Right to root access

https://medhir.com/blog/right-to-root-access

by medhir • 2 years ago

487 411 2 years ago

p_ing3• 2 years ago

Author seems to want 'hardware-level locks' regulated, i.e., allow the government to get into your encrypted devices.

drannex• 2 years ago

That is absolutely not what the author is saying here, just that users should have the ability to install their own software on their own hardware, and that locked bootloaders and the like should not be allowed.

zb34• 2 years ago

I want to install my own software on my smartphone. However, I don't want others with physical access to be able to do this... here we hit a problem, because if the device allows extracting the data, bruteforce becomes feasible..

Also I don't want others to be able to use my phone after stealing it.. here FRP lock helps me but in order for it to work it must also limit how I can use the phone.

I wish we stopped falling for this technical trap and finally focus on the substance - hardware/software companies get away with anti-user features that run on the user's device. This shouldn't be allowed.

I don't need an unlocked bootloader, I just don't want the preinstalled Google spyware. Google should not be allowed to hold my device hostage like this.

p_ing3• 2 years ago

Yes, that is exactly what the author is saying, wanting government regulation. For one, the government won't simply say "keep the device open for the end user" (or a "smart" government wouldn't), but even if they did, you've now opened that device to any attacker, law enforcement included.

zb34• 2 years ago

Root access refers to the highest level of privileges a user can be granted to a computer system.

This is no longer true. You might have root access on your smartphone, but you still don't have access to the TEE (on ARM this is implemented using the "TrustZone" "feature").

Also, AVF is coming to Android, and protected VMs won't work with unlocked bootloader.. so expect the situation to deteriorate further once manufacturers make use of pVMs..

zb34• 2 years ago

The TEE is where both the device encryption keys (not DRM) and Widevine keys (DRM) are stored..

TechDebtDevin• 2 years ago

So basically a TDM?

causality03• 2 years ago

There's not nearly enough awareness of this. Even with root access, on modern Android you have to set up a virtual USB connection just to get at the files in the data folders of android apps if you want to, for example, sync the savegames between your mobile emulators and your desktop emulators. It's fucking disgusting. With every new edition they shave off a little more user agency.

stavros19• 2 years ago

What do you mean "a virtual USB connection"? With root access I can see all the files on my Android phone.

qmr3• 2 years ago

It's sad how Google has perverted what Android was meant to be.

puppycodes3• 2 years ago

Yeah I mean theres not even any way to really know what your communicating with without taking the thing apart and following the traces + an ocilliscope. If it was worth obfuscating to a determined company it would be hell to figure out.

You could just be a sandbox root which is pointed at a guest user in a higher namespace.

mixdup11• 2 years ago

For some, the absolute locked down-ness is a selling point. Why should those who want to buy something that can't be messed with not be able to?

If you don't want to buy something you can't install whatever you want onto, don't buy it. 100% the ability or inability to modify the firmware of a device should be disclosed, but if it's disclosed the seller should be able to set the policy to whatever they want

stavros19• 2 years ago

This is an extremely weak argument, and I'd like to stop seeing it perpetuated. If you don't want an unlocked bootloader, just don't unlock your bootloader. Why should we remove the ability to unlock the bootloader entirely just because some people don't want to use it?

mixdup11• 2 years ago

Because the fact that it can't be unlocked makes me reasonably reassured that I can trust the software running on it comes from the vendor of the device

It's the same reason I don't want "the good guys" to have decryption keys to my messaging service, because even if I did trust the FBI, the fact that there is a backdoor at all means it could be exploited by someone I don't trust

Again, if you don't want to use a device that has a locked bootloader, don't buy it. I fail to see how this business model should be legally foreclosed upon. You'll always have the option to buy a device that can be unlocked, someone will always sell such a device. But if you can't lock them, then I can't buy one even if I want to

jbombadil2• 2 years ago

If you don't want an unlocked bootloader, just don't unlock your bootloader.

That kind of logic cuts both ways: "If you don't want a device with a locked boot loader, just don't buy a device with a locked bootloader".

Unfortunately, as consumers, we're trapped between a rock and a hard place. On the one hand, I would want 100% freedom to use my device exactly as I see fit and run any software I want, without any form of curation from the manufacturer. On the other hand, there are plenty of software companies who do shitty things when given absolute freedom over what to do in a user's device (tracking / spying / etc) and I welcome buying a device where the manufacturer helps me fight some of that.

So I can absolutely see both arguments. And I think both types can coexist. I am happy my iPhone doesn't allow Meta to say "to use WhatsApp, you must install the MetaStore®, give it root and install it from there". I would not be happy with those restrictions on my desktop.

puppycodes3• 2 years ago

not sure if your in the US, but we can't even get net neutrality. Unfortuantely the likelyhood of this is a hell freezing over situation.

I would start with, laws should be logical and informed and go from there... the number of prerequisite changes required to come mildly close to this is unreal. Including but not limited too: copyright law, insurance law, patents, contract law, federal vs state law, an agency competent enough to enforce this, lobby from the most powerful companies in the world, and more.

In dream land I support you though.

qmr3• 2 years ago

California is typically pro consumer, tenant, employee.

If it could be passed in California it would trickle down elsewhere.

e.g. California emissions mandates leading to less emissions in the entire country because it makes more sense at scale to build 1 SKU.

puppycodes3• 2 years ago

I agree states can more quickly change laws, but thats a far cry from what's proposed here. Can you imagine enforcement of such a law? Can you imagine a state employee checking for root access? You break at least five California laws an hour there just walking around as the beauracratic machine consumes any reasonable enforcement. This would be considered absolutely niche and no politician would likely care because it wont get them reelected. Call me cynical I guess but our track record of change for the better is pretty poor in this arena.

In my dream we abolish copyright all together but alas we live in a profit oriented society not a knowledge oriented one.

bigstrat20032• 2 years ago

Let's not have more of a single state passing de facto laws for the entire country, please. You're right that this happens, but it's an awful thing that we need to fight, not promote more of.

theandrewbailey• 2 years ago

I believe consumers, as a right, should be able to install software of their choosing to any computing device that is owned outright.

Manufacturers will then claim that people don't own devices, merely a perpetual license to use it.

zb34• 2 years ago

... plus the license to smash those devices with a hammer :)

shmerl2• 2 years ago

That's a slippery slope, because they list devices as sold, not as rented. So they can't claim that. Some still try, especially using copyright on software on the devices as leverage.

jmb999• 2 years ago

More than likely, they’ll instead just start actually renting you the products. See Apple’s 2-year rental program for a (relatively) non-predatory implementation, or NZXT’s for a very predatory implementation.

lapcat28• 2 years ago

Manufacturers will then claim that people don't own devices, merely a perpetual license to use it.

It would be refreshing for them to be honest about their monetary greed instead of telling false stories about "security" and what's "good for users".

emmelaich8• 2 years ago

I used to think this way but then I saw how non-techy people use their devices.

Something like this would inevitably be abused and result in wave of malware so massive that it would render the internet too hostile for all but the most careful, knowledgable and paranoid users.

Palomides• 2 years ago

"everyone is too stupid to be trusted with general purpose computers" is a pretty grim position to hold

emmelaich8• 2 years ago

You left out the vital clause. "... if they have total unfettered control". Also, not everyone. Obviously.

It's a position I came to rather regretfully and sadly.

gjsman-10004• 2 years ago

A grim position that is completely accurate for over 90% of people.

lightedman2• 2 years ago

A grim position that accurately reflects my 36 years of experience involving people and computers.

lapcat28• 2 years ago

As the author mentions, desktop computers have always been (mostly) unlocked. This comment is just over the top scaremongering.

emmelaich8• 2 years ago

Even with access controls, people do things like download chrome from random web sites, then do their banking with the result. If the fake-chrome requested admin access then you'd never be able trust anything on that computer ever again. Even re-installing the OS wouldn't fix it.

It would no longer be your computer.

emmelaich8• 2 years ago

Yep, and if you connected a Windows95 machine to the internet it would be compromised within 15 minutes.

qmr3• 2 years ago

Stupidest take I've seen today.

There are already myriad unlockable devices.

What a bizarre fantasy you have constructed.

emmelaich8• 2 years ago

Let me clarify .. if you have an unlocked device, then software vendors should be able to ensure that their software is non-functional on such a device.

Given that, then anything very useful would be rendered non-functional, resulting in the device probably being useless.

BeFlatXIII2• 2 years ago

Good. Boot the normies offline again. Bring back the glory days of the internet being an exclusive club of nerds.

lrvick• 2 years ago

I detest Google, but I do think they made the right call with Android devices and Chromebooks. You can unlock either as long as you are willing to totally wipe the device first and start over as a new device under a new security context.

This removes the risk of this being abused to compromise the data of stolen devices or evil maid attacks unless a user that knows what they are doing has explicitly opted themselves into that risk.

alex77342• 2 years ago

This, or even sell "dev units" with the bootloader unlocked so that you explicitly have to accept the risk before purchasing the device.

The problem though is that rooting by itself is not that useful when a lot of apps use remote attestation to deny you service if you're rooted.

We don't just need root access, we need undetectable root access.

cwalv7• 2 years ago

We don't just need root access, we need undetectable root access.

At some point the argument morphs from 'I should be able to do whatever I want with my device' to 'I should be able to access your service/device with whatever I want'.

