10 ms·

I'm almost at the point where I consider any type of firmware update for anything to be actively hostile and to be avoided if at all possible with the sole exce

• markus_zhang 2y ago
  I almost never do firmware update, even for security reasons. You never know what's in the patch, and your data is already sold left and right anyway. I consider myself fully hacked 10 times, and every social media company knows me better than my wife.
  • iforgotpassword 2y ago
    You also never know what's in the original firmware, so why trust it more than the update, security-wise?
    • markus_zhang 2y ago
      I don't trust it anyway. I just use it.
  • brokenmachine 2y ago
    In the update notes for my banking app, it listed the changes as "Minor update to keep the app running smoothly". If it's running smoothly, why does it need an update? I guess it's like an engine that needs fresh oil.
    • goosedragons 2y ago
      90% of Nintendo firmware updates just read "General system stability improvements to enhance the user's experience." It's kind of hilarious at this point. Must be rock solid by now.
      • worthless-trash 2y ago
        That's just lazy patch note writing
      • qingcharles 2y ago
        This is the update notes for practically every mobile app I see now. Never anything specific.
        • 2OEH8eoCRo0 2y ago
          Visual updates is code for bigger and more numerous ads.
• vladvasiliu 2y ago
  > In 2017, Apple put out a new iPhone, and in the same week, made my 1 year old iPhone unusable on purpose overnight to make me buy a new one. I often see people claim something along those lines, but it differs from my experience. In early 2017, I bought a refurbished iPhone 7 which has served me well for 7 years. I've never noticed any sudden deterioration in performance.
  • SOLAR_FIELDS 2y ago
    I think it’s right to call for receipts here. It’s a common refrain that older devices getting updated causes performance to slow to a crawl but exceedingly rare that someone is actually able to demonstrate with data that it was directly tied to an update. That’s not to say it doesn’t happen, but I treat any claim like that with a good deal of skepticism without anything other than anecdata
    • brokenmachine 2y ago
      Apple admitted purposefully slowing down older devices with updates. They said it was to prolong battery life.
      • Syonyk 2y ago
        It was more to prevent unexpected shutdowns. Which, I'll add, were a problem with Android devices at the time, and the Nexus 5, in particular, had three battery OEMs, one of which would only last a year before being unable to run the device in high demand situations (say, "taking a picture with the flash"). As lithium batteries age, their internal resistance goes up - you can model a battery as a voltage source and a series resistor accurately enough. Over time, that resistance goes up, which means, for a given current, you end up with less voltage "at the output." Most power supplies will compensate by pulling more current to provide the needed power, which will drop the voltage more until you slam into the low voltage protection circuitry that cuts power. The Nexus 5s are the ones I'm most familiar with, and they absolutely had this problem with one of the battery OEMs (the only way to tell which OEM you had was to pull the battery out, they were labeled on the back). The typical symptom was, "The phone shuts down when you try to take a picture," because camera modules are power hungry, the CPU was spinning hard to keep up with rendering the view from the camera (and possibly doing some pre/post frame capture to find the best frame, I don't recall when that showed up), and the flash pulls a LOT of current, very briefly. So everything would simply shut down when you hit the button to take the picture. Apple decided to attempt to limit this problem, and they locked out the highest tiers of CPU performance (which are the most power hungry), if the device was having brownout issues. It's a reasonable enough strategy. Where they failed (IMO) was in not alerting the users that it was happening, or that it was a battery health issue. The later iterations of it, where it tracks battery health, and will tell you if your battery is going bad and needs replacement, are what they should have rolled out, and didn't. My guess is that they didn't think it was going to be a major issue for many devices, so it was just a CYA sort of thing that would prevent shutdowns. Unfortunately, that also happened right around the same time that US carriers started dropping the "New phone every 2 years on contract!" thing, and so the iPhones of that era started being used rather substantially longer than the previously-expected 2 years, and, Apple, so drama for clicks. Had they just gone about telling users, "Hey, it looks like your battery is getting weak, would you like to schedule a replacement? Otherwise, we've limited performance slightly to prevent shutdowns." - I think it would have been fine. And they did settle on that eventually. It just took a few iterations.
• dylan604 2y ago
  The motherboard that I bought for my Hackintosh allowed for a thunderbolt port, and worked great with the OS. The motherboard issued a firmware that then removed the functionality of that thunderbolt port. The Hackintosh was pretty much useless at that point, as the external gear I used connected via thunderbolt
  • brokenmachine 2y ago
    I assume that was a BIOS update since you said the motherboard issued a firmware. Couldn't you downgrade the motherboard BIOS?
