Hacker News Reader

Comment by jacquesm | Hacker News Reader

Ah, another case of OTA murder of perfectly good devices. You have to wonder at what point regulators will step in to ensure that companies end up liable for updates that effectively cost consumers money. Updates should be to make devices safer and better, never worse. One of the devices in our house has been nagging me since forever to update and I'm just about 99% sure that if I do allow it to update I'll end up regretting it. So now I'm facing a tough choice: potentially run a device with a security issue on the network here or play the update game of Russian Roulette (with 5 bullets instead of the normal single one) and hope that I still have a functional device afterwards.

View on HN

Look at the bright side: a bricked phone won't collect your personal data, you won't be able to fall for phishing scams on it, and its battery should last a really long time!

Hyperbole aside, let's remember that "better" and "safer" exist in dialectic tension. Or, "convenience" vs. "security". Often, functionality or features are removed because they were insecure, so now your device is "safer". If you've got a big feature update pending, consider how many bugs/flaws it may introduce as the software gets "better".

Slim pickings...

I've posted a small summary below, with links to consistent reports of this happening + a software course of action to unbrick the phones.

It's totally on google who's refusing to release the QPST files. It's creating ewaste for no acceptable reason.

Hopefully, someone will leak the QPST files to allow a restore from the Qualcomm EDL firehose mode.

Nice sleuthing! It's incredible to me that there is no bullet proof recovery mode for this, even something as dumb as an Arduino can recover from almost every form of abuse.

> It's incredible to me that there is no bullet proof recovery mode for this, even something as dumb as an Arduino can recover from almost every form of abuse.

There's a bullet proof recovery mode, check my comment below ( https://news.ycombinator.com/item?id=39145490 ) where I detail the steps and provide links.

The EDL firehose mode is just the phone showing up on a very unique USB-ID and waiting to be spoon fed the data to be rewritten to its flash. It needs partition specifications (think like a GPT partition table) + the binary data for each partition (think like the EFI partition for the bootloader, the Windows partition for the actual operating system etc)

It would take litteraly 1 minute for someone with access to the QPST to post it to archive.org and help all the people who've been affected by the bug.

It would take each of them about 5 minutes to restore their phone to a working state. You may object that not everyone may have the technical ability to do that, but I'm sure the small businesses fixing phones in the malls would be happy to charge for the "service" of plugging the phone on a Windows computer, double-clicking on an icon, drag and dropping the right files and clicking on another button.

IMHO, the fact this situation is allowed to persist, even after multiple reports of similar pixel phone problems in the past, can only have 2 explanation: 1) the good people at google writing this software have less understanding that you and I, 2 random HN users or 2) there's money to be made in not fixing the problem, as it will increase the update cycle (people with a dead phone will buy another phone)

I'm all for making money, but not if the consequence is creating ewaste, and forcing people who may not have deep pockets to spend more money on yet another broken-by-design phone.

That's way beyond most ordinary users though.

> That's way beyond most ordinary users though.

To take a broken phone to the mall where there're a small store that's known to fix phones?

Yes, precisely. That puts the onus for the fix squarely on the users, who have not created the problem and who likely will mis-identify it. If it were to happen to me - it won't - it would cost me half a day and that's assuming the 'small store in the mall' will be able to do the repair on the spot, which if there is a glut of customers due to this issue may well not be the case.

You forgot 3) It requires money to fix the problem, and Google has become such a bureaucratic mess, that it can't get out its own way to do it.

Those of us in large corporations see that pattern quite often.

> Those of us in large corporations see that pattern quite often.

It's sad there's such a dilution of responsibility such problems are allowed to persist, and that nobody cares they are killing random people phones.

I can already see the storm of people saying that making companies liable for the software that costs consumers money is going to kill hobbyists, because we are just casualties waiting to give everyone money without any expected right

I have a very simple solution for that: you get to choose: you are either the provider of commercial software and accept liability for your product or you have to open source it.

So obviously open source software for proprietary hardware is treated as, er, ..?

I don't know what you're getting at, that's clearly spelled out already. But in case you didn't get it: that's without liability for the manufacturer because you have the choice to bypass them. Presumably such a situation wouldn't occur very often because 'proprietary hardware' with 'open source software' wouldn't be proprietary for very long. The software would tell you all you need to know about how it works.

Have you heard about Android?

Yes, if you have a point to make you should spell it out. Google manufactures phones, has an open source OS and has a bunch of proprietary stuff that they do not release, see:

https://en.wikipedia.org/wiki/Android_(operating_system)

"However, most devices run on the proprietary Android version developed by Google, which ships with additional proprietary closed-source software pre-installed, most notably Google Mobile Services (GMS) which includes core apps such as Google Chrome, the digital distribution platform Google Play, and the associated Google Play Services development platform. Firebase Cloud Messaging is used for push notifications. "

At least they're doing updates.

Reply on news.ycombinator.com