7 ms·

AFAIK, Apple has never retroactively removed functionality from devices people already purchased Selling a walled garden is one thing, building walls around a

AFAIK, Apple has never retroactively removed functionality from devices people already purchased Selling a walled garden is one thing, building walls around a garden you already bought is another thing entirely

ulrikrasmussen 2y ago
This is the Google model then. Base everything on open source, even allow unofficial builds of your operating system (LineageOS, Graphene), but slowly introduce more and more device attestation and DRM so it becomes de facto impossible to actually use anything but the closed builds because everything from banking apps and electronic identification apps to streaming apps will refuse to run on your "unsafe" operating system.
- Arch-TK 2y ago
  Currently the only thing which won't run on a non-google blessed android build is google wallet, although a lot of applications rely on google's proprietary services exposed through google play. I've not ran into any banking applications which won't run on a non-google build of android (as then they would only run on a pixel). That being said, I refuse to seriously bank with any bank which doesn't offer a functioning website. My main bank offers an app but you have to wholesale switch to it.
  - jumski 2y ago
    Revolut stopped working for me on GrapheneOS with an official message "Sorry, Revolut is not supported on devices with custom firmware".
    - piaste 2y ago
      Do you have the sandboxed Play Services installed? It works fine for me on Graphene (just checked). That said, the recommendation I always give, and personally follow: keep a spare phone in a drawer somewhere, with official Android installed, a Google account, and use it exclusively for business purposes - banking, government services, and the email account you use for those (separate from the one you use for everything else). Nothing else, no messaging, socials, browsing, or games. Then you're free to keep your personal phone FOSS and as private as you like, without fear of getting locked out of important stuff due to a crappy Google® SafetyNet® upgrade.
      - jumski 2y ago
        Yes I have. I'm on Pixel 6, just verified again and still no luck for me :-( Thanks for the recommendation tho - you reminded me that I have some old Xiaomi phone that should be able to run it still!
      - Arch-TK 2y ago
        > That said, the recommendation I always give, and personally follow: keep a spare phone in a drawer somewhere, with official Android installed, a Google account, and use it exclusively for business purposes - banking, government services, and the email account you use for those (separate from the one you use for everything else). Nothing else, no messaging, socials, browsing, or games. Anything which doesn't support an alternative method (not involving a proprietary blessed google phone) of management should be illegal if it's government related and should be boycotted if it's not.
        piaste 2y ago
        I certainly agree with the sentiment (I would trust-bust tech giants, and severely restrict advertising as a whole for being a negative-sum game). Nevertheless, for living in this world while preserving your privacy, my advice stands. Separate the devices that you control, which you will use for personal and private purposes, from the devices that global corporations and institutions control, which you will use to access the services those institutions provide - services which, by definition, you would not control anyway. It is far, far simpler than having to get proprietary, frequently-updated software to play nice inside a secure sandbox. If they do, great, but separate devices ensures it isn't a capital-P Problem for you if they stop. (FWIW, I lived in three different European countries over the past decade and so far the governments all offered TOTP-based web alternatives to their apps. When it comes to private banking, only one (Lunar) was available only via app, but it was also the only one that ran without Play Services.)
        Arch-TK 2y ago
        > It is far, far simpler than having to get proprietary, frequently-updated software to play nice inside a secure sandbox. If they do, great, but separate devices ensures it isn't a capital-P Problem for you if they stop. What I am saying (and what I do) is that it's far simpler still to just not rely on anything where this might be the case. If my bank turned around tomorrow and said I can't use their website to manage my account, I would not attempt to get their app working on my phone, I would switch bank.
  - 63stack 2y ago
    Anything that depends on the SafetyNet API will not run if your android build does not pass the checks, the list is much much bigger than "just google wallet". Whether a rom passes safetynet or not very much depends on what google considers blessed today, and what they will consider blessed in the future.