The fact that Google allows this shows that

1. Apple could do it with zero security impact on anyone who doesn't opt in

2. They could keep any service-based profit source intact

But they still would never do it. Because it's not only service based profit they want to protect. They want to restrict customers from running competitor's software on their hardware, to ensure they get their cut.

bboygravity2• 2 years ago

I agree useful rooting should be easier, but it's definitely possible and not super hard to hide rooting.

I'm typing this on a rooted phone where all (banking) apps work just fine. All it takes is downloading an app (magisk) and add apps to a list that need to have rooting hidden.

yndoendo• 2 years ago

I contacted the Google through the BBB. Made the statement that lack of ability to install and configure a Kernel level firewall, edit the HOSTS file, and remove unwanted bloat-ware reduces the security of the product. Google agreed their actions do this and said they find the lack of security acceptable. Having a firewall like Little Snitch should be acceptable to know where the phone is communicate, with whom, and how to prevent it.

Re-imaging with a rooted image is not acceptable because this also reduces the device's security by prevent OTA updates!

Gated community is broken when the end user cannot improve the security of the device above and beyond the lack polices of Google and Apple. For instant there should be no reason my device ever communicates with organizations I do not support such as Facebook or X-Twitter. X-Twitter is often used as command and control service in plain site.

It is not just out-wards communicate to monitor but in-wards too. I've used Zone Alarm in the past at an international company to help find the infected servers and computers that where serving up viruses and other malware.

*I would argue that the "Gated Community" analogy is flawed. A real world gated community still allows for the home owner to improve the security. By installing cameras, security system, and guards. Apple & Google prevent such actions.

arsome• 2 years ago

There are indeed software firewalls on Android that use the VPN functionality to implement something like this so they don't even require root, I believe Glasswire offers one.

stavros19• 2 years ago

Agreed, that's a good solution. I can root my phone immediately when I buy it, or I can leave it locked if that's my choice. That's the best of both worlds.

yjftsjthsd-h5• 2 years ago

I would argue that the best of both worlds is being able to add your own keys and then relock the bootloader. Which Pixel devices also do:) Not sure about Chromebooks; I kinda think you maybe could reflash the firmware and then put back the write-protect screw?

botanical76• 2 years ago

It does create an interesting choice, though. For example, certain apps will enforce attestation based on the bootloader status. Even if the user wipes their device and relocks their bootloader with their own keys, this doesn't count as fully secure per the bootloader status. Only Google's keys count. Of course, it is also almost prohibitively difficult to deliver yourself OTA updates after this point. I worry that one day I will have to keep two mobile phones; one for bank apps, which has not been altered from the vendor's security defaults, and one for everything else, that I am actually allowed to modify.

At the moment, I just run GrapheneOS and don't bother with any modification. It is not worth the hassle. I've already had my bank account locked out because a Google Store-bought Pixel phone was flagged as "stolen", probably due to some attestation measure (they could not tell me why). They recommended that I purchase a new phone.

JeremyNT• 2 years ago

Right now, although it's possible to use Android with either root or a third party ROM, attestation breaks all sorts of little things. Today this is mostly banking apps, and anything that involves NFC, but this isn't where it's going to end.

Attestation requirements are only going to become more prevalent. I predict that in a few years basically all proprietary software for Android will require attestation.

So... you may still be able to unlock the device and make it yours, but you'll also be locked out of the ever expanding and ever-more-isolated walled garden.

If you can live off of GrapheneOS and F-Droid, that's great, but for a lot of users this won't be a real choice, because you increasingly need proprietary software for access to real things in the physical world (i.e. I needed to install a special app for event tickets recently).

grishka5• 2 years ago

The problem with bootloader unlocking on modern Android devices is that they have a hypervisor that you don't get to ever unlock but that will snitch on you and make some apps, like some banking ones, refuse to work because the "integrity" of your device could not be verified. In other words, because these apps can no longer be certain they are able to hide data from you the device owner.

Magisk exists, yes, but it's a flimsy temporary solution. It only works because it's able to lie to Google that your device doesn't support hardware attestation. As soon as Google starts requiring that all devices support hardware attestation, it will stop working.

flutas• 2 years ago

It's even worse now with the P9 series.

They require hardware certification for the Pixel Screenshots app... and for anything that uses Gemini Nano (Call recorder summary, weather, pixel screenshots, etc).

surajrmal• 2 years ago

If software doesn't want to run on your hardware because it can't make sure you're not tampering with it, why is it wrong for doing so? You're not necessarily entitled to the ability to run the software right? I understand the implications this has on ones ability to create custom operating systems is troubling (eg this could destroy desktop Linux), but at the end of the day I guess it is just a choice the developer is allowed to make. It's not like they distribute the binary with no strings attached.

And there are some real strong reasons why you benefit from this sort of ability, such as preventing folks from cheating in competitive games. I can't say that all uses seem to have good reasons to use it, but that seems like more of a vote with your wallet sort of situation. Perhaps the play store should also have stricter requirements on acceptable use of attestation and ensure they are upheld.

jazzyjackson• 2 years ago

If locking the bootloader and comparing signatures against keys burned into a secure enclave allow Apple to make certain security guarantees that helps them sell products, I'm all for their freedom to do so.

Why doesn't OP merely champion competition, instead of encouraging regulation of what software others can write, what hardware others can ship?

I too am afraid of general purpose computing going by the wayside, and I have the Precursor phone and Raptor Talos PowerPC machines on my wishlist, just as soon as I wrap my head around secure boot chains in general before having to implement one myself. But niche hardware is expensive to produce, so we're likely left with what AMD, Intel and Apple provides us.

I guess one quirk that IMO is fair to criticize is that it's not necessarily consumers who are demanding to be locked out of their administrator privileges (the average computer user is of course not aware of the distinction of signed vs unsigned binaries), so I don't know where the pressure for secure enclaves really comes from. Is it the data centers buying thousands of chips that don't want to be pwned? government customers who refuse to buy a single die if they can't verify the bootloader? Or just patriotic engineers sensitive to a cybersecurity regime that demands we keep our guard up against enemies, foreign and domestic?

lapcat28• 2 years ago

Why doesn't OP merely champion competition, instead of encouraging regulation of what software others can write, what hardware others can ship?

This is false dichotomy. Why not both?

We need individual consumer rights, and we also need healthy market competition.

hamandcheese3• 2 years ago

so I don't know where the pressure for secure enclaves really comes from.

The pressure comes from shareholders. User control means users can use their device in a way that benefits them, e.g. blocking invasive tracking. This benefit provides zero or negative shareholder value.

jmb999• 2 years ago

so I don't know where the pressure for secure enclaves really comes from.

In my experience, security engineers who see them as finally solving the “root of trust” problem. Generally (ime) it’s security engineers/teams that have been pushing for things like ssl/tls, global certificate stores, signed updates of those stores, signed kernels validating those updates. But if you break the kernel (or compromise the bootloader or EFI/BIOS) then it’s all for naught. A secure enclave solves that problem (unless you find a bug in it/its implementation) - your bootloader is validated, which validates your kernel, which validates all the userland components you care about. Security teams rejoice.

margana2• 2 years ago

Because the phone market is a duopoly that was impenetrable for even Microsoft. This "why don't you just make your own Apple?" argument is ridiculous, it will not happen no matter how much you "encourage" it as a consumer. You even contradict this yourself by saying "we're left with what <megacrops> provide us".

lapcat28• 2 years ago

There are a ton of products on the market that are vastly more dangerous than computers: guns, cars, motorcycles, bicycles, chainsaws, table saws, cigarettes, alcohol, junk food. Yes, consumers do sometimes harm themselves by using these products. That's the price of freedom. I think it's bizarre that we treat computers as the most dangerous products in the world that for some reason demand paternalism, when none of these other products are locked down by the vendor.

The reason that computers are locked down by the vendors is not that computers are somehow more dangerous than other things we buy. The reason is simply that it's technically possible to lock down computers, and vendors have found that it's massively, MASSIVELY profitable to do so. It's all about protecting their profits, not protecting us. We know that the crApp Store is full of scams that steal literally millions of dollars from consumers, and we know that the computer vendors violate our privacy by phoning home with "analytics" covering everything we do on the devices. This is not intended for our benefit but rather for theirs.

mixdup11• 2 years ago

There's a difference between being able to buy something dangerous and being forced to do so

lapcat28• 2 years ago

Forced? I'm not sure I understand.

My guess is that you're assuming, wrongly, that vendor locked devices are "safe" and unlocked devices are "unsafe".

All computers that are connected to the internet are unsafe in some ways. The most dangerous apps on your computer are the vendor's own built-in web browser and messaging app.

Also, the vendor-controlled software stores are unsafe cesspools. You will never find a more wretched hive of scum and villainy. Moreover, the vendors deliberately make it impossible for you to protect yourself. For example, iOS makes it difficult or impossible to inspect the file system directly, and you can't install software such as Little Snitch on iOS that stops 3rd party apps—as well as 1st party apps!—from phoning home.

In any case, most computers, including Apple computers, have parental controls and the like, so you can lock down your own device to your heart's content if you don't trust yourself, or you don't trust the family member that you're gifting the device.

homebrewer• 2 years ago

We're heading the opposite way of not being able to buy anything "dangerous" thanks to consumers that you're describing. I've been using a Xiaomi phone that stopped receiving updates in 2020, and have since been running LineageOS, which was made possible by the unlocked bootloader. Xiaomi has since changed its policy and it's basically impossible to unlock the bootloader on newer devices.

