5 ms·

If protection of the casual user was an argument, there would be an easy option to unlock your system, be that phones or desktop computers. But on many systems

by raxxor 2y ago

If protection of the casual user was an argument, there would be an easy option to unlock your system, be that phones or desktop computers. But on many systems these options do not exist because the vendor likes people dependent on them. This is why devices like chromebooks or all mobile phones are more or less e-waste in the making. In my opinion it is a waste to use any development capacity for these systems apart from consumer devices offering the next shitty app that hopefully always stays optional. We even have dysfunctional laws that require banking apps to only run on these shitty systems. In my opinion, these errors need a quick correction. Also, the most cases of scam still work as they did before and exfiltrating information, e.g. tracking and "diagnostic data" by bad operating systems are an additional security problem.

throw0101a 2y ago
> If protection of the casual user was an argument, there would be an easy option to unlock your system, be that phones or desktop computers. Making it easy to unlock could make it easy(er) for scammers to get it unlocked: > I received the same type of call a little later in the day. They were very adamant they were calling from the Bell data centre, on a terrible line and I made them call back three more times while I considered their requests. They wanted to have me download a program that would have given them controI of my laptop. […] * https://forum.bell.ca/t5/Internet/Call-stating-that-an-issue-was-detected-with-my-modem-or-that/td-p/10823 https://forum.bell.ca/t5/Internet/Call-stating-that-an-issue...
- deleted 2y ago
  [deleted]
- dns_snek 2y ago
  Easy doesn't mean without any warning, it just means that the device is unlockable by design and without OEM's approval. It would be reasonable to: - factory reset the device before unlocking it to protect existing data (like Android phones require) - display warnings, for example "if someone's asking you to do this, it's probably a scam" - for the owner to be allowed to permanently disable unlocking, e.g. the commonly cited example of someone setting the device up for their elderly parents
  - TeMPOraL 2y ago
    > for the owner to be allowed to permanently disable unlocking, e.g. the commonly cited example of someone setting the device up for their elderly parents This opens a wormhole that warps us back to one of the core issues / battlegrounds in computing: ownership, and specifically, the balance of power and responsibility between the owner and the user, when they're not the same person. Unfortunately, the same means and the same arguments cited in case of "someone setting the device up for their elderly parents" also apply to employers "setting the device up" for their employees (where "setting the device up" may just mean letting it access the company network), vendors "helpfully" "setting the device up" for the customers (this is basically the whole history of mobile phones - bootloaders now, SIM locks before), etc. I don't know what the good answer is. I'm personally strongly biased towards "end-user should always be the owner" perspective, and while I recognize there are strong examples where this isn't the case, I can't figure out how to cleanly separate "legitimate interest" from for-profit or for-power abuse.
    - Dylan16807 2y ago
      It seems relatively simple to me. Only the owner is allowed to make these decisions, more or less. Employers can only do it to devices they own and provide. Phone vendors cannot do it, and cannot make any services contingent on doing it. A family member in this situation is reasonably acting on the owner's behalf. And while we're at it, let's not allow apps to refuse to run because of rooting.
    - rendaw 2y ago
      The balance of power between a company and you, vs you and another person, are vastly different, which IMO makes the issues distinct. Presumably the elderly parents are willingly relinquishing control to someone they trust, and they can always go out and buy their own phone if they don't want that.
    - dns_snek 2y ago
      In that scenario I think employers should have the right to make this decision since they own the device and it likely contains sensitive data and credentials belonging to them. But vendors selling devices to retail customers shouldn't be allowed to make that decision unless the customer explicitly asks for help. I think it's pretty consistent, whoever legally owns the device should be allowed to decide what is and isn't allowed to run on it.