    - Arch-TK 2y ago
      SafetyNet can be implemented by non-google-blessed ROMs (and is implemented by all non-google vendor roms without google's keys). It works on GrapehenOS with their own keys (or you can, if you want, probably use your own keys).
  - ulrikrasmussen 2y ago
    This is false. List of apps which refuse to run on my old OnePlus 6 which I revived with LineageOS: - Danish national identity app (MitID). I had to get a hardware token that generates one-time passwords. - My banking app (still works in the browser though). - The de facto payment app used for peer-to-peer payments and as a credit card alternative all over Denmark (MobilePay). - The app for controlling the heating system in my car. - Revolut. - The app for showing a digital version of my government issued health insurance card. It's literally just a barcode and a number, so I can get by using a photo of the card instead. This underlines the ridiculousness of requiring Play Integrity attestion. - The app for showing a digital version of my driver's license. As a bonus this app also doesn't work if you have set your default browser to Firefox instead of Chrome, even on a non-rooted phone. On top of this, one app for scanning goods in the supermarket stopped working, but without explicitly saying why. I suppose it just silently depends on some Google service, but I have not way of knowing that. I also cannot get Chromecast to work, but that is perhaps to be expected when replacing the Google services with microg, and not strictly a result of DRM. It is a major inconvenience though. Denmark is one of the most digitized countries, and in many ways that is good. However, it also means that you are increasingly coerced into the whole Google/Apple ecosystem and that it is very hard to get out. Luckily there are alternatives to all of the above apps, but it is a major inconvenience to have to use them.
    - Arch-TK 2y ago
      I don't know much about LineageOS but GrapheneOS supports attestation (albeit with its own keys) and it works for all the banking apps I have had the displeasure of using here in the UK including revolut. If LineageOS did support those APIs (which it can support if it wanted to, without any blessing from Google) then presumably most if not all of those should also work. Try GOS and see if it's broken there. If it works on GOS then you can shout at google for ever exposing the attestation APIs but the apps you're complaining about aren't actually abusing attestation in the way you claim, LineageOS is simply choosing not to implement the features they rely on.
      - lucb1e 2y ago
        Pretty sure this also requires the banks to then accept those attestation keys. Graphene pushes for them to do this, so you can't simply run whatever open OS you want on your device (like on desktop where you can also do online banking), you need to specifically use some third party service that then tells the banking software it's really okay to run on your device. I do find this to be a bit crappy, but at the same time it's quite amazing that Graphene has enough traction to convince many app vendors they should support an open/secure OS!
  - bayindirh 2y ago
    None of the unofficial Android builds allows me to access to the secure element in my SIM card to use my e-signature, which works with SIM menu prompts triggered OTA by the application I'm currently using, mostly governmental services. If I'm on a custom ROM, the notification never pops up.
    - Arch-TK 2y ago
      That's not an attestation issue. But have you checked if GrapheneOS handles it?
      - bayindirh 2y ago
        > That's not an attestation issue. Yes, but see my other comment in the thread. It's not something trivial. It's not I didn't dig. > But have you checked if GrapheneOS handles it? I jumped the platform soon after, so I don't have the hardware anymore, so I can't.
    - immibis 2y ago
      You have to have evidence that this is because of attestation, though - lots of open source software is missing lots of features because they are just missing features.
      - bayindirh 2y ago
        It's not an attestation problem, but a trusted pipeline problem. Yes, the required files are missing, but carrying them from official builds doesn't work either, because all pipeline from modem to kernel has to be signed, and the chain breaks somewhere, and you can't build it without the private keys Google/OEM has. It's like Trusted HDCP pipeline. Every part has to be signed properly, and no open distribution of Android can do that, period.
        immibis 2y ago
        Okay but I'd like to see evidence of this because most missing features are just missing features.
- saidinesh5 2y ago
  Did Google ever introduce more device attestation and DRM into an already released device though?
askariwa 2y ago
