News for hackers. Stuff that matters.
Re:Remote Code Execution on Most Dell Computers by cryptonector on Wednesday May 01, 2019 @03:14PM (#19800606)

  OEM: Let's differentiate our otherwise
       commodity hw product!
  OEM: I know, let's add value with bundled
       software the customer can't uninstall!
Then the bundled software turns out to (inevitably) be useless vulnerable garbage. Inevitably because a) the customer doesn't need it, b) it's engineered with all the effort that normally goes into adware for captive audiences (i.e., _minimal_), which means it will be vulnerable.

Here's an idea:

  OEM: Let's differentiate our otherwise
       commodity hw product!
  OEM: Let's add NO bundled software.
That would be fantastic.
Re:Remote Code Execution on Most Dell Computers by LeoPanthera on Wednesday May 01, 2019 @05:42PM (#19801929)
It works, too. This is partly why the iPhone was so popular, at first. It's been so long now that probably everyone has forgotten, but before the iPhone, essentially every smartphone on the market was fully loaded with trialware, crapware, and often had hardware features locked out by software so that you could pay extra to unlock them.

I remember one particular phone that had four user-configurable hardware buttons, but Verizon had locked them down so that they all opened the Verizon ringtone store.

The iPhone was a breath of fresh air if only for its software.

Re:Remote Code Execution on Most Dell Computers by iClaudiusX on Wednesday May 01, 2019 @07:35PM (#19802771)
Even a brand new, unlocked, $1000 Samsung Galaxy S10 comes riddled with adware and spyware, some of it unremovable:

"There are apps from Flipboard and Spotify as well as a unremovable version of Facebook. McAfee Anti-virus is baked into the operating system as "security," and the Samsung Gallery app wants to share my location with Foursquare. The storage management settings, which is just a simple file-cleanup app, is "Powered by Qihoo 360," a Chinese security company. A caller-ID feature built into the phone app is provided by a company called "Hiya."

Once you run through setup and connect to Wi-Fi, the phone spawns an undismissable "Secure Wi-Fi" notification, which, it turns out, is an ad for McAfee VPN subscription service. I tried blocking the notification—it's not blockable—but it turns out you can open the advertisement, carefully consider subscribing to McAfee VPN, say "No," and then it will go away. Cool."

https://arstechnica.com/gadgets/2019/04/galaxy-s10-review-fo...

Re:Remote Code Execution on Most Dell Computers by tbrock on Wednesday May 01, 2019 @08:21PM (#19803167)
I don't understand why folks subject themselves to this for $1000 when other options are available.

You don’t have to keep supporting Samsung by buying their phones. Get a pixel instead.

Re:Remote Code Execution on Most Dell Computers by sfifs on Wednesday May 01, 2019 @09:40PM (#19803739)
Google branded hardware has a notorious reputation for problems about 1-1.5 year down the road. This has happened with every single Google device anyone in my family has ever owned and so we've basically stopped buying Google. Very few manufacturers apart from Samsung come close to Apple in terms of sheer hardware quality and service support and Apple OS's lack of customisability, pathetic camera and lack of 3.5mm jack completely rules it out for me. That's basically why I have paid a premium for Samsung over the years. I may look at Huawei too now that they appear to have significantly upped the hardware quality game.

Being virtually stock Android, pre-installed software is easily disabled (even FB) - the only major complaint is inability to assign Bixby button to something else without rooting.

Re:Remote Code Execution on Most Dell Computers by saulrh on Wednesday May 01, 2019 @10:12PM (#19803937)
? I used a Nexus 5 up until last year. Ended up upgrading last year, not because it had issues or because lineage stopped releasing for it, but because IT at my new job refused to let six-year-old devices on the network. Meanwhile, my parents complained continuously about their three-year-old iPhones getting slower and slower. Anecdotes, yeah, but...
Re:Remote Code Execution on Most Dell Computers by aosmith on Wednesday May 01, 2019 @11:01PM (#19804230)
My nexus 5 still works, I don't use it anymore but the thing was an absolute tank.
Re:Remote Code Execution on Most Dell Computers by robocat on Thursday May 02, 2019 @12:00AM (#19804578)
Nexus 5 was not a tank in my experience.

