if Roku doesn't use its own resolver. If it's like some Google devices it'll use 8.8.8.8 for DNS resolution ignoring your gateway/DHCP provided DNS server.

You can block access to other resolvers though which usually works.

Eventually devices might just start using hardcoded IPs...

The downside is that Google seems to think I'm in a botnet, and wants us to login to see anything on YouTube.

That's a more or less complete home router, with plenty on spare resources to run internal or external services like a Wireguard tunnel, file server, or the Docker/Podman runtime.

That being said, I still wouldn't connect a "smart" TV to the Internet. There are better options like a Linux HTPC.

Have you got any recommendations for further reading on this topic?

I'm sure it is way more complex than this, but shazam does some kind of small windowed FFT and distills it to the dominant few frequencies. It can then find "rhythms" of these frequency patterns, all boiled down to a time stream of signature data. There is some database which can look up these fingerprints. One given fingerprint might match multiple songs, but since they have dozens of fingerprints spread across time, if most of them point to the same musical source, that is what gets ID'd.

Here's paraphrased steps/result from first article for hashing an image:

1. Reduce size. The fastest way to remove high frequencies and detail is to shrink the image. In this case, shrink it to 8x8 so that there are 64 total pixels.

2. Reduce color. The tiny 8x8 picture is converted to a grayscale. This changes the hash from 64 pixels (64 red, 64 green, and 64 blue) to 64 total colors.

3. Average the colors. Compute the mean value of the 64 colors.

4. Compute the bits. Each bit is simply set based on whether the color value is above or below the mean.

5. Construct the hash. Set the 64 bits into a 64-bit integer. The order does not matter, just as long as you are consistent.

The resulting hash won't change if the image is scaled or the aspect ratio changes. Increasing or decreasing the brightness or contrast, or even altering the colors won't dramatically change the hash value.

https://www.hackerfactor.com/blog/index.php?/archives/432-Lo...

https://www.hackerfactor.com/blog/index.php?/archives/529-Ki...

It's a developer thing, using backticks means the enclosed text is emphasised when rendered from Markdown.

I recently forgot to surround my code in ``` and Gemini refused to help with it (I think I tripped a safety guardrail, it thought I was targeting it with an injection attack). Amusingly, the two ways to work around it were to fence off my code with backticks or to just respond to:

> I can't help you with that

With

> Why not?

After which it was then willing to help with the unquoted code. Presumably it then perceived it as some kind of philosophical puzzle rather than an attack.

When I read what I write, my eyes glance through backticks and maybe come back if I need to parse the inner term in more detail.

  > Most likely ... sending the hash

I do suspect you're right since they would want to reduce bandwidth, especially since residential upload speeds are slow but this is pretty close to verifiable, right?

Also just curious, what happens if you block those requests? I can say Samsung TVs really don't like it... but they will be fine if you take them fully offline.

I admit, I've not gotten around to properly dumping that traffic. For anyone wanting to do this, there's also a spike of DNS requests every hour on the hour, even if tv is off(well, asleep). Would be interesting to see those too. Might be a fun NY holiday project right there. Even without decrypting (hopefully) encrypted traffic, it should be verifiable.

> Also just curious, what happens if you block those requests?

Due to `*.roku.com` DNS black hole, roku showed no ads but things like Netflix and YouTube using standard roku apps("channels") worked fine. I now moved on to playing content using nvidia shield and blocking outside traffic completely. Only odd thing is that the TV occasionally keeps blinking and complains about lack of network if I misclick and start something except HDMI input.

And all that is for the chance to occasionally detect that someone's seen an ad in the background of a stream? Do any platforms even let a streamer broadcast an NFL game like the example given?

The only way you can change this is very high social trust, and all of society condemning anyone who ever defects.

You are abdicating your own moral responsibility on the assumption of a deterministic reality.

The literal textbook version of this ethical issue, one you'll find in literally any intro to ethics class is

  If I don't do this job then somebody else will. The only difference is that I will not get paid and if I get paid I will do good with that money where as if somebody else gets paid they might not.