Just some of them: - Battery Management (iPhone 6, 6s, and SE): In 2017, Apple introduced a battery management feature in iOS 10.2.1 to prevent unexpected shutdowns by throttling the performance of iPhones with degraded batteries. This led to slower device performance without informing users, which is a removal of expected performance functionality. - 32-bit App Support: With the release of iOS 11 in 2017, Apple dropped support for 32-bit apps. This meant users could no longer use older apps that had not been updated to 64-bit, effectively removing access to those apps on updated devices = You want the new OS? -> you have less functionality. - Pulse oximetry features were recently removed from new Apple Watches due to Masimo's patent infringement claim.
- least 2y ago
  The last one doesn’t really hold up since the feature is still available on devices that they were delivered on. My watch has the feature still.
- Iulioh 2y ago
  I remember one guy ranting a lot about navigation with the apple pen
- po 2y ago
  > This led to slower device performance without informing users, which is a removal of expected performance functionality. As opposed to the device unexpectedly shutting down due to a degraded battery not being able to push enough energy to support the CPU? They didn't remove expected performance, they prevented crashes which are by definition 0 performance. All Li-ion batteries degrade over time. That's not removing a feature... This whole thing was totally overblown.
  - askariwa 2y ago
    Well, they DID remove expected performance by slowing CPU performance, disn't they? People who had bought these iPhones (and not the previous ones) did so also because of the promise of a more powerful CPU, a promise broken by Apple. It is removing a feature (a better CPU) and Apple knew it that's why they did it without informing users.
mls-pl 2y ago
And main difference with Apple is that you don't have to log in to their services on iPhone yet still have full _phone_ functionality.
- cowl 2y ago
  the keyword being _phone_, not smartphone. Bambulab too will let you print from SD card without logging in their infra, they are just locking the rest of the ecosystem. 1 to 1 analogy.
  - mls-pl 2y ago
    It's still a smartphone - with web browsing, mail and everything else what's available out-of-the-box. And Bambu will cut out even local network access and, as they stated in "Terms of Use", can lock print jobs until you update firmware. Far from 1:1 analogy...
    - vitaflo 2y ago
      They are actually adding in LAN modes (standard and developer) with these changes so I'm not sure what you're talking about with them cutting out local network access. Neither will require auth.
nunobrito 2y ago
They did even worse. New firmware upgrades made older devices slower and painfully unusable: https://www.techradar.com/news/apple-might-be-slowing-down-your-old-iphone-on-purpose https://www.techradar.com/news/apple-might-be-slowing-down-y... And they have plenty of experience building walls around a garden. Ask anyone using OSX for the past 15 years and you will see how difficult it has become to write or publish software for Apple.
- kennywinker 2y ago
  Alternate description of the same information: “newer upgrades made older devices batteries’ last longer” They did nerf speed. But they did it for a reason. I get being mad about your phone being slowed down, but i don’t get being mad about it once you understand why.
  - autoexec 2y ago
    > They did nerf speed. But they did it for a reason. That reason was to incentivize people to replace their old "slow" phones with faster new phones. If Apple actually cared about the problem of older phones having limited battery life they'd have made the batteries in their phones replaceable.
    - wpm 2y ago
      They are replaceable. I've replaced batteries in older iPhones plenty of times, had Apple replace the battery in a few, and I'm probably going to use the Self Service program to get the parts for my 14 Pro Max soon as it's getting a bit tired out.
      - autoexec 2y ago
        I suppose that anything is "replaceable" if you're willing to involve things like soldering irons, heat guns, or specialized tools, but replacing a battery on an iphone is not something that the vast majority of the population would be equipped to do or be comfortable doing.
cap11235 2y ago
[flagged]
makeitdouble 2y ago
As the issue here came through software update, you should look at it under the same lens for Apple. For instance did an OS update ever prevent you from doing something that you could before ? Yes. Countless times. OS updates have breaking changes, older apps lose support etc. And for iOS these updates are irreversible under supported ways, while the very nature of the "there's an app for this" paradigm means losing a third party app equals losing that functionality for your device when you upgrade (you won't get a translation layer or virtualization to help the transition) You may like Apple more and feel they communicate better, but fundamentally it's the same situation.

