Xiaomi global bootloader unlock policy has changed | Hacker News Reader

Xiaomi global bootloader unlock policy has changed

xiaomitime.com

64 pointspatrakov64 comments

As an end-user having my last four phones as Xiaomi's that get upgraded to LineageOS upon their replacement as the primary phone, this affects me in an indirect fashion:

I bought Xiaomi's because they were popular for custom ROMs, and their popularity was based on decent hardware for a decent price with a boot loader that's unlockable without too much hassle.

Once the bootloader unlock becomes a hassle, fewer developers will want to touch them, so their popularity for hobbyists will decline, therefore their sales will decline, leading to even further decreasing popularity amongst developers.

It'll be interesting to see how much difference it makes to sales, but Xiaomi will no longer be a preferred brand for me to consider. Pixels seem to be great for custom ROM compatibility, but they're ridiculously expensive even on the second hand market. Motorola might be the new go-to.

It’s one per year and the stated reasons are fair enough. Even if you get a new phone every year it’s business as usual.

Yes, that doesn't really affect me as an end user, but I think it disproportionately would affect developers. If it makes their lives harder then they'll avoid.

I think the stated reasons are bullshit. Unlocking the bootloader isn't a process your regular customer base is performing, so it will only affect the hobbyists. They're basically stating they don't want the hobbyist community anymore.

And maybe that's a bit harsh given they're just dropping from three per year to one per year, but why? How much of a difference to their stated reasons* will the change from three to one make?

I think it's just the tightening of a screw that's intending to squeeze out an element they no longer want.

(Or maybe it's to satiate an untrusting US government, to delay their own Huawei-ing)

*Reasons stated in the article are assumptions and haven't come directly from Xiaomi.

> disproportionately would affect developers

Developers of what? If it affected every software developer out there, then yeah this is a major issue. But it's a small subset of developers - mobile developers. Actually, a smaller subset - the ones on Android, not iOS. And even smaller than that - not the ones who develop apps in Kotlin (what we see on the Play Store), but the ones who hack in C++ on AOSP.

Every community likes to imagine that it is disproportionately large and powerful and influential (unless being tiny is a flex) and the ROM community is no different. To put it in perspective, the size of the LineageOS install base is 1.5 million, which is 0.05% of the total Android install base - 3 billion.

To claim that this community will make any difference to the vast majority of normies who just want to use WhatsApp, TikTok and their bank app - it's a bit delusional if I'm honest.

And to somehow tie this to the US government, that's full on tinfoil hat conspiracy mongering. You cannot be serious.

Totally understand the size of the install base for LOS. As someone else said, their target market is SE Asia.

Where I am, Xiaomi is pretty much an enthusiast / hobbyist only brand.

> the total Android install base - 3 billion.

That's so wild to me as an early millennial. For a good chunk of my life the smart phone didn't even exist and going back further computers were only for nerds. Now 3 billion freaking people using a computer every single day in a form factor that at one point I thought would be always marginal (vs desktops and laptops).

But they don't make LOS for new Xiaomi phones for a long time now, though? Unless you want some shady rom made by some rando from xda.

I have one with "Pixel Experience" and one with 'PixelOS". Both of which, by my understanding, are built on top of unofficial Lineage OS releases - but I might be way off base.

Pixel Experience was not based on LineageOS. And Pixel Experience is dead and unsupported now. While there is no official direct successor, EvolutionX offers a comparable feature set.

That loss of 1000 or so users will really affect them I am sure. Got to remember HN and hacker culture is an echo-chamber.

That's always a valid point, and I'm going to say 'but', but it's a 'but' without a lot of conviction:

But, in Australia at least, it's not super easy to buy a Xiaomi. I have to go looking for them. Samsung is synonymous with Android, it's Apple or Samsung that people say, not Apple or Android.

People still look at me sideways when I say it's a Xiaomi (or Poco).

Australia isn't really a market that acts as any kind of leading indicator though.

So exactly the point. Not their target market is it. SE Asia they are practically the number one selling phone with OPPO. And a minority (and I mean minority, perhaps a low thousands) will be wanting custom roms.

It sucks that companies have so successfully trained an entire generation (or more) of people who treat their phone (and computer too) like an appliance.

hardly anyone would be tinkering their phone to make the hardware do more than the default applications.

