Google just approved our first CyanogenMod phone | Hacker News Reader

Google just approved our first CyanogenMod phone

plus.google.com

177 pointsbane53 comments

> Aside from root access, we were not forced to make any compromises in terms of features or functionality

from the link posted in the comments here. Can someone with more knowledge of the Android ecosystem explain this? I guess the phone cannot come with root access out of the box, but since Google's own devices come with unlocked bootloaders, why would it care about that?

I guess the rule is just no root without the user asking for it in some way? The Nexus 5 is unlocked, but it's not root by default. I definitely agree with that rule, I don't think it should be difficult but it definitely shouldn't be default. I'm a big fan of the sudo approach in some Linux distros.

It's better to have root access disabled by default on phones sold to the general public since they are more likely to just click the "Allow root access" button because they don't understand the security implications of allowing root access.

Can somebody identify just exactly what the "security implications of allowing root access" are? Are we referring to unrestricted escalation with sudo by an unprivileged user/app?

CyanogenMod has never allowed sudo without confirming it with a UI, or only allowed it for a few days back when it launched.

Yes, root access is system-level root access

A user that does not know what the security implications of root access are will most likely just click "allow" when presented with a dialog

I think you are conflating issues, the Nexus 5 is only unlocked in the sense of being able to take it to any carrier. The bootloader is shipped locked but is easily unlockable by the user.

In terms of DRM the bootloader is not locked. The 'locking' is only a security toggle.

For phone security, you actually don't want root enabled by default, especially if it is being sold to noobs. Even for pro users, it is best to be able to do most of what you need to do on the phone without requiring root privileges. Although ofcourse if it is really your phone, you should have the ability to root it, which you will still be able to do provided you have an unlocked bootloader, or even just if can run an root program from over usb. It is much more important to have an unlocked bootloader than just having root access pre-installed.

Does the same apply to a laptop or desktop PC? If not, why not?

Running full root privileges is bad. The most trivial example is "rm -rf /" or "chown user:user -R /".

Everyone who has done this at least once has been enlightened.

"Thou shalt not take the name of root in vain."

Of course it does, but PC operating systems were not initially created on that assumption, making an abrupt conversion to such a system impractical.

Smartphones don't have decades of legacy software and workflows to deal with.

Nexus devices do not ship with unlocked bootloaders. Users have to manually "fastboot oem unlock" for that to happen.

Perhaps it should say "unlockable" bootloaders, not unlocked. A locked but unlockable bootloader is what every phone should ship with - unlocking the bootloader wipes the system back to factory state. This way, it can't be used to compromise user data.

an unlocked bootloader isnt the same as a rooted device

An unlocked bootloader is better than a rooted device. If you have root but not an unlocked bootloader, you are unable to get full custom ROMs (meaning kernel and such, not just userspace), full control of your device, etc...

But with an unlocked bootloader, you just flash your way to root. Or to a full custom ROM. Or to whatever the hell you want.

It is on practical terms!

From my understanding, it's really not. An unlocked bootloader means that with physical access you can install software on the phone without wiping it first. With root you have full (controlled) access to the file system. You can actually have a locked, rooted phone, but it means that if you want to change something low-level like your ROM, you may need to wipe the phone to install it.

Well, yes, an unlocked/unlockable bootloader is not the same as a rooted phone, that's correct. But the former often leads to the latter: for example, the process of rooting a Nexus phone involves flashing a new recovery system, which takes advantage of the unlocked bootloader.

If you don't have an unlocked bootloader, you have to resort to exploits and other flaws in the system. Releasing a phone with an unlockable bootloader is opening a door to rooting and many "unauthorized" modifications.

That's what I mean they're the same in practical terms.

Aside from the only thing that makes our platform open, we didn't compromise on anything!

That's a very uncharitable way of reading it. You can still get root.

A little more context:

http://androidcommunity.com/oppo-n1-cyanogenmod-edition-gain...

Oppo has made some nifty, extremely useful, very high quality, just-on-the-edge of legit (read: you can disable region coding easily) DVD players for years. I really like their stuff, and thus would have very high expectations for this phone. It's really nice to see their name on it.

You can disable region coding easily on most of big brands also. For example, Philips has simple for digit unlock code enterable via remote.

Could someone explain what this phone is? The link is worthless and their site isn't very good at explaining it.

afaik it's the Oppo N1[1] running Cyanogen. I got to play with one at the Big Android BBQ and it was pretty sweet.

[1] http://en.oppo.com/products/n1/

A 5.9" screen seems huge - would it fit in an ordinary trouser pocket?

It fits in mine... but I also wear 36x38 jeans since I'm 6'9", so I'm not a typical use case. My current phone, a Note 3, fits with a lot of room to spare so I suppose it depends on the size of your jeans.

I can also use these phones one handed whereas I don't see most people doing that.

What's the point of the Google CTS Certification?