    • dylan604 2y ago
      yes, it was a BIOS, no it could not be downgraded
      • userbinator 2y ago
        Not if you have a "chip-clip" programmer, but I get your point.
• davesmylie 2y ago
  I have stopped doing them altogether unless there is a known issue that I am trying to resolve. I have some "smart" devices like TVs, printers etc that require local area network access - where ever possible/practical they are blocked from exiting the network at the router level. Even software updates for non critical products are frustrating. I have stopped using some locally installed products (specifically, Evernote), because of it's forced, intrusive upgrade settings. I just want to open the app and quickly read a note, not have to muck around updating (or dismissing the update prompt, what seems like every single time.
  • LadyCailin 2y ago
    Ah, agile workflows, where features have to be completed and fully rolled out within a two week period.
• nop_slide 2y ago
  > I'm almost at the point where I consider any type of firmware update for anything to be actively hostile and to be avoided if at all possible with the sole exception of patches for specific, significant security bugs. I recently bricked my Eufy Baby monitor trying to upgrade the firmware. We got an additional add on camera and it wouldn't connect to the new camera. So I navigated their really piss poor documentation on upgrading the firmware but ended up bricking the whole thing.
  • SOLAR_FIELDS 2y ago
    The unofficial firmware that is maintained by some random person out of a basement in Kansas is infinitely more trustworthy than the vendors firmware itself in iot and simple embedded devices. I run some fork of some custom firmware on an older Nighthawk router in my house and the random person in Kansas updates the thing with security and perf and feature patches monthly. Never one issue upgrading them
• JohnFen 2y ago
  > I'm almost at the point where I consider any type of firmware update for anything to be actively hostile and to be avoided if at all possible I reached that point a number of years ago. I've more recently reached the point where I feel the same about software updates generally, not just firmware ones. A software update all too often means that the main thing you bought the software for is nerfed or removed.
  • genewitch 2y ago
    I have archival computers that I maintain specifically for this. I can run nearly every AI/ML software released since 2018, on the operating system it was designed for, with the correct libraries, and drivers. No docker. All on the metal. I do use venv, but that's so I don't pollute the system with libraries. I disallow internet access, too. That is, I don't put a gateway or DNS server in, but the LAN works.
• mrmuagi 2y ago
  > In 2017, Apple put out a new iPhone, and in the same week, made my 1 year old iPhone unusable on purpose overnight to make me buy a new one. How was it made unusable? > My S23 Ultra got a software update that removed features and now I can't use YouTube. I can't just not install updates, because it will nag me constantly and leave a permanent notification at all times that I cannot remove. What features did it remove?
• happyopossum 2y ago
  > In 2017, Apple put out a new iPhone, and in the same week, made my 1 year old iPhone unusable on purpose overnight to make me buy a new one. Uhh, citation please? I had an iPhone 7 working flawlessly here until I decided to replace it last year. The claim that a company “purposely” made your year old phone useless is beyond hyperbolic without at least a modicum of effort in supporting the claim.
  • brokenmachine 2y ago
    Apple paid out $500M in a class action about exactly this. https://www.bbc.com/news/technology-67911517 https://www.bbc.com/news/technology-67911517 Denied any wrongdoing but still paid $500M... hmmm
    • genewitch 2y ago
      Wow, what is that, like 1/2000th of their valuation? 1/4000th? A quarter of a tenth of a percent? I'd like all my fines to be a quarter of a tenth of a percent of my net worth that'd be awesome.
      • brokenmachine 2y ago
        How much lawyer time would $500M pay for though? Seems to me there might have been some wrongdoing if they decided it was cheaper to pay.
• the__alchemist 2y ago
  I am starting to wonder if critical security update has been co-opted to be using the same logic as think of the children. Who wouldn't support that... then it's used for subtly malicious purposes.
  • b3lvedere 2y ago
    My opinion is that someone who is making the deciscion to reduce the features of the next firmware update of things, is putting security as their top priority as ordered, but have no good idea on how to actually secure some features. So they decide to remove the feature altogether. Axes are cheaper than high fine grade operational instruments. But since the programmers are using resources anyway, why not visit all other departments of the company if they want features modified. Maybe some ideas can generate more money for the company eh?
  • iszomer 2y ago
    And there would be no way for an average consumer to test the security updates themselves and if there are, no way to confirm the validity of its assessment (SnoopSnitch).
  • deleted 2y ago
    [deleted]
• brokenmachine 2y ago
  The consumer should ALWAYS be able to return the product to the exact condition at the time of purchase. My Samsung had a nice feature for the alarms where you could say, "snooze" and it would hear you, instead of having to find the microscopic button. I have a big screen phone, WHY DO THEY MAKE IT SO SMALL? Of course they took that feature away with an "update" that provided nothing else useful.
