5 ms·

"Magic hostname" mentioned in article (afwprovisioning-pa.googleapis.com) makes me believe this may be related to zero-touch enrollment of Android Enterprise/An

"Magic hostname" mentioned in article (afwprovisioning-pa.googleapis.com) makes me believe this may be related to zero-touch enrollment of Android Enterprise/Android for Work (https://support.google.com/work/android/answer/7514005 https://support.google.com/work/android/answer/7514005). I'm sure devices sold to regular customers and enterprises are identical and nobody is going to unbox and pre-provision them before shipment, so unboxed phone needs to contact provisioning server at least once to verify that there is no pending zero-touch enrollment configuration prepared for it (which may prevent bootloader unlocking if device is enterprise-owned).

dingledork69 4y ago
That just sounds like "you don't get to own your device"
- mlyle 4y ago
  You get to "own your device" after you connect it to the internet once, to make sure it's not pre-provisioned for enterprise use.
  - MereInterest 4y ago
    If the servers are running. If the servers deign to give permission to own the device you purchased. If they correctly recognize that this device is owned by the user. After I've purchased the device, the seller has no right to withhold ownership, and the existence of enterprise devices doesn't change that in the slightest.
    - Dylan16807 4y ago
      If the process doesn't work then return it as defective. Transfer of control isn't happening exactly at sale time but a few hours later isn't a big deal. Though of course that depends on it staying unlocked.
      - dingledork69 4y ago
        And it depends on the user being willing to connect it to the (public) internet without a firewall in between. I wonder if any of the countries that implement a country-wide firewall block this domain. That would disable bootloader unlocking for the entire country.
        shadowgovt 4y ago
        We're talking about a cell phone though, right? A device that sooner or later is going to be connected to a cellular internet that will track it relentlessly? I'd imagine the demographic that is buying the cell phone and then not intending to use it as a phone is not one that Google is losing a lot of sleep over serving poorly.
      - kortilla 4y ago
        This is incorrect. Have you considered that the delay between getting the device and getting it connected could be well outside of the return window or people could be purchasing them in countries without such consumer rights? Smartphones aren’t only for the developed world.
        Dylan16807 4y ago
        Who buys a brand new phone but also has no internet connection for weeks? Do they have all the apps they need pre-downloaded? I don't think that's a big group.
        KennyBlanken 4y ago
        It's quite common for people from elsewhere in the world to buy electronics in the US, Europe, Japan, etc and then bring them back to their home countries for a fraction of the cost of what the official or unofficial importer(s) want. That's why you end up with all sorts of region-locking nonsense, companies trying to protect their importers who have a monopoly on distribution of a particular device.
  - dingledork69 4y ago
    So you don't own it when you buy it. At best Google still owns it and they graciously allow you permission to change the bootloader after you submit to their terms of service. Also, better hope their servers are online and reachable, and that you have functional internet.
    - leni536 4y ago
      The best you can do is to consider it as part of the transaction of buying the device. If it fails for whatever reason, return the device.
    - Gigachad 4y ago
      This is honestly the most overblown issue I've ever seen on HN. How many people are buying a brand new in box pixel to install a custom OS on and do not have an internet connection anywhere, not even a free public wifi? I'd be shocked if this impacts even a single person. At this point it's being angry for the sake of it.
      - Arch-TK 4y ago
        I can totally imagine a situation in which, in the future, someone buys a new old stock pixel phone and can't replace the OS because the bootloader can't be unlocked because the servers don't exist anymore. A few years ago I bought a Nokia N900 which was at the time a 10 year old phone. I did this to use it as a daily driver. Without community support the phone would have been useless. But, more importantly, if the phone required an internet connection to some server in order to let you replace the stock OS then it would have been a brick because Nokia's servers were long gone by then. That being said, all things considered, the most important argument here is not of the practicality but the principle. You handed over money for a piece of hardware but you can't make full use of the hardware until you let the phone talk to the manufacturer once. Thats completely insane irrespective of how small of a perceived issue you think it is.
