Hacker News Reader

Comment by rgmerk | Hacker News Reader

I'm a strong believer in the right of people to use their devices as they see fit...but there's a real-world problem here.

You know who else loves unlocked bootloaders?

Cyberstalkers and domestic violence perpetrators, who use them to install hidden stalkerware.

View on HN

I'm a strong believer in the right of people to cut their food as they see fit...but there's a real-world problem here.

You know who else loves knives?

Criminals and thugs, who use them to engage in larceny and assault.

And guess what? In some jurisdictions, including some US states, possession and sale of some types of knives is banned or controlled, because they are used by criminals and thugs for larceny and assault.

You're also not permitted to upload whatever firmware you like to your car's engine if you want to run it on the street.

Note also that I didn't argue that uploading alternate firmware to phones should be banned. I'm just pointing out that there are real-world safety reasons for restricting modifications, and if you want the freedom to do so you should at least try and engage on the downsides rather than just yelling FREEEDOM very loudly.

This could be easily solved if manufacturers simply allowed for using a unique password to unlock the bootloader. Want to install a custom ROM? Simple! Put the phone in recovery mode, insert the unique manufacturer-provided password, unlock the bootloader, flash the new ROM, go back to recovery, change the password to one of your choosing, lock the bootloader again, add the ROM's official private key to enable safe boot.

This is entirely possible, and yet nobody wants to make it accessible.

So if you forget your password, your expensive device is instantly and permanently bricked and becomes e-waste?

No, the password is only to lock-unlock the bootloader. If you forget it you won't be able to install a new ROM but you will still be capable of upading your OS or factory resetting it

Forgetting a password shouldn't cause permanent loss of functionality of hardware.

I'm not understanding your argument. You say that unlocking a bootloader is dangerous, so what's your solution? You can't have non-unlockable bootloaders because that would mean a loss of hardware functionality, which you just suggested you consider unacceptable. You can't have easily unlockable bootloaders because that would be dangerous. So now what?

I proposed a very reasonable solution that gives the user control AND responsibility of their own device. If you don't want the responibility (and the control) then stick with your manufacturer's locked bootloader and never touch it.

I don't know about you but I would really like if my work phone had a company-set bootloader lock just like my work laptop has a company-set BIOS lock in case someone steals it or gets lost. There are plenty of professional and personal reasons why my solution would make a lot of sense in my opinion.

> You say that unlocking a bootloader is dangerous

I didn't say that. In fact, I believe the opposite.

> You can't have easily unlockable bootloaders because that would be dangerous.

I do want easily unlockable bootloaders.

I confused you with the person I originally replied to.

Still, my solution still allows to have a passwordless bootloader if you choose to not set a password, so I really don't get what would be wrong with it.

Laws against custom engine firmware and knives are unjust themselves, so they shouldn't be used to justify other things.

I hate to have to make this argument, but here goes...

...where do you draw the line? An M240 machine gun? A Stinger missile? A PFOS factory? A Special Atomic Demolition Munition?

We regulate private possession of dangerous items all the time, and pretty much everybody draws the line somewhere despite vigorous dispute where that line should be drawn in specific cases.

You said you're concerned with "thugs" using knives to do bad things. That's where you seem to draw the line. I am afraid what you'll try to restrict when you see the reports about these people breathing air.

What about pre-installed spyware tracking you? Where do you draw the line there?

Did you know that, for example, Roborock stock firmware sends your wi-fi password to Xiaomi? [1]

Does that make you feel secure? Where are the calls for regulation on this?

[1] https://www.youtube.com/watch?v=uhyM-bhzFsI&t=586

Reply on news.ycombinator.com