If not for the "dangerous" unlocking, I would have to run with dozens of severe vulnerabilities right now, all five years worth of them. A decent phone costs large amounts of money here, the hardware on mine is still very good, and so I would have used it regardless. (Yes, I understand that the firmware does not receive updates, but it's still much better than nothing.)

gjsman-10004• 2 years ago

This is a very popular HN opinion; but not a very popular real world opinion.

The average customer wants a device that works consistently, every day, that is easy to use, with a collection of 3rd party apps who won’t steal their life savings.

Windows failed to deliver this; the average customer never downloads an Exe from a newer publisher without terror. The average consumer is literally dozens of times more likely to trust a new smartphone app than a new desktop app.

We can also see this in the console market. Windows exists; old gaming PCs exist; the locked down console market will be with us forever because even Windows can’t deliver a simple experience that reliably works.

stavros19• 2 years ago

And consumers can have that. That doesn't mean I should be unable to unlock my phone and do whatever I want with it.

do_not_redeem2• 2 years ago

The average customer wants a car that doesn't explode because you installed a sketchy spark plug. Does that mean the manufacturers should install locks on the hood of every new car, with the threat of jail time if you pick the lock and look underneath?

lapcat28• 2 years ago

with a collection of 3rd party apps who won’t steal their life savings.

This is blatant unempirical scare mongering. How many desktop computer users have had their life savings stolen by 3rd party apps? Citation needed.

The average consumer is literally dozens of times more likely to trust a new smartphone app than a new desktop app.

This is a false dichotomy. Almost all desktop computer users have a smartphone too. The people who have enough disposable income buy both smartphones and desktop computers. There's no inherent conflict between the two.

the locked down console market will be with us forever because even Windows can’t deliver a simple experience that reliably works.

That's a competely ahistorical interpretation. Originally, the gaming consoles had no third-party games: the games were all written by the vendors. The first third-party game development company was Activision, a group of former Atari programmers who learned that their games were responsible for most of Atari's revenue, but Atari refused to give them a cut, so they left and formed their own company. There was a lawsuit, and it was ultimately settled, allowing Atari to get a cut of Activision while allowing Activision to otherwise continue developing console games. It had nothing to do with "reliablity" or "security" or any kind of made-up excuse like that.

fargle• 2 years ago

that's a, frankly, stupid argument. the conclusion doesn't follow the premise.

then don't root your phone or download an .exe. having the ability to do something doesn't mean you are forced to do it.

not safe enough for you? fine! make the current status quo comfortable walled-garden-of-illusionary-fake-safety the default. for example, there's no reason windows needs to by default allow unsigned code to run. hell, even make it really annoying to turn off.

but the "safety" and "easy to use" arguments against right-to-repair, digital rights, ownership, etc. is simply nonsense. there is literally ZERO negative safety or usability impact to anyone else's device because i'd like to own mine.

it's also an insulting and disingenuous argument to hear anyone on this forum make: our careers and entire segment of the economy would not exist if it were not for open systems. and it's insulting to basically say "bubba/granny is too dumb to be trusted" with owning their own device.

nirui2• 2 years ago

The average customer wants a device that works consistently, every day, that is easy to use

And it can only be archived with a fully locked down hardware?

Of course not. The modern OS archives system security through permission and isolation, which don't require bootlock etc to work. In fact, it worked well too even after the device is unlocked & rooted.

Windows failed to deliver this; the average customer never downloads an Exe from a newer publisher without terror

Windows (and Linux for that matter) is not modern OS. They're classic OS that offers the entire computer as playground for the program running on top of it. That's why Windows can be contaminated with a single malice EXE, but not Android or iOS.

OSs are not the same, don't try get the water muddy that way.

tliltocatl• 2 years ago

The average customer only exists in marketing people's heads.

_Algernon_2• 2 years ago

Sounds a lot like "We don't need free speech because I have nothing to say".

Just because you don't need or want it, doesn't mean it's not an important right to protect. Considering the influence of computers these days, the right of general purpose computing is probably at least as important as the right to free speech.

raxxor6• 2 years ago

If you explain all details about the advantages and disadvantages to them, I am sure they would think differently.

There are much more "hostile" smartphone apps that exfiltrate your data and sell it to the largest bidder than there are compromised executables these days. Also there are more profitable scams than compromising a PC system outside of industrial espionage.

PC in contrast to consoles always were a cost or usage factor. The difficulties of operating a PC isn't significant. It also heavily increases digital competency of the user for computer systems. If you really don't want that, you have other options.

sans_souse• 2 years ago

You can stop saying this now, those numbers (of ignorant users) no longer serves the argument. We did our job in informing the majority.

DoubleGlazing3• 2 years ago

There's nothing wrong with wanting that, but as the author said those of us who want to opt-out should have the choice to do so.

If I buy an iPhone, I should have the option to completely disconnect it from Apple and be able to replace the OS with whatever I want. If I do not have the option to do that do I REALLY own the device? The answer is no bacause what I have is a device that I can only use the way Apple allows. When the phone is obsolete and Apple stops updates then all I can do is send it off for recycling since Apple won't allow me to repurpose it with new software.

You are putting a lot of trust in the manufacturers as well. For example, they have the technical capabilities to kill the second hand market in their devices if they simply decided to refuse to allow a new user to login to a device. Sure, you could still sell the hardware, but it wouldn't be much use if the manufacturer stopped it from connecting and autorizing. I know this is an extreme example and no sane manufacturer would implement it, but I think it demonstrates why having to option to disconnect is a good thing.

The same applies to all other devices that are locked down, things like smart TVs, IP cameras and appliances. Just look at how many early smart TVs are now dumb because the manufacturer stopped updating the on-board apps. There should be no reason why the owner of such devices should be allowed to do whatever they want with them to try and bring them back to life.

throwaway7623• 2 years ago

Windows failed to deliver this; the average customer never downloads an Exe from a newer publisher without terror. The average consumer is literally dozens of times more likely to trust a new smartphone app than a new desktop app.

Yet that trust is, for the most part, unfounded. There's a ton of malware in app stores - you can assume any app that contains ads is sending data about you to some shady server, for example. You can't even trust the most popular apps not to be malware [0].

[0] https://news.ycombinator.com/item?id=42651115

userbinator• 2 years ago

Not only profits, but control. Remember the whole CSAM scanning debacle from Apple?

spacedcowboy6• 2 years ago

was that when they said “instead of uploading the images to our servers to do the CSAM scan, we’ll do a quick once over in the privacy of your own phone to see if we can allow-list your photo” ?

And then the whole world suddenly went apeshit, so Apple basically shrugged, said “fine, we’ll do it just like everyone else and put your photos in the relatively unprotected server domain to do the scan”. Sucks to be you.

Understand that at no point was there an option to not do the scan on upload, like all cloud providers, Apple scans for CSAM on any uploaded photos to stay out of any government grey areas.

golergka• 2 years ago

Thanks, but no. I'm never buying a device with easy root access for a non technical family member ever again. Freedom is great, and I'm using this freedom to buy something with exactly the capabilities I need.

shortrounddev2• 2 years ago

Just because the device is capable of root access does not mean all users need to be

drdaeman• 2 years ago

It doesn’t have to be easy enough to let through a person who doesn’t understand what they’re doing (aka blindly click through the annoying popups - that’d be bad).

And non-owners shouldn’t be able to have access solely based on their physical possession - quite the contrary, owner should have means to fully use hardware security features for their personal benefit, locking their own device as tight as they want (within the device’s technical capabilities).

frizlab3• 2 years ago

It’s impressive how many people downvote this actually über reasonable opinion…

alias_neo4• 2 years ago

So they'll never use a PC or laptop or anything of that ilk again?

To use the same logic, they shouldn't be given anything with a visible screw, or are you going to tell me they _wouldn't_ take a screw driver to an appliance because that would be silly for someone who doesn't know what they're doing in there?

bell-cot• 2 years ago

And here is (in effect) a completely legitimate reason for manufacturers to wall off root access. They did not want to sell and support a full-access, general-purpose computer. Nor provide liability coverage for anyone who reprograms their toaster and starts a fire.

xorcist3• 2 years ago

I take it you mean easily unlockable bootloader, not really out-of-the-box root access which no phone have.

I have taken the opposite stance on that. Never again will they be left with some Samsung bloatware which hardly receives any Android updates when phones such as Nexus, Nokia and Nothing costs the same and has excellent LineageOS support.

Lineage is stable, bloat-free self-updating and requires no maintenance from my side.

godelski2• 2 years ago

It also significantly hampers progress and the utility of tools themselves.

This is hacker news after all. What made the computer great was programs. What made the smart phone great (smart) is applications. It's insane to me that these companies are locking down their most valuable assets. The only way this works is if you're omniscient and can make all the programs users could want yourself. This is impossible considering both individuality and entropy (time). Both in the sense that time marches on and the fact that you don't have time nor infinite resources to accomplish all that. I mean we're talking about companies that didn't think to put a flashlight into a phone but it was one of the first apps developed. You could point to a number of high utility apps, but I'm also sure there's many you all use that you're unlikely to find on most people's phones.

