The world would be a better place if locked bootloaders were not a thing. I agree that there needs to be laws in place to prevent the sale of these devices.
this post was submitted on 14 Jan 2025
403 points (98.6% liked)
Technology
60541 readers
5759 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 2 years ago
MODERATORS
Imagine a PC with a locked bootloader.
Imagine having to purchase a new PC to simply be able to get updates. Or be locked to windows for life and not have an option to install Linux, BSD, whatever else.
There is zero reason to restrict installing a new os or firmware on a phone except planned obsolescence
Imagine buying a PC but only be able to install anything from one app store made by the manufacturer
Locked in the technical sense of being able to verify the operating system isn't a bad thing. The problem is when the device owner can't add signing keys of their choice.
The latter is what GrapheneOS does.
Something that worries me about that is attestation. This is the advice from the GrapheneOS Devs:
https://grapheneos.org/articles/attestation-compatibility-guide
They're asking app developers to trust their keys specifically, which would mean that the app might work on GrapheneOS, but not my fork of GrapheneOS with some cherry picked fix I want.
It would be much better if we stamped this out now, before all online services require attestation.
Agreed. Microsoft proposed something along those lines under the name "Palladium" a couple decades ago and was widely criticized, even in the mainstream press. Apple and Google doing the same thing to our phones barely got a whimper.
I don’t have a problem with boot loaders doing cryptographic checks in general, as long as the ultimate decision lies with the device owner.
How do you feel about locked bootloader's on game consoles?
I figure this is one of those edge cases people might fall on either side of. But consoles are also a really large segment of the tech market, so it's worth thinking about.
I feel like consoles are targeted at a section of the population that doesn’t value freedom over how they use their hardware. Locked bootloaders on consoles are technically not good, but it’s almost like it’s part of what defines a game console. If it really valued the users freedom, it’d just be a PC. The steam deck and similar devices are changing that idea though.
I feel like consoles are targeted at a section of the population that doesn’t value freedom over how they use their hardware.
Well I don't think I really believe that. Certainly, I don't think gamers care less about technical freedom than other groups, say for example users of iOS devices, or smart TVs, or routers, or car entertainment systems. Most of those are pretty locked down, but I don't think a lack of caring on the user's part has much to do with that.
but it’s almost like it’s part of what defines a game console.
I do think you're absolutely right about that. A console is supposed to be plug and play. You plug in a controller, and you can play your games. You shouldn't have to worry about drivers, software updates, system specs, whatever; the games just work.
(Admittedly, this has been shifting lately, with constant software updates and different editions of the same console. But I think the point still essentially holds true.)
But yeah, once you start opening up the platform, making it easy to tinker with, suddenly total compatibility can be harder to guarantee, much like it is with Android.
The PS3 used to have an unlocked bootloader with official Linux support. Sony removed it because of piracy. Of course, piracy is still possible, but as always, it's only an excuse to exert more control over customers.
That's pretty cool though, I'm glad they at least experimented with it. I wonder if they just chickened out at some point or if they actually found a steep increase in piracy?
I enjoy your optimism Medhir, but it's more likely in the next five years that people start having their cars remotely bricked than it is any kind of right to root legislation takes off.
That's already a thing, albeit for leases.
Locked bootloader for warranty coverage: totally fine
Refusal for owner to unlock and void warranty: not fine.
I must disagree. For example, the Magnuson–Moss Warranty Act entitles you to use aftermarket parts in your product without invalidating your warranty, as long as the aftermarket parts don't cause damage. I agree with the spirit of this law, and I believe software should be considered a "part" in this context.
This is my first time reading about this. I'm very curious to hear a lawyer's thoughts on this.
If you change the bootloader to some other software, how could the company be expected to provide support for something they may have no knowledge of? Suppose I develop some theoretical SnowsuitOS and then complain to Samsung support when it doesnt run on my smartphone? It seems very likely that some conflict in my code could be causing problems, as opposed to an issue with my hardware.
I feel like to require this, you'd have to prove that the software is functionally equivalent to their software, right? (Side note, isn't this problem undecidable? Program equivalence?)
If you replace a wheel on a tractor you can pretty easily define what it should and should not do. Determining equivalence seems simpler with a physical situation. On the other hand, I'm pretty sure program equivalence is not a solved problem.
My point here is that I don't think it's reasonable to legally require a software company to offer support without limits, because they cannot be sure that there is not an issue with the (unsupported) software you are using.
Nobody is asking 'software' companies to support software they didn't write.
We are asking hardware companies to support their hardware and not use different software as an excuse not to replace faulty hardware.
They can reflash their own software to test if needed.
Of course hardware vendors could be legally mandated to adhere to standards to make things easier.
If you change the bootloader to some other software, how could the software company be expected to provide support for something they may have no knowledge of?
like xiaomi did, in the past at least. if you can reinstall the official software, you can receive service under warranty
My point here is that I don't think it's reasonable to legally require a software company to
phone manufacturers are hardware companies first and foremost
In most situations, even that is giving too much power to the manufacturer. It's fair for them to flash the original software as part of any diagnostic or service process, but not fair to refuse to repair or replace a product that actually has a hardware defect just because the owner put different software on it.
It's fair for them to flash the original software as part of any diagnostic or service process
only fair if it does not come with any data loss. so basically not actually fair
Backups are, first and foremost, your responsibility. It's unfortunately not realistic to expect someone to diagnose whether an issue is software-related or a hardware failure on any obscure DIY OS you might have installed. But as long as it's possible to flash back the original firmware, warranty should still apply
Software can easily harm the actual device, so locking it to prevent that from happening in a warranty situation doesn't seem super off-base to me.
So can installing a faulty third-party cooling fan, but in the USA, the law requires the warranty provider to prove the fault was caused by improper maintenance or defects in third-party components.
The example picture at the top of the article is weird.
The window title reads "nano" but the software running in the window is Pico, Nano's now deprecated (and strangely-licenced) spiritual parent. Or it's Nano hacked to have a Pico header which, while somewhat fitting with the theme, that would be even more weird.
*sigh*. What now, Columbo? Y’know I’ve tried to be very helpful you know, with all of your questions, but now it’s becoming very annoying! I’m very busy you know with all my, uh, hacking, as you can plainly see!