5 ms·

>The company can just declare that replacing or altering the firmware voids the warranty How can they know/figure it out? (They can't/or it's prohibitively exp

>The company can just declare that replacing or altering the firmware voids the warranty How can they know/figure it out? (They can't/or it's prohibitively expensive/difficult). >it's very common to find my firmware reverse engineered and available within a month or so of the product being released. Sure, but it's hidden from 99.99% of your user base

terribleperson 3y ago
Prusa (makers of the Prusa 3d printers) set it up so that you had to physically break part of your printer before you could flash custom firmware.
- yjftsjthsd-h 3y ago
  You could also just blow a fuse; we do actually have ways to do write-once memory for this kind of thing
  - nomel 3y ago
    Could you describe a rough implementation, with the assumption that the vendor can still provide firmware updates?
    - folmar 3y ago
      You have it in any unlockable Android phone. In short - write the manufacturer public key in ROM and a fuse selects if signature check is enforce.
    - yjftsjthsd-h 3y ago
      Sure. The vendor firmware contains an option in the settings, "unlock flashing". Enabling this (after a confirmation) will blow the "user modified fuse". When the system boots, the bootloader checks that fuse; if it's blown, then the bootloader will boot any firmware. If not, only boot images signed with the vendor's public key are allowed to boot. When the vendor gets a warranty claim, they check if that fuse is blown; if the fuse is blown and the damage could be software induced, they take that into account (IANAL, but they might not be able to immediately legally refuse it, but they can at least ask pointed questions about what exactly happened; YMMV). Disclaimer: I didn't come up with this, I'm just summarizing approximately how I understand some Android devices to already work. This also makes me view this system as somewhat battle tested.
  - crote 3y ago
    You can't read a blown fuse when the entire MCU is toast, though.
JohnFen 3y ago
> How can they know/figure it out? That's not a difficult problem, technically. There are a number of ways it can be done. Anything from comparing checksums to eFuses. > Sure, but it's hidden from 99.99% of your user base Yes. My point is that avoiding open sourcing firmware because of the risk of piracy or reverse-engineering doesn't make sense because pirates and/or interested engineers will do it directly from the devices anyway.
- brokenmachine 3y ago
  >pirates and/or interested engineers will do it directly from the devices anyway But they don't need to make it too easy by giving the source on a silver platter.
rodgerd 3y ago
> How can they know/figure it out? Sony's answer for Xperia phones used to be that you'd unlock the bootloader with a key you got from them by entering the serial number/IMEI. As part of that, they warn that using custom ROMs that damage the phone - by overclocking, for example - would void the warranty. It's a reasonable compromise, in my opinion.
- selimthegrim 3y ago
  Do they still do this?
  - brokenmachine 3y ago
    Lenovo does

terribleperson 3y ago

Prusa (makers of the Prusa 3d printers) set it up so that you had to physically break part of your printer before you could flash custom firmware.

yjftsjthsd-h 3y ago
You could also just blow a fuse; we do actually have ways to do write-once memory for this kind of thing
- nomel 3y ago
  Could you describe a rough implementation, with the assumption that the vendor can still provide firmware updates?
  - folmar 3y ago
    You have it in any unlockable Android phone. In short - write the manufacturer public key in ROM and a fuse selects if signature check is enforce.
  - yjftsjthsd-h 3y ago
    Sure. The vendor firmware contains an option in the settings, "unlock flashing". Enabling this (after a confirmation) will blow the "user modified fuse". When the system boots, the bootloader checks that fuse; if it's blown, then the bootloader will boot any firmware. If not, only boot images signed with the vendor's public key are allowed to boot. When the vendor gets a warranty claim, they check if that fuse is blown; if the fuse is blown and the damage could be software induced, they take that into account (IANAL, but they might not be able to immediately legally refuse it, but they can at least ask pointed questions about what exactly happened; YMMV). Disclaimer: I didn't come up with this, I'm just summarizing approximately how I understand some Android devices to already work. This also makes me view this system as somewhat battle tested.
- crote 3y ago
  You can't read a blown fuse when the entire MCU is toast, though.

JohnFen 3y ago

> How can they know/figure it out? That's not a difficult problem, technically. There are a number of ways it can be done. Anything from comparing checksums to eFuses. > Sure, but it's hidden from 99.99% of your user base Yes. My point is that avoiding open sourcing firmware because of the risk of piracy or reverse-engineering doesn't make sense because pirates and/or interested engineers will do it directly from the devices anyway.

brokenmachine 3y ago
>pirates and/or interested engineers will do it directly from the devices anyway But they don't need to make it too easy by giving the source on a silver platter.

rodgerd 3y ago

> How can they know/figure it out? Sony's answer for Xperia phones used to be that you'd unlock the bootloader with a key you got from them by entering the serial number/IMEI. As part of that, they warn that using custom ROMs that damage the phone - by overclocking, for example - would void the warranty. It's a reasonable compromise, in my opinion.

selimthegrim 3y ago
Do they still do this?
- brokenmachine 3y ago
  Lenovo does