The same is happening (or is already happened) to cars.

I'm not sure if it is the companies who "trained" anyone that. I think it is more correct to say that many wants that and companies recognised this desire and are offering what the costumers want.

The companies do this simply because this is the way to grow their market. For every single person who finds enjoyment in twiddling with their tools, there are hundreds who just want the thing to work and get on with other things in their life.

Many want those things, but that doesn't imply that offering yet another option for the median customer, imitating the average or market leader, is the optimal strategy either in our current economic/corporate systems or an idealized system with different rules.

Yes, there are economies of scale that come from chasing the middle, and yes, it's probably easier to just mimic an iPhone than to do the creative work to try to invent something better than what worked before. And yes, the tradeoffs, design goals, economic targets, and principles of repairability and customizability that go into, say, an F150 make those pretty popular trucks, but since Ford is still making F150s, and Chevy, and Dodge, and Toyota also have offerings that are direct competitors in that space, that doesn't mean that a hypothetical competitor can maximize their market share by making yet another F150.

Why does everything cluster into the same choices?

> Why does everything cluster into the same choices?

i suspect it's the same reason you get a cluster of the same stores/shops in a region.

It's the classic economic dilemma - Hotelling's law (https://en.wikipedia.org/wiki/Hotelling%27s_law)

Consumer want has to be expressible. It's the "faster horses" problem.

The market doesn't know what it wants until the options exist. Until a culture forms.

Almost all companies are competing in one direction only, a race to the bottom. There's sometimes some semi-geeks freedoms offered, but usually those are gilded cages too. We'd have to go back some something like Maemo to see consumers getting something actually empowering, a portable mobile Linux+FreeDesktop offering.

>It sucks that companies have so successfully trained an entire generation (or more) of people who treat their phone (and computer too) like an appliance.

Just like how most of us treat cars and stovetops as appliances?

Look, becoming omnipotent is an admirable pursuit, but time is a finite resource and by fuck most of us simply do not have enough of it. We can choose to become potent in something and most of us are in fact potent at something, but that isn't necessarily going to be electronics or computer programming.

There are over 1.5 million active users of LineageOS, let alone other roms. A good chunk of these are Xiaomi. Not a trillion dollar market, but hardly 1000 users.

It's also easy to make assumptions, such as that it's few users

90% of statistics and figures are made up

Do not forget the 6 degree of separation: 1000 people are directly connected to 100 people each on average and those 1000 are generally those who suggest what to buy to most of their contacts, and those contacts will reverberate as well.

Average Joe is more ignorant than ever in IT terms, but we are near a breaking point, and OEMs have felt it, trying to worsen as usual, and as usual such ideas will led them in the opposite direction.

What are you using these secondary phones for? Mine just collect dust in a drawer

One acts as a backup for my primary phone, I keep them as basically a mirror of each other as much as possible in case the primary gets stolen or broken.

That same one, or a different one, gets used as my 'house' device on WiFi only, so that my primary phone's battery gets used less and is therefore less likely to need charging if and when I need to leave the house.

I have one as a semi-hardware cryptocurrency wallet that can go online if necessary, but primarily is offline.

I also used to use one GPS spoofing in Pokémon Go - I actually found the intellectual challenge of getting it working far more satisfying than the actual act of playing Pogo 'remotely'. But I'm a couple of years 'sober' now and have no desire to regress.

I've also used a phone or two as webcams / security cameras. Permanently plugged in, but with the app ACCA (requires root) which limits charging to within certain battery percentages to minimise the chances of spicy pillows.

I found a wall of shame that includes manufacturers that make it hard or impossible to unlock the bootloader[1]. It was mentioned in a forum post[2].

[1]: https://github.com/melontini/bootloader-unlock-wall-of-shame

[2]: https://xdaforums.com/t/future-of-unlocking-bootloaders-in-a...

For context, Xiaomi first implemented this policy to combat a plague of devices that were being sold at retail with malware preinstalled. In the middle-income markets that Xiaomi considers home turf, a large proportion of phones are bought from independent retailers rather than major chains, so Xiaomi have limited control over the onward supply chain. While this policy might seem like a pointless annoyance to the kind of person who installs custom ROMs on their phone, it's a careful attempt to balance the freedoms of power users against the security of ordinary users.