But either way, it is you abdicating your personal responsibility and making the assumption that the job will be done regardless. But think about the logic here. If people do not think like you then the employer must then start offering higher wages in order to entice others. As there is some function describing people's individual moral lines and their desire for money. Even if the employer must pay more you are then helping deter that behavior because you are making it harder to implement. Alternatively the other person that does the job might not be as good at the job as you, making the damage done less than had you done the job. It's not hard to see that often this will result in the job not even existing as truthfully these immoral jobs are scraping the bottom of the barrel. Even if you are making the assumption that the job will be done it would be more naive to assume the job is done to the same quality. (But kudos on you for the lack of ego and thinking you aren't better than other devs)

[0] https://en.wikipedia.org/wiki/Superior_orders

Not in the USA. LEO or ICE - or even some judges misuse and never are punished. Qualified immunity.

Moral is different story. Too many people in HN work in Google or Apple. That by itself if immoral.

  > even some

Some doesn't change the law.

You're right to push back in case I intended something different. But I'll state this clearly: those LEO, ICE agents, and judges are committing crimes.

But the fact that not all criminals are punished or prosecuted does not change the laws either.

What I'm concerned about is people becoming disenfranchised and apathetic. Dismissing the laws we have that does punish LEO, ICE agents, and judges for breaking the laws. To take a defeatist attitude. Especially in this more difficult time where that power is being abused more than ever. But a big reason it is being able to be abused is because a growing apathetic attitude by people. By people giving up.

So I don't know about you and your positions. I don't know if you're apathetic or invested. All I know is a random comment from a random person. It isn't much to go on. But I hope you aren't and I hope you don't spread apathy, intentionally or not.

  > There is no reasonable argument that it's ethically unsound.

  > The fact that you immediately Godwin'd

Considering you're a military lawyer I'm absolutely certain you've heard this example before and its connection to Nazi Germany. I'm not dating anyone is a Nazi for making that argument, but it is a classic example when pointing to how Ordinary Men can do atrocities. And no, I didn't make a grammatical mistake there.

We can all agree, as a society, "hey, no individual person will graze more than ten cows on the commons," and that's fine. And if we all agree and someone breaks their vow, then that is immoral. "Society just sucks when everyone thinks this way" indeed.

But if nobody ever agreed to it, and you're out there grazing all you're cattle, and Ezekiel is out there grazing all his cattle, and Josiah is out there grazing all his cattle, there is no reasonable ethical principle you could propose that would prevent me from grazing all my cattle too.

Is there not? I don't feel this makes sense to me, as the conclusion seems to be "if everyone (or perhaps a large amount of people) do it, then it's not immoral". My immediate thought goes to moral systems that universalise an action, such that if everyone did it and it makes the world worse, then it's something that you should not do. That would be an example of a system that goes counter to what you say. Since morals are personal, you can still have that conclusion even if other people do not subscribe to the same set of moral beliefs that you have. Something can be immoral to you, and you will refuse to do it even if everyone else does.

> But if nobody ever agreed to it [...] there is no reasonable ethical principle you could propose that would prevent me from grazing all my cattle too.

Why not? I don't quite understand your conclusion. Why could the conclusion not be "I feel what everyone else is doing is wrong, and I will not do it myself"? Is it because it puts you at a disadvantage, and you believe that is unfair? Perhaps this is the "reasonable" aspect?

The original poster was not referring to individual moral feelings, but to formal ethical systems subject to systematized logical thinking: "classic example of an ethically unsound argument."

There is no religious tradition, no system of ethics, no school of thought in moral philosophy, that is consistent with that position. The closest you might come is Aristotelian virtue ethics. But it would be a really strained reading that would result in the position that opting out of commons mismanagement is required. Aristotle specifically said that being a fool is not a virtue. If anything, a virtue ethics lens would compel someone to try to establish formal community rules to prevent the tragedy of the commons.

But let me entertain it for a moment: prior to knowing, e.g., that plastics or CO2 are bad for the environment, how should one know that they are bad for the environment. Fred, the first person to realize this would run around saying "hey guys, this is bad".

And here is where I think it gets interesting: the folks making all the $ producing the CO2 and plastics are highly motivated to say "sorry Fred, your science is wrong". So when it finally turns out that Fred was right, were the plastics/CO2 companies morally wrong in hindsight?

