Notes ·
Plugging In a Display Should Not Install Adware on My Computer
Joshua MorrisS-Config has a wonderfully angry post about stopping a smart TV from being used against you. The tone is considerably hotter than I would use, and I don't think every claim in it is established. But the underlying complaint is real, and it exposes a trust boundary I had not thought enough about.
Plug an LG display into a Windows computer and, on supported models, Windows can identify the hardware and automatically install LG's Monitor App Installer. No installer from LG's website. No disc. No USB stick. The display identifies itself, Windows recognizes it, and Microsoft's software-distribution infrastructure can pull down the manufacturer's companion application.
That application then became notorious this summer for repeatedly displaying advertisements for a McAfee trial. Gamers Nexus tested the behavior and reportedly saw the McAfee promotion on 31 of 32 boots. LG says McAfee itself was never installed without the user's explicit permission, which is an important distinction. The more interesting problem is that the LG application displaying the advertisement could arrive without the user explicitly asking for it. LG has since removed the McAfee promotion and says it is changing the installer so customers can decide. Good. It should never have worked this way.
S-Config focuses heavily on EDID, the Extended Display Identification Data that monitors expose to connected computers. EDID itself isn't malicious—it is basic display metadata. The problem comes afterward: Windows can use that hardware identity to associate the device with manufacturer software and retrieve it through Microsoft's device-installation infrastructure.
So this isn't an evil television sending an executable over HDMI. It is closer to: display identifies itself → Windows recognizes hardware → Windows trusts the vendor association → vendor software gets installed → vendor software starts advertising things. I find that worse in a different way. The operating system is the trusted party crossing the boundary.
I bought a display. That transaction should not implicitly make my other computers available as another surface for monetization. There can be legitimate reasons for companion software—firmware updates, color calibration, unusual hardware features. So ask me. Windows could say LG offers optional software for this display—Install? Yes. No. Done. The problem is not supporting software. The problem is turning physical possession into implied consent for software installation.
Keeping the television itself off the internet may not completely eliminate this issue. The display doesn't need to contact LG—the Windows computer has the internet connection, and the display only has to identify itself.
It would be easy to make this entirely about LG. I don't think that is right. Microsoft created and operates the mechanism that allows hardware-associated applications to arrive automatically, and that mechanism has legitimate uses. But an automatic installation channel is also a privileged distribution channel. A McAfee advertisement does not make pixels appear on an LG monitor. Once that distinction disappears, "driver installation" becomes a convenient way around the expectation that I choose what applications are installed on my computer.
S-Config's solution is an EDID blocker—a device between display and computer that provides different identification so the computer no longer necessarily sees: Hello. I am this specific LG product. Using one as a privacy device because you don't trust your monitor manufacturer is considerably funnier. It is also a little depressing—you shouldn't need a hardware dongle to make your monitor less ambitious. Windows settings can also restrict automatic downloads of manufacturer applications, which is probably more sensible for most people. But I appreciate the physical certainty of the S-Config solution.
I keep wanting this option from modern consumer electronics. Give me the hardware. Let me explicitly enable the smart parts I want. And let me turn the rest off—really off. A monitor should be capable of being a monitor. Connecting hardware should not quietly expand who is allowed to install software on my computer.
Read S-Config's "Stopping the smart TV from being used against you."