And if the existing restriction to three devices per year didn't stop it, how is reducing it by two going to make a difference?

(and maybe it will, but I don't see it)

individuals will now have to use ChatGPT to get suggestions about how to unlock Xiaomi devices with some tool that was stolen from Xiaomi by hacking them

Chinese users root their device and damage the wifi via software instructions for a refund. Happened during the Mi 11 series

However I do think phone companies should allow root after warranty expires.

I'm a custom ROM developer that spans a lot of devices (TrebleDroid GSI, a generic kind of custom ROM that works on thousands of Android devices) I've bought dozens of smartphones to implement bug fixes (current total number is 50).

I used to buy Xiaomi devices, because there are a lot of users (lots of bugs to fix), and often have brand new SoC at affordable price early. But I've stopped buying Xiaomi for a few years now, because of the low reliability, high complexity of Xiaomi's bootloader unlock, and the rules keep changing.

So far it looks like the community of people using Xiaomi devices with custom ROM is still pretty strong, so it's not necessarily a bad idea to buy Xiaomi. But I very strongly recommend that you unlock bootloader right after buying your device [1], because buying a device now and expecting to be able to unlock it in 4 years look too optimistic to me.

[1] Though you'll most likely won't be able to "just" unlock and forget it, because of all the apps that really really really want you to run Xiaomi and Google adwares and not your own OS

What are your preferred devices now?

I know it’s off topic but this post reeks of LLM-generated content. The itemized lists with bold two word headings are a dead giveaway.

No.

It's unfortunate that we even have to have this discussion, but it doesn't read that way to me. The text is not quite...homogenous enough to have come from an LLM IMO.

Got the same impression, same "aligned" structures and constructions like "here’s what you might want to consider". Probably not fully LLM-generated, but definitely LLM """enhanced"""

Yeah

> The new policy signifies a key change in Xiaomi’s way of handling things and now raises several questions over how developers, enthusiasts, and other users will be affected.

I don't know any human who speaks or writes like that.

> Although not explained by Xiaomi officially, the following could be some of the reasons for this update.

Likely LLM, but will give it a pass

> Allowing a limited number of devices that one can unlock reduces for Xiaomi the possibility of misuse of an unlocked device by performing some unauthorized or potentially harmful activity.

Exactly how ChatGPT would "enhance" your writing.

> The new limit will indeed be a big problem, especially for those working with several devices for testing and development purposes.

"a big problem" sounds too unprofessional for ChatGPT, and this part likely was revised by a human writer.

> To the Community of Custom ROMs: This move will delay the development of third-party ROMs, kernels, and mods for Xiaomi devices.

A confusing claim without any context/explanation/evidence? That's LLM.

It's a very common way to write in Indian English. What is probably happening here is that ChatGPT is trained in text over the internet and it is possible that there's lot more Indian English text on internet than others, and hence this effect.

Don't Chromebooks already do a nag on every boot if they're unlocked?

Why not do it on phones too? It's not like they get rebooted very often. That would totally combat the "compromised phone sold as clean" issue.

my redmi note 9 has a small icon with a unlocked lock in the top middle on boot not much compared to a pixel though.

Yep, lots of phones do this and in big scary letters.

Upon boot my custom ROM'd Xiaomi's give a five second warning page telling me the bootloader is unlocked, so, yeah, it's not hidden.

There may be ways to suppress that though.

So that means that the stated reason for further rate-limiting boot loader unlocks (to prevent unlocked, compromised phones from being sold as clean) is BS.

Don't know about Chromebooks; I have some Chromeboxes, all unlocked, and all of them show the Coreboot splash screen before booting but no nags or warning signs. My Pixel7, however, since installing GrapheneOS shows a very detailed screen on boot indicating the operating system has been swapped. not a problem for me, but surely It'd raise alerts if I wanted to sell the phone. So it's not like phone manufacturers lack ways of telling the user that something happened. To me it's just the old security by obscurity mentality paired with greed: a lighter and open OS on the phone translates in less user data being exfiltrated, longer device life and potentially fewer sales of newer phones.