We can also look at the maker community. Its flourished for centuries, millennia even. People are always innovating, adapting tools to their unique needs and situations. To some degree this is innately human and I'm not embellishing when I say that closed gardens and closed systems are dehumanizing. It limits us from being us. That person obsessed with cars and makes a sleeper Honda civic, that person that turns trash into art, that person that finds a new use for every day objects. Why would you want to take this away? It even hurts their bottom lines! People freely innovate and you get to reap the rewards. People explore, hack, and educate themselves, dreaming of working on your tech because of the environment you created. By locking down you forgo both short term and long term rewards.

I also want to add that we should not let any entity claim to be environmentally friendly or climate conscious that does not create open systems. No matter how much recycling they do. Because it is Reduce, Reuse, Recycle. In that order. You can't reuse if your things turn to garbage and reusing certainly plays a major role in reducing.

medhir4• 2 years ago

this!!! sustainability is a huge aspect that seems to be getting lost in the broader discussion. locked devices are leading to an incredible amount of e-waste and it's entirely preventable.

femiagbabiaka• 2 years ago

half of those things have computers in them now

metalman2• 2 years ago

my fuel injected chain saw, has a data port, but luckily, my back woods repair shop showed me the computerless,seasonal re-tune procedure that only requires a stop watch, works a charm As to other devices....phones, we need a whole re write of the privacy and publishing laws, to allow each person to regulate themselves. With an ultra basic "standard" set up for the masses who do want to be entertained, while having buying "oportunites" presented to them. But it has to be consentual, and basics like a phone number, email address, and personal/comercial web space, a non alienable birth right.Ban utopian concepts outright, and get back to bieng the quarlsome and somewhat violent species, that we are. I am starting to wonder, is the root cause of all of the ancient civilisations, lying in there own dust, what we are doing now, and the vast echoing silence from the stars, the same.

raxxor6• 2 years ago

If protection of the casual user was an argument, there would be an easy option to unlock your system, be that phones or desktop computers.

But on many systems these options do not exist because the vendor likes people dependent on them. This is why devices like chromebooks or all mobile phones are more or less e-waste in the making. In my opinion it is a waste to use any development capacity for these systems apart from consumer devices offering the next shitty app that hopefully always stays optional.

We even have dysfunctional laws that require banking apps to only run on these shitty systems. In my opinion, these errors need a quick correction.

Also, the most cases of scam still work as they did before and exfiltrating information, e.g. tracking and "diagnostic data" by bad operating systems are an additional security problem.

throw0101a• 2 years ago

If protection of the casual user was an argument, there would be an easy option to unlock your system, be that phones or desktop computers.

Making it easy to unlock could make it easy(er) for scammers to get it unlocked:

I received the same type of call a little later in the day. They were very adamant they were calling from the Bell data centre, on a terrible line and I made them call back three more times while I considered their requests. They wanted to have me download a program that would have given them controI of my laptop. […]

* https://forum.bell.ca/t5/Internet/Call-stating-that-an-issue...

sumtechguy3• 2 years ago

But on many systems these options do not exist because the vendor likes people dependent on them.

Dependent is not exactly the right thing here. Lower support costs probably is. If a vendor gives out root access. If that root access can brick a machine. Then you will get a small percentage of very high touch broken things as returns. Customers like this are in the 'dangerous enough' but not 'good enough to do it correctly' stage of hacking. They will then not claim any responsibility for breaking it. As they are hoping you just fix it for free.

I had one customer who would randomly change out stored procedures on our code. Then yell at our tech support for thing not working or being broken. Wasting hundreds of hours of time until we realized what he was doing. Locking him out is very appealing. Instead we sold him and his management on 'we will do the work for you for a fee'. Which was more along the lines of 'you do this again we will fire the customer'.

That is but one small thing that can/will happen.

pjmlp2• 2 years ago

I guess you want the equivalent of asking an adult friend to buy booze for a party.

miki123211• 2 years ago

There are a ton of products on the market that are vastly more dangerous than computers

The thing with chainsaws and motorcycles is that they look and feel dangerous, and people have an intuitive understanding of how to approach those dangers.

If you ask a random person on the street about safe motorcycle riding, they'll probably tell you about respecting speed limits, wearing protective gear, only doing it when sober, not pulling stunts / showing off etc. I've never been on a motorcycle, have 0 interest in them, and I know those things.

Computers don't work that way. People can't distinguish between a real banking app and a fake banking app that looks real, an update pop-up and a fake "you need to update Adobe Flash Player" pop-up on a phishing website etc.

I've done plenty of "helping non-technical people out with computers" during my middle / secondary school days. That was when people still used Windows a lot, as opposed to doing everything on their phones. Most computers I've seen back then had some app that hijacked your start page, changed your search engine to something strange, would constantly open random websites with "dpwnload now free wallpapers and ring tones for your mobile now" etc. You didn't even have to fall for a scam to get something like that, plenty of reputable software came with such "add-ons", because that's how you made money back then.

I feel like that era of "total freedom" has somehow been erased from our minds, and we're looking at things through rose-tinted glasses. I, for one, vastly prefer the world of personalized ads and invasive surveillance over one where I constantly have to be on alert for my default browser being changed to Google Chrome for the hundredth time this year, just because I decided to update Skype.

grishka5• 2 years ago

You didn't even have to fall for a scam to get something like that, plenty of reputable software came with such "add-ons", because that's how you made money back then.

That's why you never blindly clicked "next" in installers. Everyone got one of those IE toolbars accidentally at some point, but it usually only took doing it once to learn the lesson.

lapcat28• 2 years ago

If you ask a random person on the street about safe motorcycle riding, they'll probably tell you about respecting speed limits, wearing protective gear, only doing it when sober, not pulling stunts / showing off etc. I've never been on a motorcycle, have 0 interest in them, and I know those things.

How did this matter? People may know these things, but they nonetheless ignore speed limits, don't wear helmets, drive drunk, pull stunts, etc. And the motorcycle manufacturer can't stop them. They have the freedom to harm themselves.

Computers don't work that way. People can't distinguish between a real banking app and a fake banking app that looks real

Guess what, people can't distinguish between the real and fake apps in the crApp Store either. Let's stop pretending that it's safe, when we've seen over and over that it's not.

That was when people still used Windows a lot, as opposed to doing everything on their phones.

People still use Windows a lot. Smartphones have not replaced desktop computers but rather added to desktop computers. Almost every desktop computer owner also has a smartphone I believe that desktop computer sales are as high now as ever; I know that's true for Apple Macs, specifically.

I feel like that era of "total freedom" has somehow been erased from our minds, and we're looking at things through rose-tinted glasses.

It hasn't been erased. The desktop never left. It's been surpassed in volume by smartphones, of course, but let's not pretend that desktops were somehow made obsolete and removed from the Earth. The people who have enough money buy smartphones and desktops. Many even have a smartphone, a desktop/laptop, and a tablet. The choice is not about security, it's about money and form factor. When I leave home, I put a phone in my pocket. When I'm on the couch, I use a laptop. When I'm reading an ebook, I use a tablet.

skywhopper• 2 years ago

Actually, chainsaws, table saws, cars, motorcycles, and even guns all have safety mechanisms installed by the manufacturers and tampering with them voids the warranty.

lapcat28• 2 years ago

Nobody is arguing that computers shouldn't have safety mechanisms. But the manufacturers of those devices don't have remote control over what I do with them. There's no equivalent of a "curated App Store" (and one that requires a 30% cut to the manufacturer, which is the real point behind it).

The equivalent would be if you could only use specific brands of replacement chains, blades, tires, or bullets that are approved by the manufacturer, for which the manufacturer gets a cut of the sales of those replacements.

sudosysgen• 2 years ago

Tampering with safety mechanisms on your car voids the warranty on the safety mechanism, not on your whole car. Otherwise using third party mechanics would be impossible.

invalidlogin• 2 years ago

A chainsaw does not introduce an opportunity for thousands of remote criminals to steal money from your bank account.

logicchains• 2 years ago

But like a gun or a knife it may give local criminals an opportunity to threaten (or worse) you into giving them money from your wallet.

Retr0id• 2 years ago

It does introduce an opportunity to lose a limb, though. I think I'd rather have my bank account hacked.

m463• 2 years ago

Why don't they let you firewall your phone?

jmull2• 2 years ago

There are a ton of products on the market that are vastly more dangerous than computers

An irrelevant "whaddabout" argument.

It doesn't change that we need security and privacy for our information handling devices, as well as personal control. The real conversation is about how to best balance these.

mschuster91• 2 years ago

It doesn't change that we need security and privacy for our information handling devices, as well as personal control.

I can do online banking on my PC as root user if I so choose, but I cannot do online banking on my phone because my bank's app employs a rooting detector SDK that as of now even Magisk+a host of (questionable) modules can't bypass.

lapcat28• 2 years ago

It doesn't change that we need security and privacy for our information handling devices, as well as personal control. The real conversation is about how to best balance these.

An irrelevant false dichotomy argument. There's no inherent conflict between security/privacy and personal control. I would argue that a device which has to phone home to the vendor to get approval for everything results in both less privacy and less personal control.

PittleyDunkin4• 2 years ago

The real conversation is about how to best balance these.