      - dingledork69 4y ago
        It's possible to care about issues that infringe on people their rights even if they do not affect you personally.
- LiamPowell 4y ago
  This is correct, people generally don't get to own a device provided by their employer. Not allowing the bootloader to be unlocked on company-owned devices seems like a very desirable feature.
  - fkarg 4y ago
    except that their employer[0] doesn't own it either [0] except for the employer being google in this case
  - MereInterest 4y ago
    Not allowing a bootloader to be unlocked on a company-owned device does sound like a desirable feature, but only for company-owned devices. Applying that setup to all phones assumes that the default phone is a company-owned device and is subject to external control.
    - tapoxi 4y ago
      It assumes that company owned and managed phones are more common than people who want to unlock the bootloader. I know this isn't ideal, but that's the correct assumption to make.
      - kortilla 4y ago
        That’s a stupid false dichotomy caused by a poor onboarding workflow. “Well we either make it easier for businesses or deny the right to literally every customer to own their device. It’s okay because most people won’t notice.”
        shadowgovt 4y ago
        You'll notice that the market is not lining up to buy the PinePhone in response to this state of affairs, so I would say that the decision has been working out well for Google. It is very much the case that most people don't care about this definition of freedom.
deleted 4y ago
[deleted]
Wowfunhappy 4y ago
Do you need to actively be connected to the internet while enabling bootloader unlocking, or does the phone merely need to have connected to the internet once at some point? The latter seems reasonable to me in light of your point about enterprise enrollment. However, I'm confused by nelblu's post downthread[1], which describes using wifi to unlock used phones. [1] https://news.ycombinator.com/item?id=35853135 https://news.ycombinator.com/item?id=35853135
- damisanet 4y ago
  According to "Locking/Unlocking the Bootloader" docs (https://source.android.com/docs/core/architecture/bootloader/locking_unlocking https://source.android.com/docs/core/architecture/bootloader...), "(...) the user needs to boot to the home screen, open the Settings > System > Developer options menu and enable the OEM unlocking option (...). After setting, this mode persists across reboots and factory data resets.". My guess would be that if OEM unlocking stays disabled, phone reverts to "greyed-out" setting after each factory reset (yeah, that would be an issue if Google suddenly decides to send Android to graveyard...). I believe actual bootloader unlocking happens inside fastboot mode, outside regular OS and without access to WiFi/cellular data - enabling OEM unlocking is only a prerequisite to actual unlock.
IshKebab 4y ago
Yes this is obviously the reason they do it. They don't want to have to flash different firmware for carriers, consumers, enterprises, etc. I think it's kind of reasonable.
- teaearlgraycold 4y ago
  As an Android engineer I can confirm we are lazy just like software engineers in other companies.
devjab 4y ago
I wonder how this will work for Google. I can only speak for the Danish market, but when we (both private and public Enterprise) buy devices for business we tend to want the supplier to roll them for us. Apple and many Android manufactures does this. At one point we had a bunch of iPads stolen, likely from someone on the inside since they were delivered and then promptly “lifted” from where they had been delivered by someone who had a key and knew where the cameras were. But since Apple has enrolled them for us, they are essentially dead devices. It’s been some time since I worked for the organisation, but when I was still there we frequently got calls from people who had bought the iPad “legitimately” calling us to get it unlocked. Google might not care, since it’s not likely to consider the EU it’s primary market for these things, but I think they risk finding out that their being “lazy” is going to bite them in the ass. Or maybe I don’t understand the bootlicking enough, and what I described above of having a Pixel turn on as “owned by organisation” is entirely possible with it.