How do they uniquely identify individual end users? In other words, is anything stopping me from creating a new account for each device I want to unlock?

They verify by phone number.

Right. So the unlock cost is now the cost of a burner SIM at the convenience store, and a bunch of hassle.

Burner SIMs are not as easy to come by in China, which is what they care about.

You need to sign in with a Xiaomi account to unlock devices, presumably they have similar spam protection to other big companies, IP addresses, device fingerprinting, etc.. So if you unlock a device from account A, then account B tries to unlock a device from the same computer/IP address, you'd be caught.

Given the amount of users who actually bother to unlock their bootloader, I doubt you'd need more sophisticated duplicate account detection

In addition to this, Google is phasing out device integrity check to the Play Integrity API, which will completely kill custom ROMs if apps adopt it, which bank apps most likely will, because their entire security is based on box-checking.

I feel like governments should enforce unlocked bootloaders on consumer devices. If I want to install a different OS on my phone, TV, fridge, whatever, I should be allowed to

This would be great for individuals but bad for companies' revenue streams.

Such is the nature of pro-consumer & competition-enabling legislation.

There's so much I already know my devices are fully capable of but they are artificially nerfed and likely only because it would empower competitive products emerging.

Anyway allowing to unlock the bootloader without providing the updated and complete kernel source code is useless for ROM development.

That's what they do with most of their device, I don't think there is much lineage os official support for the recent phone (3-4 years old) and the unofficial are made from patched kernel with a little bit of code from a phone, a little bit from another, etc.

Xiaomi was and is pretty much dead for rom development, i don't know who keep repeating that online but they obviously haven't been paying much attention.

The Galaxy S24 is a popular phone that has a very easy to unlock bootloader and published kernel sources, yet next to zero ROM development.

The SafetyNet war is over, Google won and custom ROMs now just make you loose too much.

I believe it's also a lack of desire for custom rom. Years ago, most manufacturers rom were atrocious so you would flash custom ones but nowadays beside the few Chinese one, most things are 'good enough'. Especially with Samsung one UI, what more could a custom rom bring than oneui doesn't already has?

It's much more active with Chinese phone because their system looks like half ass copy of iOS, and on pixel because you can get grapheneos and others but that's all.

Google didn't need to lock things up, they just needed manufacturer rom to be good enough.

Look on the bright side. Locking bootloaders has the potential to break the duopoly by driving more people towards Linux phones or other unlocked devices. The more people that move, the stronger those communities get. I've been daily driving a Furi for 3 months now and am glad to have options outside of the duopoly.

i can easily get another sim card to get around the limit as an end user. this only affects people who want to buy devices en masse and would have to get a sim card each. and even that is not that hard if you compare the cost of a sim to the cost of a phone.

the annoying thing about xiaomi unlocking is the random wait time. when my mother visited a few years ago, i got her her first smartphone that i wanted to install /e/OS on. i remembered my own wait time was a week, so i figured i'd have enough time while my mom was here. when i started the unock process i realized that the wait time was randomized and this time i got two weeks. luckily that still left me one day before my mother had to leave so i managed, but if the wait time would have been just a few days more i would have been unable to set up the phone for her.

On the one hand, Xiaomi is enough popular to do such kind of good thing to attract attention for geeks.

On the other hand, this can reduce the risk of fraud and cost of anti-fraud, especially when cost of phone is becoming lower and lower.

The biggest problem with Xiaomi's original ROMs is the crazy amount of ads. And they don't even offer a subscription-based business model to avoid them. The hardware is good these days, but the software is not.

The official EU ROMs ship without ads

I'm in Europe and had endless ads on my Xiaomi phone - normally for Xiaomi crap, like themes and games. I actively had to go in and turn off notifications for various Mi apps to stop them pestering me with notifications several times a day, but there are still full-screen ad interruptions in the stock apps like the file manager and notepad.

My Redmi Note 13 Pro Plus is nowhere near as good as my last Xiaomi - the ads seem to have increased, and the battery life has gone to shit after <1 year of usage. I won't get another.

Did you import from China?

I had an Xiaomi 14 for a little bit with the EEA ROM and had zero ads.

Is it me or does this blogs content seem AI generated?

The old one device policy

Reply on news.ycombinator.com