Hacker News Reader

Comment by Osiris | Hacker News Reader

What I don't understand is why phone manufactures are even worried about rooting. If it's about service and warranty, they can simply make it clear that replacing the OS voids the warranty and they won't provide service for the phone.

Besides warranty and service costs, what else are they so worried about that they feel it necessary to add these protection measures?

Surely the percent of customers that root/mod a phone is so small that it's not worth the man-power and engineering to try to "fix" the problem. It seems there must be some other concern they are trying to resolve that escapes me.

View on HN

Most people preached the benefits of rooting make a very compelling case. And often this case is to very dumb people. Dumb people like to complain. Loudly.

Remember from their perspective, 99% of all the feedback they get back (that they don't have to pay for) is negative. Therefore, they are solely concentrated on reducing that negative feedback by preventing failure in the first place. They view these protections as a way of doing that. It reduces the need for a larger support department and therefore their bottom line.

Of course, this ignores the fact that by making the methods for circumventing these protections more complex, they are creating a more error-prone process, and therefore a large support volume. But whatever, I didn't say it had to make sense.

The same is true of bookshelves, cordless drills, computers, and anything else that people can buy. Someone will always find a way to fuck up the assembly, modifications, or general use. But there is no EULA on my bookshelf saying I can't modify it.

So why are mobile phones different?

(My guess: "because we can". Nobody has figured out how to make a bookshelf that I can't put something too heavy on. But people have figured out how to ensure I can only run Verizon's adware on my phone, so they don't cripple my bookshelf but they do cripple my phone. Follow up question: why does the market allow this? Nobody would buy a crippled bookshelf with an EULA.)

Is your follow-up question rhetorical? Nevertheless: the market isn't rational. Plus people are used to skipping over EULAs and not reading contracts. Plus the people that actually care are a minority. Etc. etc.

Before and at the time of purchase most people don't think about the EULA or it's consequences. It's merely part of the shrink wrap that needs to be removed to enjoy the shiny new product.

Perhaps if it were something consequential instead of something to click through it would actually affect peoples habits.

Most EULAs are atrocious. I shouldn't need to hire a lawyer to buy a consumer product.

The people making these products probably don't want them heavily enforced either. If things actually got to that point nobody would buy their products.

I think they like the current status: you technically owe them your first born but still buy their products. If you do anything they don't like, they can stop you. But people still buy their stuff. Its the best of both worlds for them.

"The people making these products probably don't want them heavily enforced either. If things actually got to that point nobody would buy their products."

That's exactly my point. There currently isn't anything that forces the consumer realize what they are getting themselves into. If they did, they probably wouldn't be buying the products.

Carrier control, most likely. I'm sure HTC are being lobbied hard by carriers who want to be able to use artificial restrictions to segment their offerings.

Exactly. Phone manufactures are in the pocket of the carriers (as google proved with the Nexus one, you can't sell phones without carrier relations) and carriers don't like rooting as it limited their options to block certain software and services (e.g. VOIP / tethering).

Perhaps it's setting things up for the future, but the carrier in question here, T Mobile, is notable for its openness in not blocking tethering or voip.

I should imagine the decision about how much protection is applied to the system is made long before the device is accepted on various carriers. Ok, this is a 'made for T-mobile' device, but its likely it will appear in almost the same form on other carriers under another name and HTC branding. So, it would be easier to build in the protection other networks want at this this early stage.

It needn't be T-Mobile to have prodded HTC in this direction. In fact, it's more likely to have been another carrier who said "We'll only start to carry this phone if you lock it down like this."

I guess it's because virus writers also to try to root the devices to install rootkits. I'm quite in favor of requiring hardware mods (although I'd prefer a jumper...) to modify the OS.

But they can do that now already, just like the regular phone-rooting hackers.

The article mentioned that the new version needed hardware hacking to root. Maybe at one point a software hack will be found, I don't know. I'm just saying that there is a legitimate reason to lock down the software, especially for a mass market product like a phone.

Has anyone really ever seen a real phone virus?

http://news.cnet.com/8301-13579_3-10393136-37.html

You'll note it only hit jailbroken iPhones.

Is it really a virus if it has to guess your root account's password to work?

Yes it is. It takes advantage of a known vulnerability to spread.

You can't expect a non technical person to understand the importance of strong, unique passwords. Most people can't remember more than one (and a simple one, at that).

I don't really see from that article what the issue is. It just tries to SSH into your phone, and if you left the default root password, ta-da, it's in; then it tries to use your phone to SSH into other people's phones.

Is there some part of the story missing here? The only vulnerability I see is that foolish people are allowed to run SSH servers on their phone.

Well if you don't see the potential vulnerability in that, I guess there's no point arguing. Back when Linux distro's shipped with all services enabled out of the box, and sometimes with default passwords, people used to say "oh that's not a real problem, it's the stupid users." Well maybe so, but that doesn't reduce the amount of rooted boxes. So as people wised up, and the hardliners were told to shut it, things moved to 'secure out of the box' (for some definitions of 'secure') setups. Hardware-locked phones are the next step of that. There may be (misguided) commercial interests in trying to control the software; most real-world issues with a higher complexity than 'what will I have for breakfast' are multi-faceted. All that said, there is a real case to be made to control the setups of devices that are supposed to 'always work'. That's all.

Pushing the jumper idea further, It should hard reset the phone from read only memory when flipped back to "not root".

It may be a small minority of people rooting their phones but from the carrier perspective they're the ones who would otherwise be willing to pay $20-$30/month for a wireless tethering plan.

This is the same false perspective as the RIAA believing a pirated copy equals a lost sale though, and we've seen how well that has worked out.

Even saying "No" costs money. Plus, some customer's tech buddy / kid will do the "upgrade" for them to make the phone "better", the customer will encounter a problem, and then the carrier's support explanation of rooting will make no sense. How often have you seen someone help someone else by changing some settings on their computer?

Often, sure. But that's no excuse for locking people out of their own hardware. Mobile platforms are the future computers for many people, and we simply cannot accept a future where the carriers and manufacturers control all aspects of computing.

I think the carriers are afraid of becoming commoditized; if their phones are open, then they really are nothing more than an ISP. If they had to compete like ordinary ISPs, price for bandwidth would become the primary selling point, and that eventually becomes a race to the bottom.

Reply on news.ycombinator.com