On mine the plastic frame cracked between the power button and the volume control (I think a reasonably common problem with this phone, I've never had a frame crack on any other phone). After that one button gets stuck on, which makes phone cycle reboot - OK - I can workaround that. Then the microphone went bad: that is caused by the crack causing pressure on the micro-connector which causes an electrical issue. That wasted more time and eventually my workaround for that issue failed.

I have had close experience with 5 different Nexus devices, and 4 of the 5 had nasty failure modes.

The Nexus line has been far less reliable than the iOS devices I have had experience with, and all the Apple devices got far more security updates over their useful life. Note: I usually use Android phones and iPad tablets (although I have also personally had iPhones and Android tablets).

Re:Remote Code Execution on Most Dell Computers by sannee on Thursday May 02, 2019 @03:19AM (#19805550)
The soft plastic casing definitely cracks easily. On the other hand it does not fail catastrophically. I have dropped my Nexus 5 on the floor more times than I can count and while it has miniature cracks around the button/power connector it's nothing that prevents the phone from working.
Re:Remote Code Execution on Most Dell Computers by robocat on Thursday May 02, 2019 @03:24PM (#19811643)
> On the other hand it does not fail catastrophically

So my two complete failures due to the crack were not "catastrophic" then?

The case cracking is common, and those two failures were common enough: most users would consider the phone uneconomic to fix, and not everyone has my tenacity or skill to waste time fixing their phone.

I also think it was that phone where the flash slowed enough to make it barely usable.

Back on topic.

The only Nexus I have had that hasn't had a problem was a Samsung Nexus 10 (still goes, but stuck on insecure Android 5.1).

The only Samsung phone I have had was the original Galaxy Nexus, which was still going when I gave it away last year. It's problems were: 1. screen burnin (OLED) and 2. Google didn't release Android 4.4 (due to TI dropping OMAP4 support?) even though 4.4 came out within 2 years. That phone cost more than an iPhone 4. My colleagues got iPhone 4 phones at the same time, and they got updates for twice as long and their phones remained useful for far longer.

So my experience with Samsung hardware has been good. I have always avoided buying Samsung because I hate their modified Android versions and lack of updates.

Re:Remote Code Execution on Most Dell Computers by neilv on Wednesday May 01, 2019 @11:46PM (#19804511)
The Nexus 5 is one of my favorite devices for PostmarketOS (project to get sustainable mainline Linux on smartphones and tablets): https://wiki.postmarketos.org/wiki/Google_Nexus_5_(lg-hammer...
Re:Remote Code Execution on Most Dell Computers by PascLeRasc on Wednesday May 01, 2019 @11:53PM (#19804545)
I loved mine, I'd still be using it if I could have found one that didn't have motherboard issues. It was a pinnacle of industrial design and I'm sad that smartphone designs have moved away from it.
Re:Remote Code Execution on Most Dell Computers by ajdlinux on Thursday May 02, 2019 @12:02AM (#19804587)
My Nexus 5 was also fantastic.

And then I heard the horror stories of everyone in my office who, having had a great experience with the N5, went and bought a Pixel.