You are arguing that morality is entirely socially determined. This may be partially true, but IMO, only economically. If I must choose between hurting someone else and dying, I do not think there is a categorically moral choice there. (Though Mengzi/ Mencius would say that you should prefer death -- see fish and the bear's paw in 告子上). So, to the extent that your life or life-preserving business (i.e. source of food/housing) demands hurting others (producing plastics, CO2), then perhaps it is moral to do so. But to the extent that your desire for fancy cars and first class plane tickets demands producing CO2...well (ibid.).

The issue is that the people who benefit economically are highly incentivized to object to any new moral reckoning (i.e. tracking people is bad; privacy is good; selling drugs is bad; building casinos is bad). To the extent that we care about morality (and we seem to), those folks benefitting from these actions can effectively lobby against moral change with propaganda. And this is, in fact, exactly what happens politically. Politics is, after all, an attempt to produce a kind of morality. It may depend on whom you follow, but my view would be that politics should be an approach to utilitarian management of resources, in service of the people. But others might say we need to be concerned for the well-being of animals. And still others, would say that we must be concerned with the well-being of capital, or even AIs! In any case, large corporations effectively lobby against any moral reckoning against their activities and thus avoid regulation.

The problem with your "socially determined morality" (though admittedly, I increasingly struggle to see a practical way around this) is that, though in some ways true (since society is economics and therefore impacts one's capacity to live) is that you end up in a world in which everyone can exploit everyone else maximally. There is no inherent truth in what the crowd believes (though again, crowd beliefs do affect short-term and even intermediate-term economics, especially in a hyper-connected world). The fact that most white people in the 1700s believed that it was not wrong to enslave black people does not make that right. The fact that many people believed tulips were worth millions of dollars does not make it true in the long run.

Are we running up against truth vs practicality? I think so. It may be impractical to enforce morality, but that doesn't make Google moral.

Overall, your arguments are compatible with a kind of nihilism: there is no universal morality; I can adopt whatever morality is most suitable to my ends.

I make one final point: how should slavery and plastics be handled? It takes a truly unfeeling sort of human to enslave another human being. It is hard to imagine that none of these people felt that something was wrong. Though google is not enslaving people nor are its actions tantamount to Nazism, there is plenty of recent writing about the rise of technofascism. The EAs would certainly sacrifice the "few" of today's people for the nebulous "many" of the future over which they will rule. But they have constructed a narrative in which the future's many need protection. There are moral philosophies (e.g. utilitarianism) that would justify this. And this is partially because we have insufficient knowledge of the future, and also because the technologies of today make highly variable the possible futures of tomorrow.

I propose instead that---especially in this era of extreme individual power (i.e. the capacity to be "loud" -- see below)---a different kind of morality is useful: the wielding of power is bad. As your power grows, so to does the responsibility to consider its impact on others and to more aggressively judge every action one takes under the Veil of Ignorance. Any time we affect the lives of others around us, we are at greater risk of violating this morality. See eg., Tools for Conviviality or Silence is a Commons (https://news.ycombinator.com/item?id=44609969). Google and the tech companies are being extremely loud, and you'd have to be an idiot to see that it's not harmful. If your mental contortions allow you to say "harm is moral because the majority don't object," well, that looks like nihilism and certainly doesn't get us anywhere "good". But my "good" cannot be measured, and your good is GDP, so I suppose I will lose.

If, for ethical reasons, fewer people were willing to take these jobs, then either salaries would have to rise or the work would be done less effectively.

If salaries rise, the business becomes more expensive and harder to scale. If effectiveness drops, the systems are less capable of extracting/using people’s data.

Either way, refusing these jobs imposes real friction on the surveillance model.

If you want a deontological answer:

You have a responsibility not to participate in unethical behavior, even if someone else would.

Ready to do anything for money as long as it seems legal-ish or your ass is covered by hierarchy?

Killing someone is legal in certain countries for different reasons (I'm not talking about war). Not sure I would like to get involved in that business, for instance if I don't agree on how and why people are sentenced to death in my country.

Some people are built with low ethics. Sure, if it's not made illegal, they'll always find someone to do it. Looks like in that case it might be illegal, as TV makers are sued.

If you see a unattended laptop in a coffeeshop, do you steal it because “someone will steal it, so it might as well be me”?

