As far as I'm aware, the monitor does not transmit a URL. Windows is looking at the hardware's vendor and device IDs and using those to look up and download the "drivers" that LG has stated are for that device.

I think the point is that:

1. Yes Windows must have "approved" the drivers

2. Windows Update runs automatically and not (usually) manually

3. Automatic update can't even be disabled, only manually postponed a bit

At least 2 and 3 are different on virtually every Linux distro. Also, I find it very unlikely that they would accept such behavior.

To give MS the benefit of the doubt here, now that this happened and has been reported on they might decide to enforce stricter rules on manufacturers in the future. But as a Windows user you don't have a choice in case you don't like how they decide and how their decisions might change again later.

I believe you register your device with Microsoft so Windows can automatically obtain and install drivers for them when they are plugged in.

What LG sent in for installation is not a simple .inf or .sys/.dll file. They sent in a whole bag of software which does all the nasty things, and Microsoft doesn't vet or care about the software installed as the "driver" of the hardware.

Eh? No.

It's just a device attached to a computer.

But in a Plug-and-Play world, its addition is noticed by the operating system -- as has been normal for decades.

Microsoft's Windows operating system sees this new hardware ID and then goes forth to install whatever-the-fuck software it associates with that identification, presumably as a service to the user. (Did Microsoft approve it? Dunno. I'm just over hear eating popcorn.)

I would say 95%+ do just this. The Debian, Ubuntu, and even Fedora repos are very large and include all the software you could ever want. And then flathub takes the rest.

It’s really only arch with the AUR and some others where completely untrusted packages are used. This is legitimately a better model than what windows does, although Microsoft has been trying to change this with winget.

Virtually all desktop Linux users do. The biggest exception is AUR as its not vetted.

'desktop Linux' is a term used when the majority of Linux users don't support your argument.

Are you disputing that the repos are vetted or that users use them???

Almost never occurs as the repos contain a ton of software.

Let's be real, in most cases it is:

    curl -s script.random-guy.net | sh

It is such glaring security hole that there was an old submission about filling such install script with `sleep` commands and detecting it on server side, to send different versions for downloading (and reviewing) and for actual direct execution.

    wget https://raw.githubusercontent.com/timofurrer/russian-roulette/master/russian-roulette -O - | sudo bash

There is one major difference: those install under your users. I haven’t seen a windows installer that didn’t require admin. Some older Linux apps require sudo. They don’t need to do that anymore, not for a while. We have xdg standards of where to install stuff in a users home directory.

> Increasingly software is distributed by "curl dodgysite.com/get.sh|sudo bash -"

I don't think this is the norm at all. I have seen curl/bash install scripts for tools like Claude Code, but they don't use sudo, and the expectation is that you deploy them in isolated user accounts or containers.

Nah, install.exe must be signed by a certificate authority or you get 10 prompts, and they do revoke certificates.

Famously, the Linux kernel does not have a stable ABI for drivers. As a result, by far the majority of drivers are in-tree, maintained by the kernel folks as part of the kernel.

The Linux approach has the downside of not having the drivers if a vendor has not been working with the kernel community before launch (or for those who haven't upgraded to a kernel that has the driver, e.g. a LTS release).

On the other hand, the driver is maintained by kernel developers, not created by the hardware developer who is not getting paid after they sell the device. This helps avoid abandoned / vulnerable drivers, or having the hardware dev search for... alternative revenue streams, as in this case.

It's not a weakness that they targeted and exploited, it's a feature that was purposefully implemented by Microsoft.

AUR is an effectively unmoderated user repo. It’s not Arch Linux’s core repository, nor is it enabled by default or indeed even possible to use without manual downloads from outside the package manager.

I think you can probably find a better example, even if less recent. The AUR is unofficial and not properly vetted in the same way as the actual Arch repos, Debian repos, etc.