The most thorough security review your television received this year came from a stranger with a serial cable. This week’s Hacker News front page carried an item titled “Root shell on Samsung TV” — 671 points, 531 comments — circulated from an account posting as log4j. Somebody got a shell on a television, and a few hundred people showed up to argue about whether that was a scandal, a hobby, or a warning.
They argued about the wrong thing.
The Lock Was Never About Your Safety
Every vendor tells the same story about a locked bootloader: it protects you. Verified software, sealed firmware, no tampering, sleep easy. In practice the lock protects a warranty and an inventory sheet, and it does so by arranging the world so that the person most likely to find a flaw is the person least entitled to go looking for one.
The anti-circumvention provisions of the DMCA have made poking at hardware you bought a legally interesting activity for a quarter century, smoothed over every few years by a triennial exemption process that treats device research as a favor granted to a deserving class. That is a bizarre way to operate the maintenance department of the consumer internet. We do not ask a locksmith to petition a librarian before he can look at a deadbolt.
Conservatives who reflexively defend the end-user license agreement should read one closely. What they are defending is a document that converts a sale into a license and a purchaser into a licensee with no standing to inspect the object sitting in his own living room, plugged into his own router, listening to his own children. Property rights are a fine instinct. They are not an argument for letting the seller keep the property.
Nobody Is Paying for This Work
Here is the part the thread skipped past. Samsung did not commission this research. No regulator ordered it. The person who found the shell received, in compensation for a genuinely useful piece of public work, 671 upvotes and a comment section.
“We don’t get a bug-bounty line item for a panel we shipped in 2019,” a firmware contractor who has done stints at two television makers told me in a Slack DM, after I asked why the bootloader page on his employer’s site runs to three paragraphs and never once mentions the division that sells the ad inventory. “We get a line item for the bootloader page.”
That is the whole industry in one sentence. Security is a marketing asset with a budget, and audit is a hobby with a lawyer attached. Firms staff for the firmware they are shipping this quarter. Nobody staffs for the eleven-year-old panel in your den, which is still on your network, still phoning home, and still running whatever was compiled for it in an era when “smart” meant it had a menu.
And the market cannot fix this, because the market has no price for it. You can comparison-shop a television on inches and nits and motion handling. You cannot comparison-shop it on what it reports about you, to whom, and how badly the reporting code was written — because that information is not on the box, not in the manual, and not in any review you will ever read. A consumer who cannot see a product attribute cannot punish anyone for it. That is not a free market in televisions. It’s a free market in glass.
A Safe Harbor, Not a Bootloader Mandate
The obvious legislative answer — force manufacturers to ship unlockable bootloaders — is worse than it sounds. It converts a security question into a compliance checklist, and compliance checklists get satisfied by the least expensive contractor who can satisfy them. It also flatters the hobbyists, who should be told plainly that their solution does not scale. A world where you can flash your own firmware is a world administered by people who know what a UART header is. That is not a mass market. It is a subculture with excellent taste in soldering irons.
The narrower ask is better, and cheaper. First, a standing safe harbor for good-faith security research on devices people own — no petition, no triennial renewal, no lawyer on retainer before you can attach a probe. Second, a disclosure line on the box, the way a calorie count sits on a package: what this device reports, to whom, and for how long it will keep receiving security fixes. The Federal Trade Commission already has ample authority over marketing claims; “we take your privacy seriously” printed above a decade of silence is a claim.
The abstentionists will object that the answer is simply to never connect the television to the internet. Fine advice, offered by people who own a spare monitor and mistake their own inconvenience tolerance for a policy. The panel still ships with firmware. The firmware still has a shell. Somebody still has to look at it.
What happened this week is that somebody did — unpaid, in his spare time, in a jurisdiction that could make his Saturday a legal question. Your television is a computer with a microphone and a cloud account, and the closest thing it has to a security team is a comment thread. The least we can do is stop charging the volunteers rent.