  • genewitch 2y ago
    Some bigwig at Samsung had a mischievous kid that made them miss meetings by drive by "Snooze"? My kid used to shut my alarm off and then wonder why I was sleeping till 2.
    • alpaca128 2y ago
      I read a story about someone using Spotify for their alarm and sometimes a song would come up that instantly stopped the alarm as the first word in the lyrics triggered the voice recognition.
      • Y_Y 2y ago
        Hey Siri, don't make it bad. Take a sad user experience and make it better. Remember to let her into your wallet, Then you can set a timer for thirteen minutes to make it better.
  • alpaca128 2y ago
    I agree about the microscopic buttons, some buttons on my 13 inch iPad are literally 2mm wide (I measured). I usually have no issues with things like that but man, they really are trying hard to make it difficult. But what annoys me more is that they put in so many gestures and features that sometimes it takes me more than 10 tries just to save an image in the browser because it constantly wants to do some text recognition instead. It’s almost like context menus were useful.
• jcgrillo 2y ago
  If they have to update it after they shipped it, that means they shipped it before it was done. I don't get why we all put up with that. And before you say "but what about the complexity?!?" I'll respond with "why do you think you need that?" I'd pay so much more for simple tools I can buy once and never have to buy another again.
  • baby_souffle 2y ago
    Are you excluding security specific fixes in that policy?
    • jcgrillo 2y ago
      I'm awful tempted to say no. If it's so complex it can't be made secure before shipping it, maybe that's just too much complexity. I could possibly be convinced otherwise, but it would have to be a compelling argument. EDIT: also a lot of the "security" stuff around consumer devices is just active user hostility. I don't need my office printer to connect directly to my home WiFi, a USB cable is fine. If making a secure WiFi enabled printer isn't something we can do as a species, maybe it's just not a reasonable goal.
  • alpaca128 2y ago
    Something can be shipped 100% complete and still gain new features afterwards. The Airpods Pro 2 recently got hearing aid functionality, that doesn’t mean they were incomplete at launch. That said I’d agree in most situations, especially video games.
• LeoPanthera 2y ago
  > made my 1 year old iPhone unusable on purpose overnight to make me buy a new one This claim is obviously not true. The evidence required to believe it would be extraordinary. Do you have it?
  • behnamoh 2y ago
    it is true, multiple sources reported that.
    • sureIy 2y ago
      Older iPhones maybe yes, but not one-year-old iPhones.
    • Dylan16807 2y ago
      No, they reported something that was different in multiple significant ways.
• NoPicklez 2y ago
  Well the whole Apple slowing older device debate has been beaten to death and Apple claims it was a safety net for older devices of which their batteries would be unable to provide enough stable power. Therefore they had to slow the device down to allow to battery to keep up with the device and increase the longevity of the device even if it meant the device was being power managed under particular workloads. Whilst we can have our opinions of the legitimacy of this, I am inclined to agree with it. There have been many people on the other side of the coin who have claimed their device instability was fixed after these updates.
• m463 2y ago
  I agree. For my home machines, I have a jail lan where nothing can get out. If there's a need, I have a proxy and can let specific things out to specific places. After setting that up, my quality of life became SO much better. It's too bad the status quo for tech is basically "everything gets out". I think people should be able to do this easily. Maybe AI can coach "normal" people through this kind of thing.
• smolder 2y ago
  This hostility towards ownership goes way beyond computers. There has been a decades long effort to exclude people from 'productive' society if they don't consent to being controllable and surveilled.
• gjvc 2y ago
  "I'm almost at the point where I consider any type of firmware update for anything to be actively hostile and to be avoided if at all possible ..." Never attribute to malice that which may be adequately explained by incompetence.
  • alpaca128 2y ago
    Never attribute to incompetence what may be adequately explained by market incentives that reward malice.
• Ballas 2y ago
  Updating firmware is like buying new underwear - I do it only when the old ones stop working (or have visible holes).
• hilbert42 2y ago
  "I'm almost at the point where I consider any type of firmware update for anything to be actively hostile and to be avoided if at all possible with the sole exception of patches for specific, significant security bugs." In recent years not one of my printers has been on the net, whether it's a printer on a standalone PC or one on a network. The same applies to printer utilities. With driver bugs I'll download an updated driver, which these days is often in the form of an executable, and I'll block internet access before running it. I take the view that printer updates include user-unfriendly afterthoughts that manufacturers have since dreamt up to further line their pockets at our expense. I always assume that manufacturers will slipstream crud and spyware into driver updates. As for HP, I'd never buy another HP product let alone a HP printer, the last printer I bought would have been around 2005. Why do people still buy HP printers when it's so widely known that to do so is to buy a 'lemon'—nothing but a pile of trouble?
