Hacker News Reader

Comment by comex | Hacker News Reader

> Aside from root access, we were not forced to make any compromises in terms of features or functionality

from the link posted in the comments here. Can someone with more knowledge of the Android ecosystem explain this? I guess the phone cannot come with root access out of the box, but since Google's own devices come with unlocked bootloaders, why would it care about that?

View on HN

I guess the rule is just no root without the user asking for it in some way? The Nexus 5 is unlocked, but it's not root by default. I definitely agree with that rule, I don't think it should be difficult but it definitely shouldn't be default. I'm a big fan of the sudo approach in some Linux distros.

It's better to have root access disabled by default on phones sold to the general public since they are more likely to just click the "Allow root access" button because they don't understand the security implications of allowing root access.

Can somebody identify just exactly what the "security implications of allowing root access" are? Are we referring to unrestricted escalation with sudo by an unprivileged user/app?

CyanogenMod has never allowed sudo without confirming it with a UI, or only allowed it for a few days back when it launched.

Yes, root access is system-level root access

A user that does not know what the security implications of root access are will most likely just click "allow" when presented with a dialog

I think you are conflating issues, the Nexus 5 is only unlocked in the sense of being able to take it to any carrier. The bootloader is shipped locked but is easily unlockable by the user.

In terms of DRM the bootloader is not locked. The 'locking' is only a security toggle.

For phone security, you actually don't want root enabled by default, especially if it is being sold to noobs. Even for pro users, it is best to be able to do most of what you need to do on the phone without requiring root privileges. Although ofcourse if it is really your phone, you should have the ability to root it, which you will still be able to do provided you have an unlocked bootloader, or even just if can run an root program from over usb. It is much more important to have an unlocked bootloader than just having root access pre-installed.

Does the same apply to a laptop or desktop PC? If not, why not?

Of course it does, but PC operating systems were not initially created on that assumption, making an abrupt conversion to such a system impractical.

Smartphones don't have decades of legacy software and workflows to deal with.

Running full root privileges is bad. The most trivial example is "rm -rf /" or "chown user:user -R /".

Everyone who has done this at least once has been enlightened.

"Thou shalt not take the name of root in vain."

Nexus devices do not ship with unlocked bootloaders. Users have to manually "fastboot oem unlock" for that to happen.

Perhaps it should say "unlockable" bootloaders, not unlocked. A locked but unlockable bootloader is what every phone should ship with - unlocking the bootloader wipes the system back to factory state. This way, it can't be used to compromise user data.

an unlocked bootloader isnt the same as a rooted device

It is on practical terms!

From my understanding, it's really not. An unlocked bootloader means that with physical access you can install software on the phone without wiping it first. With root you have full (controlled) access to the file system. You can actually have a locked, rooted phone, but it means that if you want to change something low-level like your ROM, you may need to wipe the phone to install it.

Well, yes, an unlocked/unlockable bootloader is not the same as a rooted phone, that's correct. But the former often leads to the latter: for example, the process of rooting a Nexus phone involves flashing a new recovery system, which takes advantage of the unlocked bootloader.

If you don't have an unlocked bootloader, you have to resort to exploits and other flaws in the system. Releasing a phone with an unlockable bootloader is opening a door to rooting and many "unauthorized" modifications.

That's what I mean they're the same in practical terms.

An unlocked bootloader is better than a rooted device. If you have root but not an unlocked bootloader, you are unable to get full custom ROMs (meaning kernel and such, not just userspace), full control of your device, etc...

But with an unlocked bootloader, you just flash your way to root. Or to a full custom ROM. Or to whatever the hell you want.

Aside from the only thing that makes our platform open, we didn't compromise on anything!

That's a very uncharitable way of reading it. You can still get root.

Reply on news.ycombinator.com