At this point you might as well blame the average guy for global warming...

As someone who was in an industry that I later discovered was doing things I wasn't personally ethically okay with, I would advise them to do similar to me. Start looking for a new gig and just get out as soon as you can.

Unfortunately as an individual there just isn't much you can do. There will always be someone willing to do the job that you aren't willing to do. Just get out and find something you can sleep at night doing

I'd also recommend you actually find out about somebody's background before making such a giant assumption about how much they know about the issue.

And if you don't think DRM has been used to abuse legitimate users, you yourself have a significant amount of understanding the other side to do. A great start might be just reviewing some of the anecdotes in this comment section or any of the other many threads that continually happen on HN. It turns out that DRM technology has actually changed a bit in the last 24 years, and it's not just about "protecting" IP

I started on another side of engineering and I get that. Building rockets is exciting and fun. But while you build those things it's easy to forget you're building something much more destructive.

Is this data linked to me personally in some way (e.g. though an account) or is it anonymous data?

I'm not saying this is impossible to avoid, but it ends up being a LOT of work when the alternative is just not connecting the TV to the internet and using a laptop / Apple TV / etc. instead.

Do you have a sense for what data is tracked and how it's used? Or if this sort of system is blind in certain cases? (eg: I hook up an N64 to the a/v ports -- will I get retro game ads on the TV?)

What data is tracked? Don't think we can see what's plugged into the TV if it's not connected to the internet but besides that... all of it... If we have your TV we know where you live. We know what you're watching (hopefully our customers' ads!). We know all the devices that connect to your home network. We know where those devices go when you leave the house. We know you were driving down this stretch of road when you saw that ad on that billboard or on the side of that truck ("out-of-home" advertising). We know if you saw that ad and then bought something ("conversion" + "attribution"). We know what apps you have downloaded. Did you know Candy Crush is spying on you, too? Did you know Grindr sells your IP address? We likely know your age and your race and how much your home cost and where you went to college and how many kids you have ("segmentation"). Privacy laws have gotten in the way a little bit, but not much - it's less "we can't get this data anymore" and more "here's the hoop(s) we now have to jump through but we still get it".

I don't want to freak anyone out. In my time in adtech I never felt like anyone was using this data for anything besides "Please buy more coca-cola..." but you never know. Privacy _can_ exist it's just insanely hard because there's so much money hell-bent on tracking you down.

Those datacenters are not being built so that you can talk to ChatGPT all day, they are being built to generate and optimize ads. People who were not previously very suggestible are going to be. People who are suggestible will have their agency sold off to the highest bidder.

Avoid owning a TV? Your friends will. Maybe you can not have a FB/IG/WhatsApp account, only use cash, not have a mobile phone, but Meta (or Google, or Apple) can still detect your face in the background of photos/videos and know where you shop, travel and when.

Hence why I will never connect my TV to the internet

That way they aren't cut out of the loop by you using a different service to watch something and still have a 'cut'.

All this could be done long before any sort of TV-specific image processing, so the only source of "noise" I can think of would be from the various encodings offered by the streaming service (e.g. different resolutions and bitrates). With the right choice of downsample resolution and color quantization I have to imagine you could get acceptable results.

https://arxiv.org/abs/2409.06203

Not super tough to pull off. I was experimenting with FAISS a while back and indexed screenshots of the entire Seinfeld series. I was able take an input screenshot (or Seinfeld meme, etc) and pinpoint the specific episode and approx timestamp it was from.

this is most likely the case, although there's nothing stopping them from uploading the original 4K screengrab in cases where there's no match to something in their database which would allow them to manually ID the content and add a hash or just scrape it for whatever info they can add to your dossier.

[1] https://en.wikipedia.org/wiki/Perceptual_hashing

I should have been more specific in my comment. Perceptual hashing allowsfor higher similarity scores between similar looking images.

Lots of cool techniques to experiment with. Highly recommend playing around if you’re interested.

Then server-side the hash is matched to a program or ad and the data accumulated and reduced even further before ending up in someone's analytics dashboard.

Client side processing like this is legitimate and an excellent way to scale, it just hits a little different when it's being used for something that isn't serving you, the user.

source: backend developer

And how many options do you need to toggle to actually opt out?