dingledork69 4y ago

That just sounds like "you don't get to own your device"

mlyle 4y ago
You get to "own your device" after you connect it to the internet once, to make sure it's not pre-provisioned for enterprise use.
- MereInterest 4y ago
  If the servers are running. If the servers deign to give permission to own the device you purchased. If they correctly recognize that this device is owned by the user. After I've purchased the device, the seller has no right to withhold ownership, and the existence of enterprise devices doesn't change that in the slightest.
  - Dylan16807 4y ago
    If the process doesn't work then return it as defective. Transfer of control isn't happening exactly at sale time but a few hours later isn't a big deal. Though of course that depends on it staying unlocked.
    - dingledork69 4y ago
      And it depends on the user being willing to connect it to the (public) internet without a firewall in between. I wonder if any of the countries that implement a country-wide firewall block this domain. That would disable bootloader unlocking for the entire country.
      - shadowgovt 4y ago
        We're talking about a cell phone though, right? A device that sooner or later is going to be connected to a cellular internet that will track it relentlessly? I'd imagine the demographic that is buying the cell phone and then not intending to use it as a phone is not one that Google is losing a lot of sleep over serving poorly.
    - kortilla 4y ago
      This is incorrect. Have you considered that the delay between getting the device and getting it connected could be well outside of the return window or people could be purchasing them in countries without such consumer rights? Smartphones aren’t only for the developed world.
      - Dylan16807 4y ago
        Who buys a brand new phone but also has no internet connection for weeks? Do they have all the apps they need pre-downloaded? I don't think that's a big group.
        KennyBlanken 4y ago
        It's quite common for people from elsewhere in the world to buy electronics in the US, Europe, Japan, etc and then bring them back to their home countries for a fraction of the cost of what the official or unofficial importer(s) want. That's why you end up with all sorts of region-locking nonsense, companies trying to protect their importers who have a monopoly on distribution of a particular device.
- dingledork69 4y ago
  So you don't own it when you buy it. At best Google still owns it and they graciously allow you permission to change the bootloader after you submit to their terms of service. Also, better hope their servers are online and reachable, and that you have functional internet.
  - leni536 4y ago
    The best you can do is to consider it as part of the transaction of buying the device. If it fails for whatever reason, return the device.
  - Gigachad 4y ago
    This is honestly the most overblown issue I've ever seen on HN. How many people are buying a brand new in box pixel to install a custom OS on and do not have an internet connection anywhere, not even a free public wifi? I'd be shocked if this impacts even a single person. At this point it's being angry for the sake of it.
    - Arch-TK 4y ago
      I can totally imagine a situation in which, in the future, someone buys a new old stock pixel phone and can't replace the OS because the bootloader can't be unlocked because the servers don't exist anymore. A few years ago I bought a Nokia N900 which was at the time a 10 year old phone. I did this to use it as a daily driver. Without community support the phone would have been useless. But, more importantly, if the phone required an internet connection to some server in order to let you replace the stock OS then it would have been a brick because Nokia's servers were long gone by then. That being said, all things considered, the most important argument here is not of the practicality but the principle. You handed over money for a piece of hardware but you can't make full use of the hardware until you let the phone talk to the manufacturer once. Thats completely insane irrespective of how small of a perceived issue you think it is.
    - dingledork69 4y ago
      It's possible to care about issues that infringe on people their rights even if they do not affect you personally.
LiamPowell 4y ago
This is correct, people generally don't get to own a device provided by their employer. Not allowing the bootloader to be unlocked on company-owned devices seems like a very desirable feature.
- fkarg 4y ago
  except that their employer[0] doesn't own it either [0] except for the employer being google in this case
- MereInterest 4y ago
  Not allowing a bootloader to be unlocked on a company-owned device does sound like a desirable feature, but only for company-owned devices. Applying that setup to all phones assumes that the default phone is a company-owned device and is subject to external control.
  - tapoxi 4y ago
    It assumes that company owned and managed phones are more common than people who want to unlock the bootloader. I know this isn't ideal, but that's the correct assumption to make.
    - kortilla 4y ago
      That’s a stupid false dichotomy caused by a poor onboarding workflow. “Well we either make it easier for businesses or deny the right to literally every customer to own their device. It’s okay because most people won’t notice.”
      - shadowgovt 4y ago
        You'll notice that the market is not lining up to buy the PinePhone in response to this state of affairs, so I would say that the decision has been working out well for Google. It is very much the case that most people don't care about this definition of freedom.

deleted 4y ago

[deleted]

Wowfunhappy 4y ago

Do you need to actively be connected to the internet while enabling bootloader unlocking, or does the phone merely need to have connected to the internet once at some point? The latter seems reasonable to me in light of your point about enterprise enrollment. However, I'm confused by nelblu's post downthread[1], which describes using wifi to unlock used phones. [1] https://news.ycombinator.com/item?id=35853135 https://news.ycombinator.com/item?id=35853135

damisanet 4y ago
According to "Locking/Unlocking the Bootloader" docs (https://source.android.com/docs/core/architecture/bootloader/locking_unlocking https://source.android.com/docs/core/architecture/bootloader...), "(...) the user needs to boot to the home screen, open the Settings > System > Developer options menu and enable the OEM unlocking option (...). After setting, this mode persists across reboots and factory data resets.". My guess would be that if OEM unlocking stays disabled, phone reverts to "greyed-out" setting after each factory reset (yeah, that would be an issue if Google suddenly decides to send Android to graveyard...). I believe actual bootloader unlocking happens inside fastboot mode, outside regular OS and without access to WiFi/cellular data - enabling OEM unlocking is only a prerequisite to actual unlock.

IshKebab 4y ago

Yes this is obviously the reason they do it. They don't want to have to flash different firmware for carriers, consumers, enterprises, etc. I think it's kind of reasonable.

teaearlgraycold 4y ago
As an Android engineer I can confirm we are lazy just like software engineers in other companies.

devjab 4y ago

I wonder how this will work for Google. I can only speak for the Danish market, but when we (both private and public Enterprise) buy devices for business we tend to want the supplier to roll them for us. Apple and many Android manufactures does this. At one point we had a bunch of iPads stolen, likely from someone on the inside since they were delivered and then promptly “lifted” from where they had been delivered by someone who had a key and knew where the cameras were. But since Apple has enrolled them for us, they are essentially dead devices. It’s been some time since I worked for the organisation, but when I was still there we frequently got calls from people who had bought the iPad “legitimately” calling us to get it unlocked. Google might not care, since it’s not likely to consider the EU it’s primary market for these things, but I think they risk finding out that their being “lazy” is going to bite them in the ass. Or maybe I don’t understand the bootlicking enough, and what I described above of having a Pixel turn on as “owned by organisation” is entirely possible with it.