The tone is considerably hotter than I would use, and I don't think every claim in it is established.

But the underlying complaint is real, and it exposes a trust boundary I had not thought enough about.

Plug an LG display into a Windows computer and, on supported models, Windows can identify the hardware and automatically install LG's Monitor App Installer.

No installer downloaded from LG's website.

No disc.

No USB stick.

The display identifies itself, Windows recognizes it, and Microsoft's own software-distribution infrastructure can pull down the manufacturer's companion application.

That application then became notorious this summer for repeatedly displaying advertisements for a McAfee trial.

Gamers Nexus tested the behavior and reportedly saw the McAfee promotion on 31 of 32 boots.

LG says McAfee itself was never installed without the user's explicit permission.

That is an important distinction.

The more interesting problem is that the LG application displaying the advertisement could arrive without the user explicitly asking for it in the first place.

LG has since removed the McAfee promotion and says it is changing the installer so customers can decide whether they want to install it.

Good.

It should never have worked this way.

HDMI didn't infect the computer

S-Config focuses heavily on EDID, the Extended Display Identification Data that monitors and televisions expose to connected computers.

EDID itself isn't doing anything malicious.

It is basic display metadata.

It tells the computer things like:

manufacturer
model
supported resolutions
refresh rates
display capabilities

The problem comes afterward.

Windows can use that hardware identity to associate the device with manufacturer-provided software and retrieve it through Microsoft's supported device-installation infrastructure.

So this isn't:

evil television sends executable over HDMI

It is closer to:

display identifies itself
        ↓
Windows recognizes hardware
        ↓
Windows trusts vendor association
        ↓
vendor software gets installed
        ↓
vendor software starts advertising things

I find that worse in a different way.

The operating system is the trusted party crossing the boundary.

I bought a display

This seems like an increasingly difficult concept for consumer electronics companies.

I bought the hardware.

That transaction should not implicitly make my other computers available as another surface for monetization.

A monitor displaying an image does not need an advertising relationship with my Windows installation.

A television connected through HDMI certainly should not gain one simply because its manufacturer and Microsoft have arranged a software-distribution path.

There can be legitimate reasons for companion software.

Firmware updates.

Color calibration.

Changing display settings.

Managing unusual hardware features.

Those can all be useful.

So ask me.

Windows could say:

LG offers optional software for this display.

Install?

Yes.

No.

Done.

The problem is not that hardware can have supporting software.

The problem is turning physical possession of the hardware into implied consent for software installation.

This is exactly why people distrust smart devices

The larger argument in the S-Config piece is about smart televisions, and I understand the frustration.

Modern TVs already have an uncomfortable number of incentives that do not necessarily align with the person who bought them.

Advertising.

Viewing analytics.

Automatic content recognition.

Voice features.

Recommendations.

Accounts.

Telemetry.

Streaming partnerships.

Data collection.

A television is one of the stranger products we buy because the purchase increasingly feels like only the beginning of the manufacturer's relationship with us.

The screen may be relatively inexpensive precisely because there are other ways to make money after it is sitting in the living room.

That makes trust especially important.

And automatically putting software onto another device is a spectacularly bad way to build it.

What makes this particular case interesting is that keeping the television itself off the internet may not completely eliminate the issue.

The display doesn't need to contact LG.

The Windows computer has the internet connection.

The display only has to identify itself.

Windows can do the rest.

That is a clever architecture when it is being used to make hardware work automatically.

It is an ugly architecture when that trust gets used to deliver advertising.

The operating system owns part of this problem

It would be easy to make this entirely about LG.

I don't think that is right.

Microsoft created and operates the mechanism that allows hardware-associated applications to arrive automatically.

That mechanism has legitimate uses.

A printer can appear and Windows finds what it needs.

A specialized mouse can gain its configuration application.

A monitor can expose controls that aren't available through generic interfaces.

Automatic hardware support is one of those things users notice mostly when it stops working.

But an automatic installation channel is also a privileged distribution channel.

If manufacturers are allowed to use it, Microsoft has to enforce a much stronger boundary between software required to support the hardware and software the manufacturer would like installed because it creates another commercial opportunity.

A McAfee advertisement does not make pixels appear on an LG monitor.

Once that distinction disappears, "driver installation" becomes a convenient way around the normal expectation that I choose what applications are installed on my computer.

The workaround is wonderfully ridiculous

S-Config's solution is an EDID blocker.

These devices sit between the display and the computer and provide different display-identification information.

The computer still gets the information it needs to output a picture, but it no longer necessarily sees:

Hello. I am this specific LG product.

That can prevent hardware-specific software matching.

There are perfectly legitimate uses for EDID emulators and blockers in professional AV installations, remote systems and multi-display configurations.

Using one as a privacy device because you don't trust your monitor manufacturer to behave is considerably funnier.

It is also a little depressing.

You shouldn't need a hardware dongle to make your monitor less ambitious.

There are Windows settings that can also restrict automatic downloads of manufacturer applications associated with device metadata, which is probably the more sensible approach for most people.

But I appreciate the physical certainty of the S-Config solution.

Sometimes the best firewall really is a piece of hardware that simply refuses to tell the other side anything useful.

We need dumb modes for smart things

I keep wanting this option from modern consumer electronics.

Give me the hardware.

Let me explicitly enable the smart parts I want.

And let me turn the rest of it off.

Really off.

Not:

disabled except for telemetry

Not:

disabled until the next firmware update

Not:

disabled but another device will download our software for you

A television should be capable of being a display.

A monitor should be capable of being a monitor.

A refrigerator should be capable of keeping food cold.

The "smart" features should be additions to those functions, not a permanent claim the manufacturer retains over the device and everything connected to it.

LG removing the McAfee promotion is good.

Making its installer opt-in will be better.

But the lesson here is larger than one annoying pop-up.

Connecting a piece of hardware should not quietly expand the list of companies allowed to install software on my computer.

Read S-Config's "Stopping the smart TV from being used against you."

Read LG's response about the Monitor App Installer.

All notes