How do you even formulate these values so that they're in conflict in the first place?

mardifoufs• 2 years ago

Bringing up whataboutism is even less relevant. Comparisons aren't suddenly bad because of an overused buzzword

regnull4• 2 years ago

Before we put all the blame on vendors, I submit to you, ladies and gentlemen, this: the public finds this tradeoff (privacy for entertainment) completely acceptable. With all the outrage, privacy-centric solutions are out there and relatively easy to find, how come they don't get more traction? Including among the HN crowd?

pseudocomposer3• 2 years ago

“The least bad option in a market oriented against users and designed to maximize profit” is not the same as “completely acceptable.”

ragnese• 2 years ago

Exactly. Even the people who complain about these things immediately get defensive when you call them out on their uses: "Well, I can't switch because what about my banking app?" or "Well, games don't count as software to me." or "It won't make any difference to the big tech companies if I'm the only one who switches, so why bother?"

lapcat28• 2 years ago

privacy-centric solutions are out there and relatively easy to find

Really? Please name them. Over the past 10 or 15 years, I've never seen anything other than the iPhone/Android or Mac/Windows duopoly for sale in any retail store. I've never seen any advertising for other than those duopolies. The HN crowd may be aware of obscure options, but for the vast majority of consumers, they don't exist. And since we as developers make money catering to the vast majority of consumers, we're kind of stuck with the duopoly too, at least as far as our work is concerned.

Ajedi325• 2 years ago

This isn't about privacy. Not directly anyway. This is about your right to have control of your own property.

You make a fair point though; the case does need to be made as to why this is a market failure and not just consumer choice working as expected. Why _do_ consumers tolerate manufacturers retaining ultimate control of consumer's property after the sale? It certainly doesn't seem to be that important to them. Maybe greater awareness of the issue would help somewhat?

freedomben4• 2 years ago

I have no data to back this up. So what follows is purely my personal opinion.

I think the reason people don't care, is because they don't know. The average person either doesn't know or barely knows That anything deeper than what they see in the user interface is happening on their system.

We humans are very much an out of sight out of mind type of creature. If we can't see it, it's hard for us to imagine that it exists.

_aavaa_• 2 years ago

There is nothing inherent to the benefits that these companies tout that require them to lock us out of our own devices.

What you are describing is not a tradeoff but a magnificent bribe. They bribe us with measly benefits in order to accept the deal that is incredibly favourable for them.

See: https://reallifemag.com/the-magnificent-bribe/

chainingsolid• 2 years ago

I'd argue the general population doesn't even know this trade off exists (not helped by the pros being advertised to users and the cons purposely not mentioned). Even then the minority (us) shouldn't be stopped from doing what we want with our stuff just so some company can make more money.

fsflover11• 2 years ago

https://news.ycombinator.com/item?id=20207348

jshen3• 2 years ago

Only computers let bad people drain bank accounts at scale.

lapcat28• 2 years ago

Please cite the statistics on the volume of bank account draining before you claim that it happens "at scale".

eviks5• 2 years ago

think it's bizarre that we treat computers as the most dangerous products in the world

We do not? You don't even need a license to buy /operate a computer unlike with some other examples on your list

lapcat28• 2 years ago

By "we" I meant online commenters debating the issue of tech company device lockdown.

I didn't mean "the law". To the contrary, the submitted article author was proposing that we pass laws giving greater individual consumer rights over their devices. But the big tech companies have been viciously fighting against consumer rights, such as the right to repair.

PittleyDunkin4• 2 years ago

Yes, consumers do sometimes harm themselves by using these products. That's the price of freedom.

"Freedom" is also a terrible argument for this. What does it even mean? Freedom from what? Freedom to do what? It's such a meaningless word you're going to lose half your audience just by bringing it up.

diggan2• 2 years ago

"Freedom - the condition of being free; the power to act or speak or think without externally imposed restraints"

When the context is "digital devices", it becomes pretty clear what it means. You should be free to use it however you want, without externally imposed restraints.

Locking down the device so much so users cannot run applications they've written themselves without the approval of the company who made it, isn't "freedom" as the required approval from the company breaks the "without externally imposed restraints" part.

1vuio0pswjnm7• 2 years ago

"The reason that computers are locked down by the vendors is not that computers are somehow more dangerous than other things we buy "

It makes sense to allow the _buyer_ to responsibly lock out others. This is common in other products that could be dangerous. But allowing the _seller_ to lock out others, e.g., competitors or the buyer, is a recipe for malfeasance, at the buyer's expense. Interestingly, with computers and pre-installed software, there is no option to lock out the sellers such as Apple or the companies that partner with sellers and pre-install software on the computers, such as Microsoft, Google, etc.

"It's all about protecting their profits, not protecting us."

It is interesting that the "protections" are not optional. It assumed _every_ buyer wants the protections from others _and also from themselves_ enabled by default, and also for protections from so-called "tech" companies to be _disabled_ by default. A remarkable coincidence.

Perhaps if buyers were given the option to login as single user and change the default protections some (not all) might disable phoning home to Silicon Valley or Redmond. They might block unwanted access to their computers by so-called "tech" companies who sell them out as ad targets. The so-called "tech" companies and their customers (advertisers) from other peoples' computers might be locked out.

Indeed letting buyers lock out whomever they choose might diminish the profits of so-called "tech" companies.

In the past HN commenters often sidestepped the question of these "protections" as self-serving and argued that so-called "tech" companies serve the "majority" of computer users and in fact these "protections" are what computer users want even though these users were never asked or given the choice to opt-out. If that were true then allowing a "minority" of users to control the protections themselves, i.e., operate as root, would only affect a minority of profits.

likeabatterycar• 2 years ago

I think it's bizarre that we treat computers as the most dangerous products in the world that for some reason demand paternalism, when none of these other products are locked down by the vendor.

That's because there are people behind every product, and the people behind computers tend to be the paternalistic, nanny-state type. Just read through the histrionics in any HN thread about leaf blowers, they want every landscaper locked up and their tools of the trade taken away. Someone once suggested they should be forced to use rakes. Imagine if some landscaper insisted what laptop you should use.

As you wouldn't expect to find many in-the-Army buzz-cut guys roaming the Google campus as you would at a gun company, you wouldn't expect some blue-haired face-pierced sales engineer selling you table saws.

It's a cultural thing, nothing more.

cpuguy83• 2 years ago

Locking them down also makes supporting them *FAR* simpler.

amelius2• 2 years ago

Computers can be dangerous, but the solution is not to let the vendor control security. It is to allow third parties to provide security products.

pjmlp2• 2 years ago

And there are plenty of laws in many countries on how to use them, seatbelts, helmets, chain gloves, plastic cover, minimum age, access exam,...

Failure to obey them, might get jail time on those countries if caught disobeying, or an hefty fine, not counting what misuse might bring in, regardless of the country.

stavros19• 2 years ago

Every time this issue comes up, an army of people who've never unlocked a phone comes out of the woodwork to talk about their theoretical fears of malware and piracy and rain falling from the sky if you dare to own your device.

If you've never unlocked a phone, please educate yourself on how the process works before opining. It's really not as terrifying as you imagine.

dmichulke• 2 years ago

On the contrary, unlocking the bootloader might also be not as possible as you imagine.

Happened twice to me:

Once the URL for getting the key did not exist anymore.

The other time it was disallowed after some time by the company.

petesergeant• 2 years ago

Contrarian take: you bought the device, that you knew already did not provide that, from a company who has priced in not having to support rooted devices, and who had priced in your future revenue from extras. The company can't complain if you find a way to root it (and they don't), but they're under no obligation to add in this extra feature you're asking for. If you want a mostly-open handheld device, they're for sale, you should buy one of those.

jmb999• 2 years ago

I agree. The gist of the main arguments I see in this thread are that average people should be trusted to choose whether or not they will unlock their device. Yet, a group of (presumably) some of the most technically savvy people on the internet can’t figure out how to buy open products? If you don’t want a locked-down computer, don’t buy a Mac. Clearly, many, many people do, so why should they have that taken away from them because of someone else’s ideals?

user_78322• 2 years ago

It is possible for something to still be very good despite restrictions (e.g. m series MacBooks). It’s also reasonable to “complain” if the device you purchased isn’t truly in “your” control (eg forced OTA updates).

Also a minor nit: > Yet, a group of (presumably) some of the most technically savvy people on the internet can’t figure out how to buy open products?

This isn’t necessarily fair. When I bought my iPad (my first apple device) I could try it at an Apple store where there’s only so much you can realise. How are the speakers? Is the screen bright? How quickly does YouTube/websites open?

What I did not realise until much later was that even something as “basic” as downloading a couple of MP3 and playing them is bizarrely hard on iOS. Or that alarms have no option to gently rise, and are designed to give you a heart attack. Or that you can’t even set your own song/music as an alarm (unless you’ve paid apple money for their music services, very conveniently).

Would I have still bought an iPad if I knew all these? Maybe. But maybe I’d have gotten a basic model. Or maybe I’d just use an android tablet - the details are irrelevant here. But there’s a lot of things about an OS that are obscure.

BeFlatXIII2• 2 years ago

If you don’t want a locked-down computer, don’t buy a Mac

I'd be bothered to respect your opinion if there were competitors whose build quality were better than dogshit.

user_78322• 2 years ago

Correct me if I’m wrong but the base AOSP android rom allows bootloader unlocking by default. OEMs need to go out of their way to restrict it.

