Person buys a product, or downloads some software - that unknowing to them, was reaching out to a central server elsewhere to establish a network tunnel. And over that tunnel, the other server routes traffic onto that person's home network. Which can then of course go onto the internet, and it appears like the traffic originated from their home internet connection.

Other people rent access to this network. The goal being, you have surreptitious access to appear as any one of tens of thousands of home network IP addresses on the public internet. Bad guys can use this to rotate through many different IP addresses when their access gets blocked because of malicious (or benign but unwanted) behavior on the internet. Residential IP addresses are more 'valuable' because they don't have the negative connotation that datacentre and commercial IPs can have, and they can be spread geographically or across many ISPs.

A very common way for people being a part of these residential proxy networks is by buying dodgy streaming boxes, and also installing shady apps on TV app marketplaces.

They can even block all but allow-list certain vendors and models, but because USB is an unauthenticated standard - an attacker can easily spoof any vendor or model. So best not to rely on that and instead block all of certain types of USB device.

It's not intended for home users of course, because that could jeopardise sales in families.

Sure, to use the TV you need to go past the EULA screen. And the button right in front of you, pre-selected - is agree to all terms. And after pressing OK, you now have ACR turned on. But you did that, it wasn't on by default.

Okay I can take my soul sucking corporate hat off now.

At least bringing up the underlying method (restrict to contributors) has spawned the discussion about how that's probably a bad idea on the security side.

The account was commenting on the satirical sysadmin subreddit yesterday, so they know what makes a engaging story.

LiveKit Cloud uses virtual compute and networking across multiple (USA based) cloud providers. DigitalOcean, Google and Oracle at minimum. They each have servers all of the world of course, but the controlling entity(s) parent companies are all based in the USA.

Latency shouldn’t be a problem, it's handled by a global CDN.

Proton including that part about geopolitical instability implies that Meet is does not fall under the USA's CLOUD Act - that would be wrong. The metadata of any Meet call could be handed to USA authorities, for example the participants date & time, source IP and useragent of each member. The call itself should be E2E encrypted.

I didn't immediately see a red flag that would make me discount all of their work. It's clear what the author's general opinions are. They're entitled to them of course.

They were required to change the way their systems worked, to no longer respect a user's chat deletion request. That means a non-chat-logging company can of course be forced to change the way their system works, to instead log chats.

In the same way Apple can not only be forced to hand over back-doored access to UK users iCloud data (when Apple also hold a copy of the keys), they can also be forced to change the way their OS works to prevent the scenario where Apple don't hold the keys (preventing Advanced Data Protection from being enabled). The USA could force the same thing via the CLOUD Act.