Let's Go

LG webOS TV coordinated vulnerability disclosure

I have not described any vulnerability on this page. The hashes below record what I sent to LG Electronics PSRC and when, so that once the findings go public you can check they match what I committed to today.

I have sent two packages. Each one has its own commitment file and its own package digest, so you can check them separately. Delivery 2 is additive: it repeats nothing from delivery 1, so delivery 1's commitments stand unchanged.

When the window closes I publish both packages and both manifests here, and you can check every hash against them.

Per-finding commitments

Each line of CLAIMS.txt (delivery 1) and CLAIMS-D2.txt (delivery 2) commits to one finding's headline: its identifier, its weakness class and its title. Each hash also covers a 32-byte random nonce, so you cannot attack it by guessing headlines. At disclosure I publish the nonces and the headlines, and you recompute every line.

I revise findings while LG works through them. Committing to each one separately means a reworded report replaces a single line instead of invalidating the rest.

Package digests

sha256(MANIFEST.txt)      delivery 1, 86 files, committed 2026-09-15 (UTC)
039d7069c0f7b961b10c2b90f65a70a353578912140135dd82dd471bce948c6e

sha256(MANIFEST-D2.txt)   delivery 2, 30 files, committed 2026-09-16 (UTC)
52ec3459a8dcb29cb3a90a7e184e235a2b9404152754e72e896021bc5316d421

A digest pins the exact files in that package, so it changes whenever I revise anything. The per-finding commitments above are what survive revision.

Timestamps

Delivery 1's two receipts are confirmed. The earliest Bitcoin attestation on both is block 967056, mined 2026-09-15 02:38:04 UTC. Delivery 2's two receipts are new and the calendars have not anchored them yet. Run ots upgrade to complete a receipt, and ots info to see whether it holds a Bitcoin attestation or is still pending.

Files

• VERIFY.md, how to check any of this.
• CLAIMS.txt and CLAIMS-D2.txt, one commitment per finding.
• CLAIMS.txt.ots and CLAIMS-D2.txt.ots, their OpenTimestamps receipts.
• MANIFEST-DIGEST and MANIFEST-D2-DIGEST, the package digests above on their own.
• MANIFEST.txt.ots and MANIFEST-D2.txt.ots, OpenTimestamps receipts for the two manifests.
• Both manifests stay back until disclosure. Their file lists name each report, which would give away the findings they exist to record. The digests above already pin them down, and they land here unchanged with the packages.

Verifying later

ots verify CLAIMS.txt.ots
ots verify CLAIMS-D2.txt.ots
printf '%s\n%s' "$NONCE" "$RECORD" | shasum -a 256   # matches a line in a CLAIMS file

ots verify MANIFEST.txt.ots
ots verify MANIFEST-D2.txt.ots
shasum -a 256 -c <(tail -n +7 MANIFEST.txt    | awk '{print $1"  "$2}')
shasum -a 256 -c <(tail -n +8 MANIFEST-D2.txt | awk '{print $1"  "$2}')

The receipts are anchored in the Bitcoin blockchain. Checking the dates costs you no trust in this page, this domain, or me.