6 ms·

I hate when a law or legal decision is aimed 45 degrees off like this. Letting manufacturers bundle their fucked-up version of Android is a bad thing. What we

by causi 5y ago

I hate when a law or legal decision is aimed 45 degrees off like this. Letting manufacturers bundle their fucked-up version of Android is a bad thing. What we need is mandatory unlockable bootloaders so the users can load whatever they want on their devices.

gjsman-1000 5y ago
There will still need to be the option for a locked boot loader though. If I’m Snowden, knowing my boot loader could be unlocked and a key logger side loaded isn’t reassuring.
- causi 5y ago
  I'm not aware of any manufacturer who allows bootloader unlocking without also displaying a warning screen every time the phone boots up. Example: https://www.thecustomdroid.com/wp-content/uploads/2019/06/How-to-Unlock-Bootloader-on-OnePlus-7-and-OnePlus-7-Pro.jpg https://www.thecustomdroid.com/wp-content/uploads/2019/06/Ho...
  - piaste 5y ago
    My current phone (Xiaomi POCO F2 Pro) only displays a faint lock/unlock icon above the logo while booting. Easy to miss. But that's not really important, because unlocking the bootloader factory resets the device on every Android phone that I know of. AFAIK it's not possible to unlock a bootloader without the owner's knowledge.
    - causi 5y ago
      Even if it's easy to miss, a person like Snowden would be looking out for it.
- 2Gkashmiri 5y ago
  If such snowden like person wants to use such a device, wouldn't he be able to change to lineage os or whatever knowing full well he is now the master of the device or is there malware that persists still ?
  - yoavm 5y ago
    Someone could flash a hacked version of lineage when you're not looking.
    - 2Gkashmiri 5y ago
      that is on you
- craftinator 5y ago
  No, locked bootloader's are the stuff of nightmares. Much rather be able to scratch all memory on the device and reinstall. Perhaps what I mean is "locked bootloaders at POS". Selling them locked should be illegal, but locking them yourself with your own key should be trivial.
  - iszomer 5y ago
    How about splitting the difference like locking the bootloader at point of sale with guaranteed period for updates? After the period has lapsed, allow users to unlock the bootloader to extend with custom software upgrades or, a subscription base to continue with original POS policy. This weirdly intersects for the Right to Repair movement, or for consumers whom would rather be conservative on new device purchases and software licenses.
    - HelixEndeavor 5y ago
      Reminds me of the idea I've been thinking about - kind of unrelated - but once a device is officially no longer supported by a company - particularly consoles and online games - they should make the source code available so people can continue from there on their own.
      - mschuster91 5y ago
        Ideally, companies should be forced to deposit everything needed for manufacturing a product - 3D designs, software toolchains, PCBs, BOMs, service tooling - at the national archives to be held in trust. Once the manufacturer ceases supporting a product, everything becomes open source.
        HelixEndeavor 5y ago
        This is kind of solved by Right to Repair legislation. It would prevent companies from making exclusivity deals and force them to allow this stuff to be sold to the public - not that they have to sell it themselves, but their partners would be free to. I don't know if putting the government in charge of maintaining all of that would be the best idea.
- Youden 5y ago
  Ironically, Google's own Pixel devices are basically the only ones on the market that allow locking the bootloader with your own key [0]. They even follow the recommended bootflow [1], displaying a warning screen with the hash of the installed ROM when you boot the phone. [0]: https://android.googlesource.com/platform/external/avb/+/master/README.md#pixel-2-and-later https://android.googlesource.com/platform/external/avb/+/mas... [1]: https://android.googlesource.com/platform/external/avb/+/master/README.md#recommended-bootflow https://android.googlesource.com/platform/external/avb/+/mas...
  - jefftk 5y ago
    Why is this ironic?
    - rav3ndust 5y ago
      Probably because it effectively means that Google’s own devices are the simplest to “deGoogle.”
- kop316 5y ago
  In all fairness, a locked bootloader won't help against exploits in the OS: https://news.ycombinator.com/item?id=28516095 https://news.ycombinator.com/item?id=28516095 If I'm Snowden, I would be far more concerned about that.
karteum 5y ago
