Proprietary malware → Tethers

Proprietary Tethers

• The Jibo robot toys were tethered to the manufacturer's server, and the company made them all cease to work by shutting down that server.

  The shutdown might ironically be good for their users, since the product was designed to manipulate people by presenting a phony semblance of emotions, and was most certainly spying on them.

• Ebooks “bought” from Microsoft's store check that their DRM is valid by connecting to the store every time their “owner” wants to read them. Microsoft is going to close this store, bricking all DRM'ed ebooks it has ever “sold”. (The article additionally highlights the pitfalls of DRM.)

  This is another proof that a DRM-encumbered product doesn't belong to the person who bought it. Microsoft said it will refund customers, but this is no excuse for selling them restricted books.

• The British supermarket Tesco sold tablets which were tethered to Tesco's server for reinstalling default settings. Tesco turned off the server for old models, so now if you try to reinstall the default settings, it bricks them instead.

• Honeywell's “smart” thermostats communicate only through the company's server. They have all the nasty characteristics of such devices: surveillance, and danger of sabotage (of a specific user, or of all users at once), as well as the risk of an outage (which is what just happened).

  In addition, setting the desired temperature requires running nonfree software. With an old-fashioned thermostat, you can do it using controls right on the thermostat.

• The Jawbone fitness tracker was tethered to a proprietary phone app. In 2017, the company shut down and made the app stop working. All the existing trackers stopped working forever.

  The article focuses on a further nasty fillip, that sales of the broken devices continued. But we think that is a secondary issue; it made the nasty consequences extend to some additional people. The fundamental wrong was to design the devices to depend on something else that didn't respect users' freedom.

• The game Metal Gear Rising for MacOS was tethered to a server. The company shut down the server, and all copies stopped working.

• Logitech will sabotage all Harmony Link household control devices by turning off the server through which the products' supposed owners communicate with them.

  The owners suspect this is to pressure them to buy a newer model. If they are wise, they will learn, rather, to distrust any product that requires users to talk with them through some specialized service.

• Sony has brought back its robotic pet Aibo, this time with a universal back door, and tethered to a server that requires a subscription.

• The Canary home surveillance camera has been sabotaged by its manufacturer, turning off many features unless the user starts paying for a subscription.

  With manufacturers like these, who needs security breakers?

  The purchasers should learn the larger lesson and reject connected appliances with embedded proprietary software. Every such product is a temptation to commit sabotage.

• The recent versions of Microsoft Office require the user to connect to Microsoft servers at least every thirty-one days. Otherwise, the software will refuse to edit any documents or create new ones. It will be restricted to viewing and printing.

• Bird and rabbit pets were implemented for Second Life by a company that tethered their food to a server. It shut down the server and the pets more or less died.

• Anova sabotaged users' cooking devices with a downgrade that tethered them to a remote server. Unless users create an account on Anova's servers, their cookers won't function.

• nVidia's proprietary GeForce Experience makes users identify themselves and then sends personal data about them to nVidia servers.

• The iMessage app on iThings tells a server every phone number that the user types into it; the server records these numbers for at least 30 days.

• A half-blind security critique of a tracking app: it found that blatant flaws allowed anyone to snoop on a user's personal data. The critique fails entirely to express concern that the app sends the personal data to a server, where the developer gets it all. This “service” is for suckers!

  The server surely has a “privacy policy,” and surely it is worthless since nearly all of them are.

• Revolv is a device that managed “smart home” operations: switching lights, operate motion sensors, regulating temperature, etc. Its proprietary software depends on a remote server to do these tasks. On May 15th, 2016, Google/Alphabet intentionally broke it by shutting down the server.

  If it were free software, users would have the ability to make it work again, differently, and then have a freedom-respecting home instead of a “smart” home. Don't let proprietary software control your devices and turn them into $300 out-of-warranty bricks. Insist on self-contained computers that run free software!

• Adobe applications require periodic connection to a server.