Let's Go

LG webOS TV coordinated vulnerability disclosure

I have not described any vulnerability on this page. The hash below records what I sent to LG Electronics PSRC and when, so that once the findings go public you can check they match what I committed to today.

When the window closes I publish the package and the manifest here, and you can check every hash against them.

Per-finding commitments

Each line of CLAIMS.txt commits to one finding's headline: its identifier, its weakness class and its title. Each hash also covers a 32-byte random nonce, so you cannot attack it by guessing headlines. At disclosure I publish the nonces and the headlines, and you recompute every line.

I revise findings while LG works through them. Committing to each one separately means a reworded report replaces a single line instead of invalidating the rest.

Package digest

sha256(MANIFEST.txt)
fdf012474a7a0492fc6f3271ad58ff5d435b406329699a18e6e6a0b3fd81fc0b

Committed 2026-09-14 (UTC), covering 31 documents. This one pins the exact files I sent, so it changes whenever I revise anything. The per-finding commitments above are what survive revision.

Files

• VERIFY.md, how to check any of this.
• CLAIMS.txt, one commitment per finding.
• CLAIMS.txt.ots, an OpenTimestamps receipt for it.
• MANIFEST-DIGEST, the package digest above on its own.
• MANIFEST.txt.ots, an OpenTimestamps receipt for the manifest.
• MANIFEST.txt stays back until disclosure. Its file list names each report, which would give away the findings it exists to record. The digest above already pins it down, and it lands here unchanged with the package.

Verifying later

ots verify CLAIMS.txt.ots
printf '%s\n%s' "$NONCE" "$RECORD" | shasum -a 256   # matches a line in CLAIMS.txt

ots verify MANIFEST.txt.ots
shasum -a 256 -c <(tail -n +7 MANIFEST.txt | awk '{print $1"  "$2}')

The receipt is anchored in the Bitcoin blockchain. Checking the date costs you no trust in this page, this domain, or me.