upvote
> It's Windows Update that's installing LG crapware upon seeing relevant hardware IDs

This is also a misrepresentation. Microsoft has provided LG with a certificate to sign its driver packages with, and allows LG to upload packages to Windows Update, which includes a feature to install sidecar applications. Now, the spirit of this feature is that any application is meant to provide genuine configuration functionality or some graphical front end to the driver's configuration knobs.

LG then abused that feature to provide adware. Now, there are millions of hardware vendors. One can't expect that every driver package submission from every vendor is thoroughly vetted every time, this is a matter of trust and respect.

Sometimes one actually wants the app that comes with the device, like AMD's and NVIDIA's configuration trays.

Even so, I fully expect that after this debacle MS will disable this stuff. There is precedent for this. Synaptics/ELAN/Alps touchpad tray applications largely disappeared after MS implemented precision touchpads somewhere in 2015, and suddenly Windows touchpads became as precise as those on Macs. Likewise with RGB peripherals. Even GPU driver applications have increasingly become less useful as the most important features—power control, adaptive sync, HDR, etc have moved into native Windows settings.

reply
> One can't expect that every driver package submission from every vendor is thoroughly vetted every time

Why not? Microsoft isn't a struggling startup. They can afford to do just that.

reply
Because at scale, that doesn't work, I think, even money no object, because it's a task that requires a lot of domain knowledge, but also is monotonous and offers little in the way of satisfaction or looking good on your resume, so the candidates you're trying to hire aren't very junior, and also are not going to like the work.
reply
If you can’t offer a feature like this in a secure manner then you shouldn’t offer the feature at all.
reply
Why not? "At scale" is not an argument on its own. This is something where scale helps you because the number of different hardware you need to support is independent from the size of your customer base.

And if you really can't act responsibly "at scale" then you shouldn't be allowed that scale.

reply
> One can't expect that every driver package submission from every vendor is thoroughly vetted every time, this is a matter of trust and respect.

Maybe not, but LG has violated this trust and should therefore be either fined or severely restricted by Microsoft. Banning will likely cause more problems than solutions, but they shouldn't get away with this.

Adware was a huge problem during the Windows XP era, can't believe it's coming back now through Microsoft's official channels.

Also I doubt there's actually millions of hardware vendors. But that aside, Microsoft has a duty to vet everything that they offer through their channels. If it's too expensive for them to do, do like Apple did and have those that want to make use of their distribution network (and trust) pay them.

reply
I agree with you on the precedent

> after MS implemented precision touchpads somewhere in 2015, and suddenly Windows touchpads became as precise as those on Macs.

There’s still a world of difference between a MacBook touchpad and a windows one. My work laptop (18 month old dell XPS) can’t hold a candle to my 6 year old MacBook’s trackpad.

> Likewise with RGB peripherals. Even GPU driver applications have increasingly become less useful as the most important features—power control, adaptive sync, HDR, etc have moved into native Windows settings.

The peripherals still need the addons though; I have ASUS armory crate, Corsair iCue and MSI center for my Motherboard, cooler and GPU respectively. They all suck.

reply
> There’s still a world of difference between a MacBook touchpad and a windows one. My work laptop (18 month old dell XPS) can’t hold a candle to my 6 year old MacBook’s trackpad.

The latest Dell trackpads are quite bad. Price or the product being premium or not unfortunately does not tell you if it will have a good trackpad or not. And it changes over time (Dell XPS used to have really good trackpads)

Basically you have to go to a store and try or find reviews that actually pay attention to this.

reply
> There’s still a world of difference between a MacBook touchpad and a windows one

Oddly I've found otherwise (Dell Precision notebook from 2021, and Surface Laptop). It might be macOS's animations and smoothing interfering here, but I've found that my Windows touchpads are much more responsive, especially when swiping between desktops.

> The peripherals still need the addons though

Ugh, this is annoying. Hardware vendors need to be banned from writing lousy, inefficient, unsafe software.

reply
On the trackpads - I only ever use my MacBook as a single screen device, so the experience may be different. A long time ago I used it with an external monitor and the experience was very poor compared to windows.

> Ugh, this is annoying. Hardware vendors need to be banned from writing lousy, inefficient, unsafe software.

Yeah, I commented on the McAfee LG thread but the stuff that comes bundled with hardware is embarassing. I don’t know how Razer, Logitech, nvidia, MSI, asus, etc get away with it. The stuff is awful, even their “good” software. I work in games and a few years ago the biggest correlation we had between unexplained crashes/performance problems in the wild was users having MSI Afterburner installed. Users thought it did great things and fixed a bunch of games but it absolutely thrashed everything we worked very hard to do and caused no end of issues doing so.

reply
> Yeah, I commented on the McAfee LG thread but the stuff that comes bundled with hardware is embarassing. I don’t know how Razer, Logitech, nvidia, MSI, asus, etc get away with it. The stuff is awful, even their “good” software.

Well, this is the whole market on its own. It's entrepreneurship. No different than every web SaaS startup trying to capture some entry-level piece of computer use and then constrain it so it interoperates only with their "net of trusted partners".

They get away with it because everyone is happy and making money - the users, notably, are not part of the group here, and have no voice. The users are resources to be exploited. Same as on the web, and on most markets these days.

reply
What part of Afterburner caused issues? I have it installed to undervolt an old GPU but not actively running.
reply
One of the big ones is people just over clocking way past what’s sensible. Another is stuff like https://www.reddit.com/r/pathofexile/comments/z3xf5r/msi_aft... or https://www.reddit.com/r/pcmasterrace/comments/ob5jam/msi_af...

