Right to Root Access
Right to Root Access
right to repair laws should include provisions requiring manufacturers to unlock a device's bootloader (to provide root access) upon consumer request.
I enjoy your optimism Medhir, but it's more likely in the next five years that people start having their cars remotely bricked than it is any kind of right to root legislation takes off.
The world would be a better place if locked bootloaders were not a thing. I agree that there needs to be laws in place to prevent the sale of these devices.
Locked in the technical sense of being able to verify the operating system isn't a bad thing. The problem is when the device owner can't add signing keys of their choice.
The latter is what GrapheneOS does.
Something that worries me about that is attestation. This is the advice from the GrapheneOS Devs:
https://grapheneos.org/articles/attestation-compatibility-guide
They're asking app developers to trust their keys specifically, which would mean that the app might work on GrapheneOS, but not my fork of GrapheneOS with some cherry picked fix I want.
It would be much better if we stamped this out now, before all online services require attestation.
Imagine a PC with a locked bootloader.
Imagine having to purchase a new PC to simply be able to get updates. Or be locked to windows for life and not have an option to install Linux, BSD, whatever else.
There is zero reason to restrict installing a new os or firmware on a phone except planned obsolescence
Imagine buying a PC but only be able to install anything from one app store made by the manufacturer
How do you feel about locked bootloader's on game consoles?
I figure this is one of those edge cases people might fall on either side of. But consoles are also a really large segment of the tech market, so it's worth thinking about.
I feel like consoles are targeted at a section of the population that doesn’t value freedom over how they use their hardware. Locked bootloaders on consoles are technically not good, but it’s almost like it’s part of what defines a game console. If it really valued the users freedom, it’d just be a PC. The steam deck and similar devices are changing that idea though.
Locked bootloader for warranty coverage: totally fine
Refusal for owner to unlock and void warranty: not fine.
I must disagree. For example, the Magnuson–Moss Warranty Act entitles you to use aftermarket parts in your product without invalidating your warranty, as long as the aftermarket parts don't cause damage. I agree with the spirit of this law, and I believe software should be considered a "part" in this context.
This is my first time reading about this. I'm very curious to hear a lawyer's thoughts on this.
If you change the bootloader to some other software, how could the company be expected to provide support for something they may have no knowledge of? Suppose I develop some theoretical SnowsuitOS and then complain to Samsung support when it doesnt run on my smartphone? It seems very likely that some conflict in my code could be causing problems, as opposed to an issue with my hardware.
I feel like to require this, you'd have to prove that the software is functionally equivalent to their software, right? (Side note, isn't this problem undecidable? Program equivalence?)
If you replace a wheel on a tractor you can pretty easily define what it should and should not do. Determining equivalence seems simpler with a physical situation. On the other hand, I'm pretty sure program equivalence is not a solved problem.
My point here is that I don't think it's reasonable to legally require a software company to offer support without limits, because they cannot be sure that there is not an issue with the (unsupported) software you are using.
In most situations, even that is giving too much power to the manufacturer. It's fair for them to flash the original software as part of any diagnostic or service process, but not fair to refuse to repair or replace a product that actually has a hardware defect just because the owner put different software on it.
The example picture at the top of the article is weird.
The window title reads "nano" but the software running in the window is Pico, Nano's now deprecated (and strangely-licenced) spiritual parent. Or it's Nano hacked to have a Pico header which, while somewhat fitting with the theme, that would be even more weird.
*sigh*. What now, Columbo? Y’know I’ve tried to be very helpful you know, with all of your questions, but now it’s becoming very annoying! I’m very busy you know with all my, uh, hacking, as you can plainly see!
The purpose of a locked boot system is privacy. A MacBook is a less secure device, and one that's been rooted and had linux installed is basically open season for any attacker. An iPad trades off the ability to put some other OS, for fairly close to total security. State-level enemies can torture you or run expensive intrusion software… and Apple improves the defenses against the latter every time. Now it reboots if it hasn't been used in a while, say sitting in an evidence locker.
Boot loader aside, you can write code on an iPad.
There are plenty of code editors, interpreters, and several of them have compilers. The premiere one is Pythonista, but I'm also fond of LispPad (R7RS Scheme). There are a few "linux in a box" things like ish, which give a full shell in a sandbox where it's safe.
I wasn't able to find any pico or nano apps, but there are several Vims and emacsen.
This is simply incorrect. Implementing a lock on a bootloader is not dissimilar to a lock on your house. A person breaking in doesn't care that they are breaking the law, they just need to find the how of breaking in. If I as a consumer want to enter my house or give a copy of my key to someone else as a backup I should be able to do so. If I want to leave my door unlocked I should have that right however foolhardy it is. And when it comes to locking the bootloader of a computer most people won't notice it in general use but that isn't the point. It is about the edge cases, the end of life for the device, the lack of security updates.
To expand on this analogy: Your (mobile) computer is your property, you shouldn't be treated as if it was only a flat for rent.
The locked bootloader is having a lock at all. Without that, anyone can enter at any time.
In reality, home door locks are merely suggestions, they're trivially picked or broken open, windows can be entered through. But if you DID have a secure building, you wouldn't want any of the security systems to be replaced.
You get full access to operate in a secure building once you've used the key/biometrics/passwords/interrogation. You don't have access to replace the locks with tinkertoy homebrew shit, because we know that's not as competent.
This opinion is so backwards, it's actually impressive.
The purpose of a locked boot system is to control what the device does as much as possible, which intentionally, or incidentally (it makes no difference) means the manufacturer and only the manufacturer gets to decide how much privacy they get to invade.
Get real.
How is it privacy if it locks you into using an OS that reports on you?
The purpose of a locked boot system is privacy.
No. Once you strip away all the rhetoric, the purpose of a locked boot system is control (over who or what can boot the system).
Current secure boot implementations are like a door lock installed by someone else, which you are not allowed to replace and that may or may not allow you to cut your own duplicate keys for it. You have no control whatsoever over who the people who installed the lock may have given keys to, and if it turns out that the lock has a fundamental design flaw that means it can't do its job properly, well, sucks to be you. You can't even guarantee that the lock won't morph into a new shape randomly or under the control of the installer, invalidating your existing keys in the process.
Rooting a device is a tradeoff. An unreliable door lock that you don't entirely control may be better than none, but if you know you're leaving the door unlocked, you also know you need to take other precautions to safeguard what's inside (or simply not leave anything of value there in the first place).
The ideal would be a locked boot system that is installed by the user and is fully under their control, but I have yet to encounter one.
The ideal would be a locked boot system that is installed by the user and is fully under their control, but I have yet to encounter one.