Also, most manufacturers consider the warranty void of the bootloader has been unlocked. There’s definitely no service (costs) for them on that front, and I’d be amazed if even 0.1% of all customers unlocked the bootloader (for it to be big enough to notice for any company).

rollcat• 2 years ago

you bought the device, that you knew already did not provide that, from a company who has priced in not having to support rooted devices, and who had priced in your future revenue from extras.

This argument falls apart when 99% of the desirable devices do not have this option. It's not even about compromising on optional-but-important features, like having access to your bank - the "1%" devices usually do not even have a secure hardware element that handles full-disk encryption, leaving your most-personal data (that you carry with you everywhere you go, thus exposing it to additional risk) vulnerable.

If you want a mostly-open handheld device, they're for sale, you should buy one of those.

Yeah, almost none of those are actually compelling. There's the Pixel series and GrapheneOS, but these devices are huuuge (they simply don't fit in my single hand!), and I don't want to give even more money to Google :S

In an ideal world, you should be able to simply root any of your devices on demand, in exchange for wiping the storage clean, losing your warranty, and any expectation of protection/privacy/extra features. Then it's up to you (and/or a third-party OS provider) to take care of that yourself.

The problem with that route is that only a tiny fraction of users are actually interested in that, there's value to lose in accidental rooting (users get angry about lost features), and there's no value to gain.

This is where regulation could come in.

jerjerjer• 2 years ago

Fully agreed. I was thinking of something similar, only I was calling it "Right to execute", similarly to the "Right to repair". I'm buying a general computing device. It's ridiculous I'm artificially limited in using it for the main purpose of making shareholders rich.

Ideally I'd add a mandatory toolchain to that. At least a C compiler which should be able to target a device I own.

Ajedi325• 2 years ago

I just call it "Software Freedom", like GNU has since the 80s:

the freedom to change a program, so that you can control it instead of it controlling you

I don't necessarily endorse all of Stallman's philosophy on software. But I think in this point at least he was very prescient.

solatic• 2 years ago

The way to balance security and freedom is with a hardware switch. By default, keep secure boot etc. But if someone opens the case, takes out the battery, and moves a little switch on the board? Start with a fresh, unprotected context. Because it's a hardware switch, it can't be remotely hacked. An adversary who gets the hardware anyway can get control (are we going to pretend otherwise?). So just do the right thing and make it easier for people to take over their own hardware.

cube2222• 2 years ago

are we going to pretend otherwise?

aren't we in fact pretending otherwise?

Right now I believe that stolen iPhones are effectively bricks (barring state-level actors with unpatched zero-days)?

dinozarw• 2 years ago

The amount of hand-waving in this comments section is truly outstanding. Then again, it shouldn't really surprise me considering how many HN users work for the very companies that profit from vendor lockdown. "You will own nothing and you will be happy!"

zzo38computer3• 2 years ago

I believe consumers, as a right, should be able to install software of their choosing to any computing device that is owned outright.

I agree with this, as well as most (or all) of the other stuff mentioned in that article.

However, sometimes it might be reasonable to have a switch inside that you must unscrew it (using a commonly available screwdriver, rather than an obscure one) to switch it (and then later be able to switch it back), in order to enable some functions (e.g. to be able to upgrade EEPROM, or to bypass a secure boot loader). If the user puts glitter on it, then this allows the user to detect tampering, while remaining secure and allowing full control.

nicman23• 2 years ago

No. This does not happen with anything else except phones. If you brick a laptop it is a 30 dollar fix on any local shop. The same cannot be said with any locked down device.

whs2• 2 years ago

I remember how I flashed my Nintendo DS.

In the back of the device there's a sticker over a screwhole. You'll need to poke a screwdriver in there, but inside is not a screw. It's an electrical contact to make the ROM read-write which your screwdriver needs to bridge, and stay bridged while the firmware is flashing (It is harmless if the contact is loss in the process, but I don't know if it would be safe to abort at that point) Pretty hard to convince someone to do that process, yet doable by anyone with a flathead screwdriver.

I guess nowadays it become Samsung's e-fuse where if you flash it blow an e-fuse and the status of the fuse is now detectable with software. Then apps can refuse to service people just because the custom firmware fuse was blown.

dusted2• 2 years ago

I believe consumers, as a right, should be able to install software of their choosing to any computing device that is owned outright.

While I agree, I think even legislation will not fix this, because what is a computing device, and who decides what is and what is not ? I'm sure apple will argue that nothing they sell should be considered computing devices. While the hacker will consider anything they can trick into arbitrary code to be one (is your fridge a computing device?)

If we go the legal route, I think the only way is to give the right to flash firmware of _ANYTHING_ that has programmable bits, and that's probably not going to fly either because lots of legislation already dictates users should be prohibited and prevented.

reshlo• 2 years ago

I'm sure apple will argue that nothing they sell should be considered computing devices.

“What’s a computer?”

perlgeek• 2 years ago

While I agree, I think even legislation will not fix this, because what is a computing device, and who decides what is and what is not ?

If there is legislation, it will contain a definition of what is a computing device and what isn't. It will be imperfect, and the edge cases will be contested in courts. Courts deal with blurry boundaries all the time.

That's how it always is with legal matters, and doesn't mean we have to demand that anything with a firmware must be flashable.

dusted2• 2 years ago

What I mean is that I think this is the fastest way to end the era of widely-available general-purpose-computing devices that we are currently in (and that is currently ending, but at a glacial speed).

It's not that hard to imagine a version of the world where computers as we know them do not exist, but are mere appliances (like tablets and smartphones), and if companies feel threatened that they might be forced to open up their computing devices, they will be quick to make them not fall under the definition.

Instead of a smartphone, you will get a "Can telephone and access facebook and instasnap" device with whatever technical cripplement is needed to make it not a computing device and be exempt from the law. And as the general public and justice system is pretty ignorant with regard to technology, it's going to be pretty resource intensive to convince a judge why every gadget around that suddenly identifies as "not a computing device" is in fact on anyway.

blueflow• 2 years ago

German here - I do believe this legislation already exists - the owner of a thing has full rights of disposal and no other entity is allowed to interfere (except for the state itself). And this is part of the common property rights. afaik the property rights in the US are even stronger.

But i wonder, why these rights do not seem to be enforced on computing devices. Either everyone is failing to assert their property rights or i am in the wrong here. Probably the latter.

Ajedi325• 2 years ago

I think the only way is to give the right to flash firmware of _ANYTHING_ that has programmable bits

This seems reasonable to me. What's wrong with it?

cynicalsecurity• 2 years ago

We should thank all the major copyright holders for that. They are the reason many devices have been crippled. Because for them, the real enemy is the user, - that is you, my dear friend. They assume you to be a criminal by default, you know, like some crazy feminists assume all men are rapists just because they have a penis. Chop your penis off to prove you are not a rapist! Use your device without root access to prove you are not a filthy pirate who is "stealing" money from poor copyright holders who can barely afford women, yaughts and coke they are used to.

jopsen• 2 years ago

I believe consumers, as a right, should be able to install software of their choosing to any computing device that is owned outright.

That's easy to say, but hard to legislate, and impossible to enforce.

There is so much firmware around, small binary blobs burned into micro controllers that can't even be updated. Or that isn't intended to be updated.

There are probably even dimmable LED bulbs without IoT features that still have a microcontroller.

Because a tiny microcontroller is the cheapest way to add logic to anything.

I'm not sure it isn't a good idea. Just not sure we grasp the ramifications.

raxxor6• 2 years ago

I think a definition would exclude µC, dsps asics, fpga, etc. While most of those have the ability to program themselves, not all programs support such features.

And for external programming you need programming devices who would also need physical interfaces where no standard connector exists.

But a definition for general purpose computing devices wouldn't be harder than to craft legislation that requires my banking app to run on a certified shitty app environment.

palata• 2 years ago

and impossible to enforce.

You don't have to enforce it for every single manufacturer and every single product. If you enforce it for Apple, Samsung and a couple other big Android brands, you'll get most smartphones.

Now whether it is a good idea or not, I don't know. But if you wanted to enforce it, I think it wouldn't be too hard. Banks get a ton of regulations and have to apply them all the time. Surely Apple or Samsung could do that, too.

anfilt2• 2 years ago

I have talked about this before. The issue goes further in my opinion and starts to effect property rights themselves. In particular locked down hardware starts to effect the owners right of exclusion. The right of exclusion loosely is the right include or exclude something from/usesing some property. When the hardware is locked down the owner can know longer solely make those decisions. Instead in the instance of like an iDevice Apple makes those choices instead of the owner by only allowed code they have signed or signatures they allow.

An other post I have posted regarding this: https://news.ycombinator.com/item?id=39349288

medhir4• 2 years ago

thanks for sharing. the loss of property rights is an aspect I hadn’t considered… would be great to brainstorm further with an actual lawyer on these topics

anfilt2• 2 years ago

I recommend reading that paper I posted in the other comment. It underscores how important the right of exclusion is.

grishka5• 2 years ago

The problem is larger than that, it's the IT industry's obsession with denying users the ability to evaluate their own risks and take their own responsibility. You do that all the time every day in most other areas of life, but somehow interacting with technology is different. The manufacturer always knows better. Don't want to have a time component to your biometric authentication because you know your risks? Too bad. Google and Apple know better. Password is required to unlock Touch ID.

markus_zhang7• 2 years ago

I doubt any Apple engineer is very against the idea that an iPad user roots it. It's more like the legal and financial mindset. Legal doesn't want trouble and can shoot anyone who it doesn't like with law bullets, Finance just want MAW $$$.

ptman• 2 years ago

"no user serviceable parts inside"

dmurray• 2 years ago

The argument that an iPad runs substantially the same OS and hardware as a MacBook weakens the authors case instead of strengthening it.