  • roywashere 2y ago
    I think it depends on the brand of printers you buy. I bought a Brother and had trouble getting AirPrint to work. Only to find out after a year that there was an update of the firmware I had not installed, which had been available all along, that fixed the AirPrint issue immediately. Please just stop buying HP and Canon printers!
    • malfist 2y ago
      Just last week there was a news story about brother making a firmware update to "improve print quality" which of course meant refusing to print without "authentic" brother ink
      • michaelcampbell 2y ago
        I believe Brother came out and said this was a bug on their side; whether or not that is more #MarketingRuinsEverything speak I can't say.
        • edoceo 2y ago
• h4ck_th3_pl4n3t 2y ago
  Well, then only buy stuff where you control the software. Check LineageOS build support before you buy a phone. Check Linux distro support before you buy a laptop. Check postmarketOS support before you throw things away. There is options, and they work fairly well. It's just that you have to compromise on convenience for it. And convenience is the most monetary exploited weakness in human behaviors.
  • bigbacaloa 2y ago
    [dead]
  • toyg 2y ago
    > convenience is the most monetary exploited weakness in human behaviors. And there is generally nothing scandalous about it: I pay someone to mown the lawn when I cannot be bothered to do it myself. The problem is that one side of the deal is being exploitative on other levels. One day the gardener shows up and cuts your phone line, because now you can only use the phone company he likes; then every 10 minutes he tells you that he also does home renovations; one day he digs a trench so that the garden can be square, since he has decided he only works with square gardens; then he starts applying a surcharge if the grass grows too quickly. And so on and so forth. You could use another gardener, but there are only two of them in town and they both pull the same stunts.
  • edelhans 2y ago
    Its not always that easy. I specifically bought a Zenfone 9 due to its small size and unlockable bootloader. Guess what - Asus removed the bootloader unlock tool after I purchased the device. Can't trust anyone these days
  • bakugo 2y ago
    > There is options, and they work fairly well. Are you sure? The amount of Android devices being released with support for bootloader unlocking is shrinking every year, and even if you find a phone you like that supports it, good luck getting your bank's app to run on it after doing it. Companies like Google and Apple are doing everything they can to force people to use locked down devices they don't control, and PCs are slowly moving in that direction as well.
• cbanek 2y ago
  This is why I never let my "smart" TVs contact the internet anymore.
• nosioptar 2y ago
  I had a sumsung phone that did that. I specifically bought it because it allowed unlocking the bootloader. It auto updated in the middle of the night, removing the ability to unlock the bootloader. I had a TCL phone that started bootlooping at 3AM after an automatic update. TCL wanted the cost of the phone to repair it. I can't think of a realistic solution. The government could solve it, if they worked for people rather than rich fuckers. There's no way they'd regulate their donors to improve something for their constituency.
  • chii 2y ago
    > It auto updated in the middle of the night lesson learnt - don't set anything to autoupdate. This includes browsers, OS, applications, phones or hardware. Update _after_ you investigated the update. Ideally, check that the update didn't cause problems by googling it, perhaps after a few months or even a year or two. If it aint broke, dont fix it.
    • nosioptar 2y ago
      I didn't set it to auto update. Not only that, I always choose whatever options are available to prevent auto updates. Auto updates should be legally required to be opt in only.
• ChrisRR 2y ago
  > In 2017, Apple put out a new iPhone, and in the same week, made my 1 year old iPhone unusable on purpose overnight to make me buy a new one. I don't follow iphone news. What happened to make it unusable?
• deleted 2y ago
  [deleted]
• deleted 2y ago
  [deleted]
• nonrandomstring 2y ago
  Malicious updates and vendor malware are super hot topics now. Out and out vandalism of private property obviously breaches every flavour of "computer misuse" law. There probably hasn't been a massive class-action against companies like HP because not enough users feel they have redress, or they believe that they "agreed" to malicious acts of vandalism. I doubt HP would find any contractual safety to hide behind here. But the harm I see being done is bigger and more nebulous. It is a massive harm against security in general, and therefore against the public and nation. As you say yourself, it's only sensible to see "updates" as very probably hostile. I would agree. There is debate in security circles about whether one should apply updates at all. Yet, updates are a necessary component of modern security. Forcing malicious updates on users is therefore a "crime against the fabric of society" and I'd love to see a government make an example of HP, Microsoft, or anyone else pushing malicious "updates".