ulrikrasmussen 2y ago

This is the Google model then. Base everything on open source, even allow unofficial builds of your operating system (LineageOS, Graphene), but slowly introduce more and more device attestation and DRM so it becomes de facto impossible to actually use anything but the closed builds because everything from banking apps and electronic identification apps to streaming apps will refuse to run on your "unsafe" operating system.

Arch-TK 2y ago
Currently the only thing which won't run on a non-google blessed android build is google wallet, although a lot of applications rely on google's proprietary services exposed through google play. I've not ran into any banking applications which won't run on a non-google build of android (as then they would only run on a pixel). That being said, I refuse to seriously bank with any bank which doesn't offer a functioning website. My main bank offers an app but you have to wholesale switch to it.
- jumski 2y ago
  Revolut stopped working for me on GrapheneOS with an official message "Sorry, Revolut is not supported on devices with custom firmware".
  - piaste 2y ago
    Do you have the sandboxed Play Services installed? It works fine for me on Graphene (just checked). That said, the recommendation I always give, and personally follow: keep a spare phone in a drawer somewhere, with official Android installed, a Google account, and use it exclusively for business purposes - banking, government services, and the email account you use for those (separate from the one you use for everything else). Nothing else, no messaging, socials, browsing, or games. Then you're free to keep your personal phone FOSS and as private as you like, without fear of getting locked out of important stuff due to a crappy Google® SafetyNet® upgrade.
    - jumski 2y ago
      Yes I have. I'm on Pixel 6, just verified again and still no luck for me :-( Thanks for the recommendation tho - you reminded me that I have some old Xiaomi phone that should be able to run it still!
    - Arch-TK 2y ago
      > That said, the recommendation I always give, and personally follow: keep a spare phone in a drawer somewhere, with official Android installed, a Google account, and use it exclusively for business purposes - banking, government services, and the email account you use for those (separate from the one you use for everything else). Nothing else, no messaging, socials, browsing, or games. Anything which doesn't support an alternative method (not involving a proprietary blessed google phone) of management should be illegal if it's government related and should be boycotted if it's not.
      - piaste 2y ago
        I certainly agree with the sentiment (I would trust-bust tech giants, and severely restrict advertising as a whole for being a negative-sum game). Nevertheless, for living in this world while preserving your privacy, my advice stands. Separate the devices that you control, which you will use for personal and private purposes, from the devices that global corporations and institutions control, which you will use to access the services those institutions provide - services which, by definition, you would not control anyway. It is far, far simpler than having to get proprietary, frequently-updated software to play nice inside a secure sandbox. If they do, great, but separate devices ensures it isn't a capital-P Problem for you if they stop. (FWIW, I lived in three different European countries over the past decade and so far the governments all offered TOTP-based web alternatives to their apps. When it comes to private banking, only one (Lunar) was available only via app, but it was also the only one that ran without Play Services.)
        Arch-TK 2y ago
        > It is far, far simpler than having to get proprietary, frequently-updated software to play nice inside a secure sandbox. If they do, great, but separate devices ensures it isn't a capital-P Problem for you if they stop. What I am saying (and what I do) is that it's far simpler still to just not rely on anything where this might be the case. If my bank turned around tomorrow and said I can't use their website to manage my account, I would not attempt to get their app working on my phone, I would switch bank.
- 63stack 2y ago
  Anything that depends on the SafetyNet API will not run if your android build does not pass the checks, the list is much much bigger than "just google wallet". Whether a rom passes safetynet or not very much depends on what google considers blessed today, and what they will consider blessed in the future.
  - Arch-TK 2y ago