What we need is control on the bootloader, with the ability to unlock, load our own keys, and relock. We also need to clean-up the mess with all those "partitions" (some of them with critical informations e.g. calibration, IMEI, etc) so that only one partition would have all those static information (reasonably protected against overwrite, e.g. colocated with bootloader and device-tree). We should be able to re-partition the storage (like we do on PC) without bricking the device...
- HelixEndeavor 5y ago
  While this all sounds great, I don't imagine legal regulation on how a device is partitioned would go as well as you think...
- fsflover 5y ago
  Librem 5 has its modem on a detachable M.2 card, sounds like what you describe.
- grishka 5y ago
  Google phones allow re-locking the bootloader with your own key, except it still results in a warning during boot, and there's no way you're passing SafetyNet with this, at least not without hacks like Magisk. Also even when you unlock the bootloader, the TrustZone OS, which runs with hypervisor permissions and manages all the exciting things like DRM and SafetyNet itself, is still off limits for you.
  - sangnoir 5y ago
    > Google phones allow re-locking the bootloader with your own key, except it still results in a warning during boot The warning is a great thing for security: I'd appreciate it if my phone showed me that warning after I've surrendered it to the border control agent (alternatively, a sketchy repair shop), or bought it pre-owned, or if I "lost" it and gets returned to me.
    - grishka 5y ago
deleted 5y ago
[deleted]
fsflover 5y ago
> unlockable bootloaders so the users can load whatever they want Here you go: https://puri.sm/products/librem-5 https://puri.sm/products/librem-5.
- HelixEndeavor 5y ago
  We shouldn't have to sacrifice performance, quality, and reasonable price points in order to have the basic things we've had in the desktop world for decades.
  - deleted 5y ago
    [deleted]
  - hdjjhhvvhga 5y ago
    We've only had them for historical reasons. If any of the big manufacturers had the option to invent a "personal computer" now, I'm 100% sure running arbitrary code wouldn't make it to the feature list.
    - horsawlarway 5y ago
      Honestly - I don't think it's just the big manufacturers. If HTML was invented in the current climate, I'm damn well convinced a simple <a href={external domain}> would be shot down for "security" reasons. We're seeing a real breakdown into walled ecosystems. My opinion is that most of the steps that direction are well-intentioned (Safety, Security, Consistency, etc). The end result is fucking hell, though, where the ecosystem owner profits massively and unfairly compared to all other entities.
    - dleslie 5y ago
      That's how IBM built the PC, loosely. They didn't imagine a market where there would be third party expansion cards, and they believed that users should come to them, and their partners, for software. Compaq blew that wide open, much to IBM corporate's dismay and IBM legal's glee.
  - pjmlp 5y ago
snarf21 5y ago
I know that a lot of us more tech inclined want this freedom. But grandma is never running toolchain on a computer to install custom software. What 99% of people want is cheap/free and they will give up privacy to get it. I see this as SK giving its citizens what they say they want. I wish that wasn't the case but it seems like that is the world we live in.
- kijin 5y ago
  Ordinary citizens don't really care. This is SK giving Samsung what they want: an Android-fork OS for their smartwatches and other gadgets where the app store can be controlled by Samsung, not Google.
  - turtlebits 5y ago
    I think the issue is Google blocking customizations if they want the Google Play store on the device. I don't think there is anything stopping Samsung from using AOSP.
    - ocdtrekkie 5y ago
      You are incorrect. Google's AFA is viral in nature. Daring to ship a non-Google Android will cancel your ability to ship any devices with Google Play.
- pessimizer 5y ago
  > I know that a lot of us more tech inclined want this freedom. But grandma is never running toolchain on a computer to install custom software This is thought-terminating nonsense, constantly repeated. What my grandma wants is for me to pick what's best for her and install it. What she doesn't want is Google (or Samsung for that matter) keeping her grandson from doing what he thinks she'll like best. edit: and to be clear, that's what all of my computer-illiterate family members want, although not all of them from me (there are other grandchildren, uncles, etc.). The radical idea that people would rather have decisions made by the people that they love and trust rather than companies that actively and constantly prey upon them should be accepted without question.