You can buy from Apple a computer that's locked down (an iPad), or a computer that's not locked down by the author's definition (a MacBook). It's a matter of consumer choice, not the company insisting on control of your devices.

The non-locked-down machines come in a different form factor than the locked-down ones - they usually have a physical keyboard and a larger form factor to accommodate that. This is partly for historical reasons, but very largely also for consumer choice - and also it makes sense that on the more flexible machine users are more likely to need a keyboard. This is all fine, you can't expect every company to sell their products with every combination of features.

I find more convincing the arguments about e-waste, but they need to be framed like that: sometimes we should mandate consumers get something they don't particularly want, for the greater good.

kachapopopow3• 2 years ago

The reason why this will never happen is simply due to things like DRM.

We right now have ENCRYPTED signal going from our computer to our displays, not just computers, but phones too SIMPLY to prevent people from dumping raw data.

All of that extra processing done just so you're allowed to for ex: watch netflix with a resolution higher than 720p. Then comically there's Chinese capture cards that you plug your GPU into, use mirroring mode and completely bypass it.

DRM is just one example, there's many more motivations such as preventing paid apps / pay for currency games from having these things given for free. This is the primary reason why iOS devices make significantly more money than android as it's near impossible to pirate / hack / crack for an average user.

maniacwhat• 2 years ago

Perhaps it imposes some restrictions, like using TPMs, but I don't think it excludes what the author is suggesting, which is the ability to run as root.

Case in point: every popular desktop PC let's you run as root, and also watch DRM content. They aren't totally mutually exclusive.

margana2• 2 years ago

You can't play 4K Netflix on Linux, period. Because of DRM. Before you say "this is just a Netflix issue" - you can't play 4K Prime Video on Linux either. Nor 4K Disney+. And many other services. Piracy is the only way to watch most 4K streaming content on Linux. You may have the most capable and up-to-date hardware on the market, you still can't.

beefnugs• 2 years ago

There is nothing stopping anyone from selling an HSM (hardware security module) that can decode their protected video without fisting the control into the computer itself

kachapopopow3• 2 years ago

These are sort of prevented by signing the hardware, you have a module on your computer that creates a web request identifying that this module is present.

cakealert2• 2 years ago

I suspect DRM will eventually be self defeating. For example, I prefer to torrent content just so that I can get stuff to play using my media player of choice (and the instant seeks) without any hassle. Most normal people probably aren't even aware this is an option.

But with cryptocurrencies normalizing it's only a matter of time before a paid piracy service emerges that is both cheaper, simpler and better than Netflix or any other streamer. Some arguably already have.

DRM was being broken for years without even a monetary incentive, with one it won't stand a chance.

bobdvb3• 2 years ago

I'm a senior person who looks after content protection and anti-piracy at a major streaming company.

The idealism of those who want to see the demise of DRM doesn't actually hold up in the face of reality. Even when we remove restrictions and give global access to content, for free, pirates don't give up. One of the reasons is that many pirate sites get ad revenue, piracy is a business for many folk and they get the benefit of not paying for the most expensive part. They also don't have legal/regulatory compliance, taxes and will often operate their infrastructure using stolen credit cards or accounts (we can see this).

Then you have people who are selling legitimately and trying to provide the best service for customers, but who have to pay for the content, competing with people who don't have any such responsibilities. So, customers take the cheap deal.

Some folk are also under the assumption that streaming services are money grabbing. Except when you actually look, most streaming services are running at a loss, or barely profitable.

I'm just working to protect our company and reduce losses, ultimately I am not preventing people getting access to fresh food or water. I am protecting premium goods from being illegitimately exploited and protecting the jobs of my colleagues when we're already under significant cost pressures.

One reason I post about these things on the internet is in the hope that one day we might have a constructive dialogue about how to balance freedoms AND enable commerce. But at the moment we have extremism, libertarian ideals against company lawyers.

markus_zhang7• 2 years ago

I think in the not too far future, every electronics device will be locked down. Laptops and desktops can be locked down too. The technology is already there. They can also throw in AI for recommendations i.e. lock down users' mind too. Think what this is going to do to the next generation if they start using electronic products from 6.

For example, if anyone is interested, check out the computers Chinese governments are using right now. They are basically large mobile phones running some sort of Linux, but the whole thing is locked down. Fortunately things are OK on the commercial side but again it's more and more difficult to root or unlock a device.

And now the Western states are following suite, except it's the corporations that are leading the charge.

If they achieve this, and wipe out all commercial electronics distributors such as Mouse, then we need another underground railway movement to teach people to scavenge and build computers in that Dark Age.

I'm not joking. This could be real. It's already shaping.

rednafi• 2 years ago

Computers have sharp edges, and people often throw hissy fits when things break. Manufacturers infantalize consumers to dodge lawsuits. Then companies like Apple take it too far by building walled gardens where devices don't have proper file systems, locking you out of your own files.

therealmarv2• 2 years ago

Banking, some government and crypto apps on Android think: no

They sometimes actively search for root evidence.

fiso64• 2 years ago

I'm actually confused about why banks are so aggressive in denying users the ability to use their apps while rooted. Unlike Google and Apple I can't think of any financial incentives for this, and the security argument is quite obviously nonsense, as I don't think there has been a single person in history who managed to fall for a scam that made them follow the complicated procedure of rooting a smartphone. Nevertheless there is a clear continuous effort in developing new root detection methods to keep me from using their apps.

adolph3• 2 years ago

to fall for a scam that made them follow the complicated procedure of rooting

If you are unable to imagine how a 3rd party might root a device without the principal being aware of it, then maybe it is a shortcoming of your risk survey, not theirs.

whs2• 2 years ago

I believe the root detection is a form of security-by-obscurity. Bank applications are required to be obfuscated, so you can't simply statically decompile them. The other way to do that is to run the app and set runtime breakpoints, which you can't do on production firmware.

Once the application is decompiled the attacker then can proceed to pentest the bank backend, or find any frontend-only security measures to bypass. One attack I heard in local news is not even a hack at all - they simply make script that use the mobile application API to automatically move money between sock puppet bank accounts. Once a victim get scammed, the money move around quickly. For privacy banks do not provide information about unrelated cross-bank transfers so even cops can't easily trace the multiple hops. That specific bank got in the news for that "weak security"

pmdr• 2 years ago

What's even worse is that some won't even let you take a damn screenshot. "Disabled by your administrator." If that doesn't scream the fact that my device is in fact owned by someone else, I don't know what is.

therealmarv2• 2 years ago

With root + LSPosed + this LSPosed module

https://github.com/LSPosed/DisableFlagSecure

it works in every app again on YOUR phone. I also have root and all my banking apps work currently ... but it's a cat-and-mouse game.

markus_zhang7• 2 years ago

It helps to keep a burner phone just for those. We don't use them everyday anyway.

yason2• 2 years ago

I'd like a capability that I can run any application in a tight container that absolutely sees nothing what's on my phone. I can give it a real or fake or filtered network if needed, and anything else the app sees like contacts or files would look like a real phone but just originate from a fake null source. There's a mutual distrust with users and manufacturers and application vendors and technology can solve that.

Namely, that's what I do with proprietary software on my desktop. Nothing that's closed runs with access to my files. Further, a banking app shouldn't need to know I'm running a rooted device. For some reason, I can do banking with an open source browser on a rooted phone just fine. It's just the proprietary blob that comes with TPM shackles, and I think I should be the owner of those shackles because I own my phone.

Grimblewald• 2 years ago

the weird thing about banking apps is, if i don't install them and just log in via browser I don't need any of that bullshit. So why does my bank app need all that, if they're ok with browser just logging in? It all feels a little like something the app monkeys got sucked into because they don't know better and trust google more than they should.

andrewla2• 2 years ago

I'm not entirely aligned with this article, though I think the principle is correct.

I do think that it should never be illegal to tamper with a device that you own in any way that you find acceptable.

But I do not feel that manufacturers have any obligation to make this easy or possible.

It should be completely legal to hack your devices and to distribute tools and instructions for hacking devices without limitation.

i5heu• 2 years ago

But the question here is if it should be illegal for manufacturers to make the modify a product.

The difference is between a locked down boot loader and one that is just a standard boot loader.

andrewla2• 2 years ago

Right -- and that I don't agree with. My concern is laws that make it illegal to modify products you own or to offer advice or tools to people who wish to modify products they own. Similarly, arrangements like leases and limited licenses that convey some aspects of "ownership" but not complete ownership should also be severely restricted.

In general if there are no legal recourses to go after people who modify their devices, then it makes it more appealing for manufacturers to allow a supported opt-out method because that reduces the incentives to compromise their products with out-of-band methods.

So I'd prefer to take an indirect route of empowering customers rather than requiring manufacturers to do additional work to free up their products.

adolph3• 2 years ago

What the author calls "double standard" could be reframed as "consumer choice." A vendor sells different devices. Some have provisions to make changes to the bootloader and some don't.