    SafetyNet can be implemented by non-google-blessed ROMs (and is implemented by all non-google vendor roms without google's keys). It works on GrapehenOS with their own keys (or you can, if you want, probably use your own keys).
- ulrikrasmussen 2y ago
  This is false. List of apps which refuse to run on my old OnePlus 6 which I revived with LineageOS: - Danish national identity app (MitID). I had to get a hardware token that generates one-time passwords. - My banking app (still works in the browser though). - The de facto payment app used for peer-to-peer payments and as a credit card alternative all over Denmark (MobilePay). - The app for controlling the heating system in my car. - Revolut. - The app for showing a digital version of my government issued health insurance card. It's literally just a barcode and a number, so I can get by using a photo of the card instead. This underlines the ridiculousness of requiring Play Integrity attestion. - The app for showing a digital version of my driver's license. As a bonus this app also doesn't work if you have set your default browser to Firefox instead of Chrome, even on a non-rooted phone. On top of this, one app for scanning goods in the supermarket stopped working, but without explicitly saying why. I suppose it just silently depends on some Google service, but I have not way of knowing that. I also cannot get Chromecast to work, but that is perhaps to be expected when replacing the Google services with microg, and not strictly a result of DRM. It is a major inconvenience though. Denmark is one of the most digitized countries, and in many ways that is good. However, it also means that you are increasingly coerced into the whole Google/Apple ecosystem and that it is very hard to get out. Luckily there are alternatives to all of the above apps, but it is a major inconvenience to have to use them.
  - Arch-TK 2y ago
    I don't know much about LineageOS but GrapheneOS supports attestation (albeit with its own keys) and it works for all the banking apps I have had the displeasure of using here in the UK including revolut. If LineageOS did support those APIs (which it can support if it wanted to, without any blessing from Google) then presumably most if not all of those should also work. Try GOS and see if it's broken there. If it works on GOS then you can shout at google for ever exposing the attestation APIs but the apps you're complaining about aren't actually abusing attestation in the way you claim, LineageOS is simply choosing not to implement the features they rely on.
    - lucb1e 2y ago
      Pretty sure this also requires the banks to then accept those attestation keys. Graphene pushes for them to do this, so you can't simply run whatever open OS you want on your device (like on desktop where you can also do online banking), you need to specifically use some third party service that then tells the banking software it's really okay to run on your device. I do find this to be a bit crappy, but at the same time it's quite amazing that Graphene has enough traction to convince many app vendors they should support an open/secure OS!
- bayindirh 2y ago
  None of the unofficial Android builds allows me to access to the secure element in my SIM card to use my e-signature, which works with SIM menu prompts triggered OTA by the application I'm currently using, mostly governmental services. If I'm on a custom ROM, the notification never pops up.
  - Arch-TK 2y ago
    That's not an attestation issue. But have you checked if GrapheneOS handles it?
    - bayindirh 2y ago
      > That's not an attestation issue. Yes, but see my other comment in the thread. It's not something trivial. It's not I didn't dig. > But have you checked if GrapheneOS handles it? I jumped the platform soon after, so I don't have the hardware anymore, so I can't.
  - immibis 2y ago
    You have to have evidence that this is because of attestation, though - lots of open source software is missing lots of features because they are just missing features.
    - bayindirh 2y ago
      It's not an attestation problem, but a trusted pipeline problem. Yes, the required files are missing, but carrying them from official builds doesn't work either, because all pipeline from modem to kernel has to be signed, and the chain breaks somewhere, and you can't build it without the private keys Google/OEM has. It's like Trusted HDCP pipeline. Every part has to be signed properly, and no open distribution of Android can do that, period.
      - immibis 2y ago
        Okay but I'd like to see evidence of this because most missing features are just missing features.
saidinesh5 2y ago
Did Google ever introduce more device attestation and DRM into an already released device though?