by causi 5y ago

gjsman-1000 5y ago

There will still need to be the option for a locked boot loader though. If I’m Snowden, knowing my boot loader could be unlocked and a key logger side loaded isn’t reassuring.

causi 5y ago
I'm not aware of any manufacturer who allows bootloader unlocking without also displaying a warning screen every time the phone boots up. Example: https://www.thecustomdroid.com/wp-content/uploads/2019/06/How-to-Unlock-Bootloader-on-OnePlus-7-and-OnePlus-7-Pro.jpg https://www.thecustomdroid.com/wp-content/uploads/2019/06/Ho...
- piaste 5y ago
  My current phone (Xiaomi POCO F2 Pro) only displays a faint lock/unlock icon above the logo while booting. Easy to miss. But that's not really important, because unlocking the bootloader factory resets the device on every Android phone that I know of. AFAIK it's not possible to unlock a bootloader without the owner's knowledge.
  - causi 5y ago
    Even if it's easy to miss, a person like Snowden would be looking out for it.
2Gkashmiri 5y ago
If such snowden like person wants to use such a device, wouldn't he be able to change to lineage os or whatever knowing full well he is now the master of the device or is there malware that persists still ?
- yoavm 5y ago
  Someone could flash a hacked version of lineage when you're not looking.
  - 2Gkashmiri 5y ago
    that is on you
craftinator 5y ago
No, locked bootloader's are the stuff of nightmares. Much rather be able to scratch all memory on the device and reinstall. Perhaps what I mean is "locked bootloaders at POS". Selling them locked should be illegal, but locking them yourself with your own key should be trivial.
- iszomer 5y ago
  How about splitting the difference like locking the bootloader at point of sale with guaranteed period for updates? After the period has lapsed, allow users to unlock the bootloader to extend with custom software upgrades or, a subscription base to continue with original POS policy. This weirdly intersects for the Right to Repair movement, or for consumers whom would rather be conservative on new device purchases and software licenses.
  - HelixEndeavor 5y ago
    Reminds me of the idea I've been thinking about - kind of unrelated - but once a device is officially no longer supported by a company - particularly consoles and online games - they should make the source code available so people can continue from there on their own.
    - mschuster91 5y ago
      Ideally, companies should be forced to deposit everything needed for manufacturing a product - 3D designs, software toolchains, PCBs, BOMs, service tooling - at the national archives to be held in trust. Once the manufacturer ceases supporting a product, everything becomes open source.
      - HelixEndeavor 5y ago
        This is kind of solved by Right to Repair legislation. It would prevent companies from making exclusivity deals and force them to allow this stuff to be sold to the public - not that they have to sell it themselves, but their partners would be free to. I don't know if putting the government in charge of maintaining all of that would be the best idea.
Youden 5y ago
Ironically, Google's own Pixel devices are basically the only ones on the market that allow locking the bootloader with your own key [0]. They even follow the recommended bootflow [1], displaying a warning screen with the hash of the installed ROM when you boot the phone. [0]: https://android.googlesource.com/platform/external/avb/+/master/README.md#pixel-2-and-later https://android.googlesource.com/platform/external/avb/+/mas... [1]: https://android.googlesource.com/platform/external/avb/+/master/README.md#recommended-bootflow https://android.googlesource.com/platform/external/avb/+/mas...
- jefftk 5y ago
  Why is this ironic?
  - rav3ndust 5y ago
    Probably because it effectively means that Google’s own devices are the simplest to “deGoogle.”
kop316 5y ago
In all fairness, a locked bootloader won't help against exploits in the OS: https://news.ycombinator.com/item?id=28516095 https://news.ycombinator.com/item?id=28516095 If I'm Snowden, I would be far more concerned about that.

karteum 5y ago

What we need is control on the bootloader, with the ability to unlock, load our own keys, and relock. We also need to clean-up the mess with all those "partitions" (some of them with critical informations e.g. calibration, IMEI, etc) so that only one partition would have all those static information (reasonably protected against overwrite, e.g. colocated with bootloader and device-tree). We should be able to re-partition the storage (like we do on PC) without bricking the device...