- AnthonyMouse 2y ago
  > Making it easy to unlock could make it easy(er) for scammers to get it unlocked Making laptops that weigh two pounds instead of 40 pounds could make it easier for thieves to steal them. Making computers less expensive could increase the number of spammers who can afford one and make it easier to send spam. Making encryption widely available could make it easier for bad actors to communicate. But these things have countervailing benefits, so we do them anyway and then address the problems by a different means. When someone insists on doing it in the way that "incidentally" provides them with a commercial advantage, suspect an ulterior motive.
- inetknght 2y ago
  > Making it easy to unlock could make it easy(er) for scammers to get it unlocked Ahh, if only governments would start cracking down on scammers. Alas, scammers are a feature of modern capitalism. You'd not be wrong if you thought modern businesses are built on scamming people.
- e44858 2y ago
  Unlocking should require a physical modification, like soldering a jumper or flipping an internal switch requiring disassembly. That would filter out basically all scam victims. If a scammer can teach a complete novice how to do micro soldering, they've earned their pay.
  - blacksmith_tb 2y ago
    The Chromebooks that require removing a single internal screw are a fairly civilized example of this approach (might be a little harder to execute in a phone).
    - Vilian 2y ago
      Maybe requiring a PC connection dev options enabled and ADB, high enough barrier?
  - jamesy0ung 2y ago
    The Prusa Mini required you to snap a part of the pcb off to flash custom firmware. I actually like this approach, you have to very deliberately break apart of it to signal that you know what you are doing.
sumtechguy 2y ago
> But on many systems these options do not exist because the vendor likes people dependent on them. Dependent is not exactly the right thing here. Lower support costs probably is. If a vendor gives out root access. If that root access can brick a machine. Then you will get a small percentage of very high touch broken things as returns. Customers like this are in the 'dangerous enough' but not 'good enough to do it correctly' stage of hacking. They will then not claim any responsibility for breaking it. As they are hoping you just fix it for free. I had one customer who would randomly change out stored procedures on our code. Then yell at our tech support for thing not working or being broken. Wasting hundreds of hours of time until we realized what he was doing. Locking him out is very appealing. Instead we sold him and his management on 'we will do the work for you for a fee'. Which was more along the lines of 'you do this again we will fire the customer'. That is but one small thing that can/will happen.
- AnthonyMouse 2y ago
  That only explains why a company wouldn't want to provide free software support for software they didn't write. There are at least two alternatives to that. First, sell hardware the user can replace the software on, or that doesn't even come with software, and then don't provide software support at all. Second, provide software support and bill by the hour, in which case the customer messing up their stuff and calling your support is the opposite of a problem. You can even combine them if you want. Free support for the software that comes with it but if you replace the boot loader then support calls are billed hourly. There is no excuse for not allowing it -- it's leaving money on the table. Unless the reason is that locking the user out of the device has the purpose of monopolizing ancillary markets, which should be an antitrust violation.
- dns_snek 2y ago
  Damage caused by the customer isn't covered by any warranty anyway, and realistically, how many people would tinker with root access as long as the device worked as intended? I'd be really surprised if the number was more than 1 in 100. And if 1 in 20 brick the device in the process, that's 1 in 2000. According to [1] the average warranty claims rate for consumer electronics is 1 in 100. I doubt the difference in support load would even register on the scale. [1] https://www.warrantyweek.com/archive/ww20240711.html https://www.warrantyweek.com/archive/ww20240711.html
pjmlp 2y ago
I guess you want the equivalent of asking an adult friend to buy booze for a party.