Other overlay apps like discord https://www.reddit.com/r/discordapp/comments/1jncrlc/new_ove... have similar issues - the way they work is by drive hooks and drawing over the application; depending on how close you are to the limit and how the game loop is coded this can very easily (and often does) cause micro stuttering, and in cases like discord causes massive performance problems regularly.

reply
My point is not to shift the blame to Microsoft; it's primarily LG that's at fault here.

My point here is simply that it's not the monitor that is installing this. Neither the malware nor the URLs to malware exist on the device - they get fetched as part of normal OS-side auto-provisioning, which is the part that was compromised.

reply
This is a primary LG fault, however I would say that Microsoft also has a fair bit of blame here.

They are downloading and installing something without the users consent.

It's nice to have drivers work without any intervention, same with "helper software" but along side the ease of use they also took on the responsibility.

If I download some random .exe from the net; I have to confirm that I want to run it, sometimes I even have to right click and unblock it to allow it to run, because it is "untrusted".

Their signature key, their auto-run system, everything done for ease of use means they own this.

Otherwise what does "trusted" mean?

reply
Yes, and it's only possible thanks but no thanks to MicroSlop.

And it's not like MS is too poor to do anything useful for their customers. They just don't want to unless the cost-benefit analysis pans out in their favor. The customer is worth as much as their wallet.

reply
>Even so, I fully expect that after this debacle MS will disable this stuff.

Isn't the debacle over? MS know about this by now. What's stopping them from killing it today?

A late resolution is barely a resolution at all. None of this functionality needs new Windows features.

reply
I can only imagine the meetings at microsoft HQ where they all sat around a table and crossed their fingers and hoped that vendors would act in the spirit of their design.
reply
The commercial software landscape more and more reminds me of a civil war torn town. Everyone shooting at everyone, a dark forest through and through
reply
It’s more a tragedy of the commons, we are the commons.
reply
> One can't expect that every driver package submission from every vendor is thoroughly vetted every time, this is a matter of trust and respect.

If you're going to allow 3rd parties to install software on potentially billions of computers with far reaching privileges then you better have something in place other than 'just trust me bro'.

reply
Why's that? "Just trust me bro" is the security model of all closed source, proprietary software. OMG, the program with secret source code is doing shady stuff? I'm shocked - shocked!

Hard to get worked up over "3rd parties" when even 1st parties cheerfully stomp all over the interests of their users. That ship sailed, caught fire, and sank to the bottom of the ocean the day Candy Crush appeared in the goddamned Start menu.

reply
If they aren't willing to vet, they should at least be keeping the update minimal. Ie no 'sidecar' apps.

Self signing a driver should mean just that, not a driver, and a load of other things we feel like foisting on the user.

Half the reason I moved to Linux is because I just wanted to print something without getting a load of advertising from a printer company.

reply
> One can't expect that every driver package submission from every vendor is thoroughly vetted every time, this is a matter of trust and respect.

Apple seem to do a pretty decent job of just that

reply
The situation is very different on Macs. Apple control almost the entire hardware stack of the machines that macOS runs on. They make it an absolute pain in the neck to run any application not blessed by attestation. This attestation server is also frequently offline. They've also made it very difficult to write things like filesystem drivers, having completely pulled that functionality from more recent versions of macOS. In fact, if I recall correctly one cannot ship a third-party kext on more recent Macs, especially ARM ones. As such, hackintoshing has basically vanished as a hobby.

At least on Windows, the most you get is a scare screen saying 'this app is from an unidentified developer'. I know what I'd rather have.

reply
At least when I plug a monitor into my Mac, it doesn't install anything. And somehow it still works despite this.
reply
> At least on Windows, the most you get is a scare screen

Well that and side-loaded LG adware

reply
> That headline was a lie.

Kinda agree but let's call it "misinformed" or something, instead of a lie.

reply
I would say it's neither a lie nor misinformed. It 's a punchier headline that can be justified by what the user experiences. The user connects a monitor which causes ads to appear. The rest of this Rube Goldberg contraption is a mere detail.
reply
Those details are the only thing that matter. Without them, all you have is superstition.
reply
I disagree. It matters that LG makes ads appear on their customers' screens as a deterministic consequence of connecting one of their monitors. It's not superstition.

Of course the details are important on some level. But that doesn't make everything else not matter and it doesn't turn an incomplete explanation into a lie.

reply
That's my point: it's not a consequence of connecting a monitor. An external element is making it look like such.

This difference tells you that, for example, you cannot fix the problem by fixing the monitor, because the problem does not exist in hardware. It's actually entirely external to the hardware you own, because it exists entirely "in the cloud" (i.e. on MS and LG servers).

reply
No you're wrong. It absolutely is a consequence of connecting an LG monitor. Connecting an LG monitor triggers a chain of events that deterministically and deliberately cause these ads to be shown.

The hardware alone is not sufficient for this to happen, but if you were to modify or "fix" the monitor (specifically its firmware) so that it no longer identifies as an LG monitor, then it would no longer cause these ads to be shown.

In other words, if A causes B and B causes C then it is correct to say that A causes C.

reply
The headline isn't a lie, even if you can technically nitpick it.

The manufacturer implemented choices to deliberately install the software when the monitors are connected. The mechanism is not important to why this is outrageous.

reply
I disagree, the mechanism is the only important thing. Everything else is storytelling and superstition.
reply