The CTS tests is the suite that ensures that all versions of Android at the same API level behave the same as far as a developer is concerned. It verifies that the public APIs do what they are documented to do.

These three articles should give you a lot of background.

http://www.theverge.com/2012/9/14/3335204/google-statement-a...

http://www.theverge.com/2011/05/12/google-android-skyhook-la...

http://arstechnica.com/gadgets/2013/10/googles-iron-grip-on-...

(page 3)

I am still curious if Jolla can be shipped by any of the Android OEMs in the Open Handset Alliance since it used a third party Dalvik VM, anyone know?

Would love for someone to elaborate a little bit. Is this deal any good for CM?

Cyanogen Inc.'s business model is to license an improved version of Android to phone manufactures who want something better than what their competitors have; large manufactures do a bunch of customizations themselves (MotoBlur, TouchWiz, HTC Sense), but smaller manufactures are often left with "what you get from Android". However, to get the Play Store, as well as other first-part Google apps, a device has to pass Google's strict compliance tests. This is thereby Cyanogen's first customer, and a demonstration that their model is not fundamentally flawed (Google didn't deny the phone during certification testing did to some weird changes CyanogenMod has accumulated over the years, and a manufacturer wanted their product enough to get all the way through that process). If you were trying to value the company, I'd say a lot of the risks of their business model just got removed: they should be worth a ton more today than they were yesterday.

> However, to get the Play Store, as well as other first-part Google apps, a device has to pass Google's strict compliance tests.

If you're talking about officially, when the device is shipped, then this is true. However, one of the first steps after installing a custom rom is to flash a Google Apps package for your device (which includes Google Play). People still install Google's applications without the device passing any test.

I would quibble with even that, as those "Google Apps packages" are often themselves from sketchy sources... but even so, being some unofficial process done by a user is not really relevant from the perspective of a shipping device purchased through a carrier...

I have a CyanogenMod-enabled phone and haven't installed Google's apps on it. I got some open-source stuff and that's it. It's a two-year old Galaxy S (first gen) and battery now lasts for 8 days.

Seriously? With "normal" amount of calls? I would love to hear more... Battery life is my biggest gripe with the smartphones.

I don't know what's normal to you. It's a backup phone, using a PrePay plan on another network (prepays are pretty cheap in my country) and indeed I'm making less calls with it than with my primary. I'm also keeping it off the data-network, unless I need to connect.

So basically I use it as a dumb phone and it's a pretty good dumb phone.

Not having (or using) LTE helps quite a bit, since it's still fairly new technology with a lot of optimization still needed. Also the fact the Galaxy S has a 4" screen. Galaxy S lives on most of all from being nearly identical to the Nexus S, so it can borrow a lot from it.

Yes, but Google also turns a blind eye to that, and by and large CM and other custom ROMs stay compatible anyway. Google could, however, start cracking down if custom ROMs started causing problems.

> However, to get the Play Store, as well as other first-part Google apps, a device has to pass Google's strict compliance tests.

The thing I wondered about when I saw this is whether there will now be a legitimate path for getting Google Play on Cyanogen-modded devices now. I kind of get the feeling not, based on what you're saying.

Thanks!

I did some looking, but found it a bit troublesome to figure out - would this phone work on Verizon just fine?

No. Verizon only allows pre-approved devices to appear on their network, regardless of whether you are prepaid or postpaid. They do this by checking the IMEI identifier of the device. If it's not one of theirs, it won't work.

Their network is also incompatible with the radio in this device.

My understanding is that Verizon is required by the FCC to allow any device on their network, as a result of Google hijinks in 2008.

That said, enforcing it is another matter.

http://buzzmachine.com/2013/09/17/verizon-caught-red-handed/

Unless something has changed, the article you linked to is basically the end of the story. Despite promises, Verizon has not moved to permit the Nexus 7 on their network, and there is no easy/useful enforcement mechanism to make them do so. The provisions are effectively toothless.

Sadly, that's my understanding, yes :/

If you read forum reports, it seems people are activating it by using IMEI numbers from other tablets and whatnot, but Verizon is not making it easy, or (IMO) living up to their contractual obligations.

I really need to ditch Verizon when my contract is up... Does anyone have network suggestions for the Bay Area? (Palo Alto, Mountain View type areas)

TMobile has some really good plans. They are trying a lot of new things. An unlimited plan from them with a Nexus 5 is what I use and I'm very happy with it.

How is their coverage in SF?

looks pretty good here: http://www.rootmetrics.com/check-coverage/

I've heard Tmo is good in cities from friends that use it, it's the non-city areas that you'd have to watch out for.

good (nob hill here) bit slow during peak hours (HSDPA/LTE?) and degrades very fast if you exit the city going toward socal.

Thanks for this - that sucks hard, I'm sorely tempted to switch off of Verizon. The only thing that keeps me on there is that I'm on a $40/month legacy family plan that still has unlimited data.

Reply on news.ycombinator.com