by raxxor 2y ago

throw0101a 2y ago

> If protection of the casual user was an argument, there would be an easy option to unlock your system, be that phones or desktop computers. Making it easy to unlock could make it easy(er) for scammers to get it unlocked: > I received the same type of call a little later in the day. They were very adamant they were calling from the Bell data centre, on a terrible line and I made them call back three more times while I considered their requests. They wanted to have me download a program that would have given them controI of my laptop. […] * https://forum.bell.ca/t5/Internet/Call-stating-that-an-issue-was-detected-with-my-modem-or-that/td-p/10823 https://forum.bell.ca/t5/Internet/Call-stating-that-an-issue...

deleted 2y ago
[deleted]
dns_snek 2y ago
Easy doesn't mean without any warning, it just means that the device is unlockable by design and without OEM's approval. It would be reasonable to: - factory reset the device before unlocking it to protect existing data (like Android phones require) - display warnings, for example "if someone's asking you to do this, it's probably a scam" - for the owner to be allowed to permanently disable unlocking, e.g. the commonly cited example of someone setting the device up for their elderly parents
- TeMPOraL 2y ago
  > for the owner to be allowed to permanently disable unlocking, e.g. the commonly cited example of someone setting the device up for their elderly parents This opens a wormhole that warps us back to one of the core issues / battlegrounds in computing: ownership, and specifically, the balance of power and responsibility between the owner and the user, when they're not the same person. Unfortunately, the same means and the same arguments cited in case of "someone setting the device up for their elderly parents" also apply to employers "setting the device up" for their employees (where "setting the device up" may just mean letting it access the company network), vendors "helpfully" "setting the device up" for the customers (this is basically the whole history of mobile phones - bootloaders now, SIM locks before), etc. I don't know what the good answer is. I'm personally strongly biased towards "end-user should always be the owner" perspective, and while I recognize there are strong examples where this isn't the case, I can't figure out how to cleanly separate "legitimate interest" from for-profit or for-power abuse.
  - Dylan16807 2y ago
    It seems relatively simple to me. Only the owner is allowed to make these decisions, more or less. Employers can only do it to devices they own and provide. Phone vendors cannot do it, and cannot make any services contingent on doing it. A family member in this situation is reasonably acting on the owner's behalf. And while we're at it, let's not allow apps to refuse to run because of rooting.
  - rendaw 2y ago
    The balance of power between a company and you, vs you and another person, are vastly different, which IMO makes the issues distinct. Presumably the elderly parents are willingly relinquishing control to someone they trust, and they can always go out and buy their own phone if they don't want that.
  - dns_snek 2y ago
    In that scenario I think employers should have the right to make this decision since they own the device and it likely contains sensitive data and credentials belonging to them. But vendors selling devices to retail customers shouldn't be allowed to make that decision unless the customer explicitly asks for help. I think it's pretty consistent, whoever legally owns the device should be allowed to decide what is and isn't allowed to run on it.
AnthonyMouse 2y ago
> Making it easy to unlock could make it easy(er) for scammers to get it unlocked Making laptops that weigh two pounds instead of 40 pounds could make it easier for thieves to steal them. Making computers less expensive could increase the number of spammers who can afford one and make it easier to send spam. Making encryption widely available could make it easier for bad actors to communicate. But these things have countervailing benefits, so we do them anyway and then address the problems by a different means. When someone insists on doing it in the way that "incidentally" provides them with a commercial advantage, suspect an ulterior motive.
inetknght 2y ago
> Making it easy to unlock could make it easy(er) for scammers to get it unlocked Ahh, if only governments would start cracking down on scammers. Alas, scammers are a feature of modern capitalism. You'd not be wrong if you thought modern businesses are built on scamming people.
e44858 2y ago
Unlocking should require a physical modification, like soldering a jumper or flipping an internal switch requiring disassembly. That would filter out basically all scam victims. If a scammer can teach a complete novice how to do micro soldering, they've earned their pay.
- blacksmith_tb 2y ago
  The Chromebooks that require removing a single internal screw are a fairly civilized example of this approach (might be a little harder to execute in a phone).
  - Vilian 2y ago
    Maybe requiring a PC connection dev options enabled and ADB, high enough barrier?
- jamesy0ung 2y ago
  The Prusa Mini required you to snap a part of the pcb off to flash custom firmware. I actually like this approach, you have to very deliberately break apart of it to signal that you know what you are doing.

sumtechguy 2y ago

> But on many systems these options do not exist because the vendor likes people dependent on them. Dependent is not exactly the right thing here. Lower support costs probably is. If a vendor gives out root access. If that root access can brick a machine. Then you will get a small percentage of very high touch broken things as returns. Customers like this are in the 'dangerous enough' but not 'good enough to do it correctly' stage of hacking. They will then not claim any responsibility for breaking it. As they are hoping you just fix it for free. I had one customer who would randomly change out stored procedures on our code. Then yell at our tech support for thing not working or being broken. Wasting hundreds of hours of time until we realized what he was doing. Locking him out is very appealing. Instead we sold him and his management on 'we will do the work for you for a fee'. Which was more along the lines of 'you do this again we will fire the customer'. That is but one small thing that can/will happen.

AnthonyMouse 2y ago
That only explains why a company wouldn't want to provide free software support for software they didn't write. There are at least two alternatives to that. First, sell hardware the user can replace the software on, or that doesn't even come with software, and then don't provide software support at all. Second, provide software support and bill by the hour, in which case the customer messing up their stuff and calling your support is the opposite of a problem. You can even combine them if you want. Free support for the software that comes with it but if you replace the boot loader then support calls are billed hourly. There is no excuse for not allowing it -- it's leaving money on the table. Unless the reason is that locking the user out of the device has the purpose of monopolizing ancillary markets, which should be an antitrust violation.
dns_snek 2y ago
Damage caused by the customer isn't covered by any warranty anyway, and realistically, how many people would tinker with root access as long as the device worked as intended? I'd be really surprised if the number was more than 1 in 100. And if 1 in 20 brick the device in the process, that's 1 in 2000. According to [1] the average warranty claims rate for consumer electronics is 1 in 100. I doubt the difference in support load would even register on the scale. [1] https://www.warrantyweek.com/archive/ww20240711.html https://www.warrantyweek.com/archive/ww20240711.html

pjmlp 2y ago

I guess you want the equivalent of asking an adult friend to buy booze for a party.