The phrase "have provisions to make changes" is on purpose. It has not yet been proven to me that a change to an iPad's bootloader function is impossible. It certainly isn't as easy as that of Mac, but the skill/effort required is a gradient.

This is similar to "soldered" storage. This was commonly thought of as impossible until it was demonstrated that a Mac will happily accept updated storage changed out with a hot air rework device. This method is certainly higher skill/effort/risk than remembering when to terminate 50pin SCSI, but shows that when a hacker has a will, there is a way.

Is it ironic that as computing devices become easier to use, they also require higher skill to fix and modify? No, more likely there is an iron rule that when a device's external complexity is contained, the inner workings of that thing become more complex. Complexity did not decrease but was hidden.

Does a grandfather clock and a tourbillon wristwatch encapsulate the same/similar general principles of timekeeping? Sure. If one has the skill to update parts of the grandfather clock, are those same skills sufficient for the wristwatch? Probably not. Should wristwatches be banned because people who update grandfather clocks do not have the skills to modify them? Surely not, that would be absurd.

Likewise, demanding root in a form you find acceptable is absurd. If you can't take root one a device you possess, it's a skill issue for you to address not the vendor.

adolph3• 2 years ago

Devices that are locked become e-waste once a manufacturer stops supporting them. This keeps happening like clockwork:
Spotify’s Car Thing

Contrary to the author's claim, Car Thing is a great example of what can happen with abandoned hardware. The device did not become e-waste when the manufacturer stopped supporting it. There is a lively community of people modifying and updating software and doing really interesting things. I lack one only because I missed the $15 price nadir and they are relatively high priced in the secondary market.

https://www.ebay.com/sch/i.html?_nkw=Spotify+Car+Thing

https://www.reddit.com/r/carthinghax/

alkonaut• 2 years ago

From a consumer rights and environmental standpoint I agree. But it's important that only the actual owner of the device can do this, and not just the person in possession of the device. You don't want to make stolen devices be anything but paperweights. But so long as I (the owner) select the passphrase for unlocking it I don't see a problem.

looneysquash• 2 years ago

Yes, I agree.

And I'd go even further, and limit the ability of devices to not be "owned outright", since that sound like a loophole. I do not want a EULA interfere with these rights.

bkummel• 2 years ago

Hear, hear!

stainablesteel• 2 years ago

this would be great for cars too, i don't want a vehicle selling my data, or even collecting it in the first place

ubermonkey• 2 years ago

I'm always amazed at the number of folks who are really, really mad that there exist products and services not intended for them.

If you are a very technical person, and you want to have root on every device you own, then iOS is not for you. That's ok. Android exists!

But iOS as an appliance-level, walled-garden environment is absolutely perfect FOR MOST USERS. And that's fine.

Nursing a grudge because Apple makes products that include choices that YOU PERSONALLY don't like is incredibly weird and entitled. Just buy something else! There are options!

elzbardico• 2 years ago

This ship has sailed a long time ago.

Thanks the MPAA and RIAA.

dmitrygr• 2 years ago

If I buy my grandma a device that is locked down in a way that NOBODY (including her, under the patient guidance of a scammer on the phone) can root, that is my choice. If you want a device that can be unlocked, the world is full of android tablets. Go wild. Some of us want an un-rootable device!

AnthonyMouse7• 2 years ago

The main exception to this, I believe, would be for critical systems where compromising operation through software modification presents too high a risk. Examples I'm thinking of include:

    > certain medical devices, such as implants and insulin pumps
    > subsets of electronic control units for cars

These are precisely the opposite of what should be exceptions. If you have a pacemaker implanted in your body, you need the right to replace whatever software is running on it before the manufacturer goes out of business and takes the signing keys with them.

There exists no thing where the owner of the device should not have the right to replace the software it runs, and the more safety-critical the device the more important the right.

ellenhp2• 2 years ago

Disclaimer I don't have a pacemaker: As a biohacker, I think this is a really bad take. I regularly put things [1] in my body of questionable provenance, and then cut them out of myself without anesthesia when they don't suit me anymore, but I like being alive too much to mess with a medical device like a pacemaker. Pacemaker hacking sounds hardcore and like, respect to anyone who does it but I don't think it should be easy to flash one of those things because I'd really prefer nobody do that to me in my sleep.

[1]. https://dangerousthings.com/

AnthonyMouse7• 2 years ago

You pretty obviously don't want to mess with it frivolously. But if there's something wrong with it, and you have to fix it? That seems better than the alternative where you can't. Note that the right to modify it doesn't imply that you're required to in the absence of any reason to.

Also, if someone wants to kill you in your sleep, they... don't need you to even have a pacemaker. And the security of medical devices is notoriously bad, so if you're worried about that sort of thing, be more worried that the status quo doesn't allow you to fix the existing remotely exploitable wireless security vulnerabilities.

mattxxx• 2 years ago

Personally, I think everything should be hackable, however...

Limiting the ability to _easily_ modify what's running on a system is more about public cyber-health than the individual's freedom. Viruses + malware much more easily infect systems when they are running outside of a sandbox.

curvaturearth• 2 years ago

At the very least there should be the right to unlock and use a device after it loses support. A whole ecosystem of software could exist (and does in some cases) to help support or repurpose old devices. If the hardware is still good for something, let it be used! I'm still using my MacBook Pro 2013 and it is fine. I worry I will not be able to do this with Apple's newer laptops. In addition, I want to be able to use my Sonos hardware after Sonos inevitably discontinues support. More realistically I'll eventually have to stop using my Sonos speaker, and realizing this I will never buy another Sonos product.

medhir4• 2 years ago

OP here. Really glad to see others engaging with this topic, I wrote up this post because I felt like there wasn't anything out there that was advocating for unlocked hardware as part of the discussion on "right to repair".

As someone that works in security, I fully understand the need for sane defaults that protect the average user. I even advocate in the article that we should keep these defaults in place for the most part.

What I tend to not understand is the argument that there should be no option for more enterprising users to access their hardware at the lowest levels because we need to protect the average consumer. It may be a footgun for some, but that's sort of the point. I expect to be able to modify something I own, whether it's to my detriment or not.

My argument isn't that root access should be the default, but at the very least it should be an option. I just don't think it's right that we've normalized corporations blocking the ability to load / inspect software, which often is marketed as a safety or privacy thing, but is arguably more a business decision meant to protect profit margins.

BytesOfProblems• 2 years ago

Thanks for this article, it was the most succinct way to describe the right to own and right to repair regressions I've noticed. I'm glad I can point to your article instead of trying to describe it myself. If you're looking for others advocating for this I know of Louis Rossmann. He also recently started a wiki on consumer protection that I hope to contribute and collaborate with to empower users.

https://wiki.rossmanngroup.com/index.php/How_to_help

tonymet• 2 years ago

A libertarian and consumer friendly right-to-repair (RTR) / right-to-own (RTO) governance model could be something like Orthodox Union or UL but for consumer devices

The Right-to-Repair union RTR-U could be a simple authority with access to the keys to unlock the device if the vendor breaches certain commitments. Various levels of commitment could be offered similar to copy-left. The basic / lowest level would be "can unlock if the company dies". Higher commitments could be

will unlock if ...

company starts telemetry

company changes licensing

company stops providing timely firmware updates.

This way consumers are guaranteed a certain quality of service and access on their devices. Then vendors get a stamp of approval (like OU or UL) with the level of certification like RTR-open, RTR-private , RTR-long-terms-support etc.

This governance operates within private enterprise while consumers are offered the option to buy into vendors who commit to right-to-repair and right-to-own.

markus_zhang7• 2 years ago

Because they just want to extract more $$ from the consumers.

I'm OK to void any guarantee if I can root it easily, TBH.

notorandit5• 2 years ago

Yes, please! Unfortunately, your smartphone doesn't (really) belong to you. It's a shared property between the hardware maker, the low level software producer (Qualcomm or Apple), the os owner (Google or Apple) and maybe finally you.

Undocumented hardware plus closed source drivers for almost everything make all this possible.

fsflover11• 2 years ago

your smartphone doesn't (really) belong to you.

Speak for yourself. Sent from my Librem 5.

notorandit5• 2 years ago

Fair! But 0.000001% of the market is hardly a point.

steve_taylor• 2 years ago

I don't really agree with this. There's no shortage of computing platforms in a variety of form factors (including tablets) for which root access is possible. When you buy an iPad, you do so knowing what you're getting and what you're not getting. It's a truly optional purchase, because no one really needs an iPad.

I'd be concerned with a move away from root access across the board, but that doesn't appear to be happening.

konaraddi• 2 years ago

Reminds me of how certain macOS APIs are gated behind the paid apple developer program so you can’t, for example, write a macOS app using Network Extensions on your own Mac until you join the Apple developer program (100USD/year in the US). I understand why they do it but it does feel weird that I can’t write certain code for my own Mac unless I pay for a subscription (on top of already having paid for the Mac).

throw_me_uwu• 2 years ago

The preference has been stated thousands of times. There's nothing to debate. They won't give you root and power. The only question is what you will do to change things:

Do you:

- Buy open devices?

- Sponsor development of open devices?

- Start open device companies?

- Develop open software that competes with walled gardens in quality and ease of use?

- Sponsor open software?

- Use open software?

- Engage in lobbying?

- Drop exploits (that would be worth a pile of gold) to let people jailbreak devices?

- ...

- Fake-care or real-care?

Right to root access

Related Stories