I’m shocked to be agreeing with Ken Paxton but he’s right on this one.

For example, check out https://github.com/akamhy/videohash

Are health providers using PS5s in a context where information may be leaked to other providers? What kind of information would you expect to be displayed that might violate HIPAA?

Also how would other providers be privvy to this view of this xray?

I work with a lot of small medical offices, and they do use consumer Smart TVs in some contexts. I typically limit their network access for other reasons, and displaying X-rays isn’t something I’ve personally facilitated, but it wouldn’t shock me to discover it’s being done in other clinics, and the popularity of cloud-based ePHR software has left a lot of smaller clinics with very limited internal I.T. services.

The destination isn’t relevant, if the image leaves the clinic at all without consent, that’s a HIPAA violation. Fortunately, I think it’s more likely that the images are sampled and/or hashed in a way that means the full image isn’t technically transmitted, but considering the consequences and costs of a data breach, I’d definitely be wary of it.

The point of HIPAA is to prevent providers from colluding against you.

Come on hackers. We could murder the global economy with this shit.

Isn't the segment who will set this up also likely to have a low conversion rate to begin with?

You'd need to make it so easy that it becomes fully mainstream. I suspect that's what happened to adblockers, it got a bit too "standard" for (Google's) comfort.

> ... See you after the break.

brief pause

> And we're back ...

Unfortunately, most ads are now burnt in. The 10 second advance will skip through them, but as it's usually the host parroting the ad text and it's easy to over shoot.

I never felt more motivated to pi-hole the TV.

Or just disconnect from the internet entirely? You already have an apple tv. Why does your tv need internet access?

Alternatives like using monitors designed for digital signage come with drawbacks. Expense, they don't have desirable features like VRR, HDR or high refresh rates, since they aren't needed for those use cases. Older TV models will break and supply will dry up.

In the long term, this problem, not just TVs but the commercial exploitation of user data across virtually all electronic devices sold, isn't something that can be solved with a boycott, or by consumers buying more selectively. The practice needs to be killed with legislation.

There are a few different "standards" around VRR, not every device supports all of them.

This place like a flat-earther gathering sometimes.

My opinion is this is just a consolidation of devices. I have many friends who live off their phone data plan giving hotspot to the TV and other devices. Now being moved into a common device format, the TV. I don't think they can spy any more effectively this way. Eexcept via the router integration that gives them way more access, but I'm sure this exists already as a wifi feature on tvs. Just technology trudging along. Perhaps they have a secret sim card or esim embedded, that might be a risk as the hardware is already there for a valid reason.

What we are lacking is implementation but the tech and probably the intent was always there. If HDMI ethernet connectivity(HEC) had gained traction, we would have seen a fire stick, apple tv or roku providing internet to your tv without asking for explicit consent.

Like, Apple knows what you're watching within the Apple TV app obviously.

But it's certainly not taking screenshots every second of what it displaying when you use other apps -- which shows and ads you're seeing. Nor does Apple sell personal data.

Other video apps do register what shows you're in the middle of, so they can appear on the top row of your home screen. But again, Apple's not selling that info.

But I do trust apple more

Isn't that too much data to even begin to analyze? The only winner here seems like S3.

I work for a company that does some work on Internet advertising and one of the main issues that came up when we discussed supporting smart TV platforms was how we could protect our proprietary advertising audience data while still showing ads on these devices. Knowing what ads we show the user tells them what the user is interested in, which is valuable information for our competitors.

Unfortunately, we were not able to solve that problem, and instead to just use lower fidelity user models for advertising on smart TVs. That makes smart TV ads less valuable, but allows us to keep our competitive advantage on desktop and mobile.

I guess I can always just refuse the TV OS access to the wifi, assuming they're not using 4G modems.

I'm indifferent to YouTube have frame-by-frame nanodata about me.

But as a Roku user, this snap shotting makes me very angry.

Maybe because much of what I watch on my TV via my Roku is content I own and stream from my personal server?

I expect my media app, ie. YouTube, to know what I watch from the media app. YouTube knows about YouTube.

My operating system, ie. Roku, should not know about what's happening inside a given app. ie. Roku does not know about YouTube.

When they start crossing layers, that greatly upsets me.