askariwa 2y ago

Just some of them: - Battery Management (iPhone 6, 6s, and SE): In 2017, Apple introduced a battery management feature in iOS 10.2.1 to prevent unexpected shutdowns by throttling the performance of iPhones with degraded batteries. This led to slower device performance without informing users, which is a removal of expected performance functionality. - 32-bit App Support: With the release of iOS 11 in 2017, Apple dropped support for 32-bit apps. This meant users could no longer use older apps that had not been updated to 64-bit, effectively removing access to those apps on updated devices = You want the new OS? -> you have less functionality. - Pulse oximetry features were recently removed from new Apple Watches due to Masimo's patent infringement claim.

least 2y ago
The last one doesn’t really hold up since the feature is still available on devices that they were delivered on. My watch has the feature still.
Iulioh 2y ago
I remember one guy ranting a lot about navigation with the apple pen
po 2y ago
> This led to slower device performance without informing users, which is a removal of expected performance functionality. As opposed to the device unexpectedly shutting down due to a degraded battery not being able to push enough energy to support the CPU? They didn't remove expected performance, they prevented crashes which are by definition 0 performance. All Li-ion batteries degrade over time. That's not removing a feature... This whole thing was totally overblown.
- askariwa 2y ago
  Well, they DID remove expected performance by slowing CPU performance, disn't they? People who had bought these iPhones (and not the previous ones) did so also because of the promise of a more powerful CPU, a promise broken by Apple. It is removing a feature (a better CPU) and Apple knew it that's why they did it without informing users.

mls-pl 2y ago

And main difference with Apple is that you don't have to log in to their services on iPhone yet still have full _phone_ functionality.

cowl 2y ago
the keyword being _phone_, not smartphone. Bambulab too will let you print from SD card without logging in their infra, they are just locking the rest of the ecosystem. 1 to 1 analogy.
- mls-pl 2y ago
  It's still a smartphone - with web browsing, mail and everything else what's available out-of-the-box. And Bambu will cut out even local network access and, as they stated in "Terms of Use", can lock print jobs until you update firmware. Far from 1:1 analogy...
  - vitaflo 2y ago
    They are actually adding in LAN modes (standard and developer) with these changes so I'm not sure what you're talking about with them cutting out local network access. Neither will require auth.

nunobrito 2y ago

They did even worse. New firmware upgrades made older devices slower and painfully unusable: https://www.techradar.com/news/apple-might-be-slowing-down-your-old-iphone-on-purpose https://www.techradar.com/news/apple-might-be-slowing-down-y... And they have plenty of experience building walls around a garden. Ask anyone using OSX for the past 15 years and you will see how difficult it has become to write or publish software for Apple.

kennywinker 2y ago
Alternate description of the same information: “newer upgrades made older devices batteries’ last longer” They did nerf speed. But they did it for a reason. I get being mad about your phone being slowed down, but i don’t get being mad about it once you understand why.
- autoexec 2y ago
  > They did nerf speed. But they did it for a reason. That reason was to incentivize people to replace their old "slow" phones with faster new phones. If Apple actually cared about the problem of older phones having limited battery life they'd have made the batteries in their phones replaceable.
  - wpm 2y ago
    They are replaceable. I've replaced batteries in older iPhones plenty of times, had Apple replace the battery in a few, and I'm probably going to use the Self Service program to get the parts for my 14 Pro Max soon as it's getting a bit tired out.
    - autoexec 2y ago
      I suppose that anything is "replaceable" if you're willing to involve things like soldering irons, heat guns, or specialized tools, but replacing a battery on an iphone is not something that the vast majority of the population would be equipped to do or be comfortable doing.

cap11235 2y ago

[flagged]

makeitdouble 2y ago

As the issue here came through software update, you should look at it under the same lens for Apple. For instance did an OS update ever prevent you from doing something that you could before ? Yes. Countless times. OS updates have breaking changes, older apps lose support etc. And for iOS these updates are irreversible under supported ways, while the very nature of the "there's an app for this" paradigm means losing a third party app equals losing that functionality for your device when you upgrade (you won't get a translation layer or virtualization to help the transition) You may like Apple more and feel they communicate better, but fundamentally it's the same situation.