HelixEndeavor 5y ago
While this all sounds great, I don't imagine legal regulation on how a device is partitioned would go as well as you think...
fsflover 5y ago
Librem 5 has its modem on a detachable M.2 card, sounds like what you describe.
grishka 5y ago
Google phones allow re-locking the bootloader with your own key, except it still results in a warning during boot, and there's no way you're passing SafetyNet with this, at least not without hacks like Magisk. Also even when you unlock the bootloader, the TrustZone OS, which runs with hypervisor permissions and manages all the exciting things like DRM and SafetyNet itself, is still off limits for you.
- sangnoir 5y ago
  > Google phones allow re-locking the bootloader with your own key, except it still results in a warning during boot The warning is a great thing for security: I'd appreciate it if my phone showed me that warning after I've surrendered it to the border control agent (alternatively, a sketchy repair shop), or bought it pre-owned, or if I "lost" it and gets returned to me.
  - grishka 5y ago

deleted 5y ago

[deleted]

fsflover 5y ago

> unlockable bootloaders so the users can load whatever they want Here you go: https://puri.sm/products/librem-5 https://puri.sm/products/librem-5.

HelixEndeavor 5y ago
We shouldn't have to sacrifice performance, quality, and reasonable price points in order to have the basic things we've had in the desktop world for decades.
- deleted 5y ago
  [deleted]
- hdjjhhvvhga 5y ago
  We've only had them for historical reasons. If any of the big manufacturers had the option to invent a "personal computer" now, I'm 100% sure running arbitrary code wouldn't make it to the feature list.
  - horsawlarway 5y ago
    Honestly - I don't think it's just the big manufacturers. If HTML was invented in the current climate, I'm damn well convinced a simple <a href={external domain}> would be shot down for "security" reasons. We're seeing a real breakdown into walled ecosystems. My opinion is that most of the steps that direction are well-intentioned (Safety, Security, Consistency, etc). The end result is fucking hell, though, where the ecosystem owner profits massively and unfairly compared to all other entities.
  - dleslie 5y ago
    That's how IBM built the PC, loosely. They didn't imagine a market where there would be third party expansion cards, and they believed that users should come to them, and their partners, for software. Compaq blew that wide open, much to IBM corporate's dismay and IBM legal's glee.
- pjmlp 5y ago

snarf21 5y ago

I know that a lot of us more tech inclined want this freedom. But grandma is never running toolchain on a computer to install custom software. What 99% of people want is cheap/free and they will give up privacy to get it. I see this as SK giving its citizens what they say they want. I wish that wasn't the case but it seems like that is the world we live in.

kijin 5y ago
Ordinary citizens don't really care. This is SK giving Samsung what they want: an Android-fork OS for their smartwatches and other gadgets where the app store can be controlled by Samsung, not Google.
- turtlebits 5y ago
  I think the issue is Google blocking customizations if they want the Google Play store on the device. I don't think there is anything stopping Samsung from using AOSP.
  - ocdtrekkie 5y ago
    You are incorrect. Google's AFA is viral in nature. Daring to ship a non-Google Android will cancel your ability to ship any devices with Google Play.
pessimizer 5y ago
> I know that a lot of us more tech inclined want this freedom. But grandma is never running toolchain on a computer to install custom software This is thought-terminating nonsense, constantly repeated. What my grandma wants is for me to pick what's best for her and install it. What she doesn't want is Google (or Samsung for that matter) keeping her grandson from doing what he thinks she'll like best. edit: and to be clear, that's what all of my computer-illiterate family members want, although not all of them from me (there are other grandchildren, uncles, etc.). The radical idea that people would rather have decisions made by the people that they love and trust rather than companies that actively and constantly prey upon them should be accepted without question.