Re:Remote Code Execution on Most Dell Computers by tigershark on Wednesday May 01, 2019 @11:03PM (#19804243)
My iphone 4 was pretty much as fast as the nexus 5 and way less buggy. The nexus 5 is the only phone that I almost threw against a wall, I’ll never touch android anymore after that shit show. You must have a very high tolerance to bugs and poor performance. My friend was very happy when I sold him that piece of crap, so it must be subjective.
Re:Remote Code Execution on Most Dell Computers by petre on Thursday May 02, 2019 @12:07AM (#19804611)
What did you replace it with? I also use a N5.
Re:Remote Code Execution on Most Dell Computers by saulrh on Thursday May 02, 2019 @12:54AM (#19804858)
Pixel 2 XL, since I also had to stop using a Nexus 7 at the same time and I didn't want to have to deal with not having a large screen to read on. It's been good so far. I haven't had any issues with the lack of a headphone jack, mostly because that jack was also the one part of the Nexus 5 that'd also failed so I was already on bluetooth-only. I upgraded about eight months after the release so they'd hammered out the QC issues on the screen. I see some black smears when I'm scrolling over pictures with black backgrounds on dark themes with the brightness all the way down in a dark room, but that's not something I'd call an issue. The real problem is actually the curved screen, which is sensitive to touch all the way out to the bezel a millimeter or two around the side of the phone, so I get a few misclicks a month when my palm hits the side of the screen while I'm trying to type. I get about two days of battery out of it despite heavy use while I'm on the subway to and from work. It does not feel a sturdy as my Nexus 5, and the screen is not as nice to read on as the Nexus 7 was; the aspect ratio is far too tall. It's definitely better than my old Droid Incredible, though I still miss the physical keyboard. I don't know if it'll be as good as the Nexus 5. It's so far only a sixth as old.
Re:Remote Code Execution on Most Dell Computers by ssheth on Thursday May 02, 2019 @01:07AM (#19804931)
OnePlus phones (originally replaced N5 with a OnePlus 3 .. now upgraded to 6T) .. they have the same "flagship killer" ethos of the original N5
Re:Remote Code Execution on Most Dell Computers by tfigment on Thursday May 02, 2019 @08:59AM (#19807382)
Same here. On 5T. My only issue was lack of security updates in the end. I could try to flash with another distro but too much work with too little gain. Love my 5T even more.
Re:Remote Code Execution on Most Dell Computers by petre on Friday May 03, 2019 @03:24AM (#19816261)
There are LineageOS images for the 5T. I had weekly updates on my N5 until 26 ian 2019 and it's a six year old phone.
Re:Remote Code Execution on Most Dell Computers by lozaning on Wednesday May 01, 2019 @09:51PM (#19803796)
It's now possible to reassign the bixby button to something else without rooting the phone.
Re:Remote Code Execution on Most Dell Computers by sfifs on Wednesday May 01, 2019 @10:21PM (#19803992)
Oh interesting. How do you do that? I don't see anything obvious in the settings area.
Re:Remote Code Execution on Most Dell Computers by lozaning on Thursday May 02, 2019 @11:41AM (#19809072)
You've gotta make sure that all your native samsung apps are up to date and then you should see the setting: https://www.digitaltrends.com/mobile/how-to-remap-the-bixby-...

Rooting will still give you the most functionality, but Samsung has finally at least partially relented.

Re:Remote Code Execution on Most Dell Computers by sfifs on Thursday May 02, 2019 @10:32PM (#19815006)
Ah thanks! Wasn't seeing this option
Re:Remote Code Execution on Most Dell Computers by lsiebert on Thursday May 02, 2019 @09:38PM (#19814728)
Tasker can assign the Bixby button as of the newest update that just dropped. Also double clicking power and volume up and down long presses (though I had to use adb to enable the volume on my phone, none of this requires root).

I hadn't messed with tasker in a long time but that got me back.

Re:Remote Code Execution on Most Dell Computers by wtvanhest on Wednesday May 01, 2019 @11:46PM (#19804515)
I have been a samsung buyer for at least 6 years and 4 phone models. The bixby button is an absolute deal breaker for me. I dont know what i will do, but it wont be a samsung with bixby
Re:Remote Code Execution on Most Dell Computers by ddalex on Thursday May 02, 2019 @01:27AM (#19805000)
I assigned the Bixby button to WhatsApp in settings, no root needed
Re:Remote Code Execution on Most Dell Computers by guelo on Wednesday May 01, 2019 @09:27PM (#19803650)
I got an S10 because of the headphone jack and sd card slot. I uninstalled or disabled any software I didn't need pretty easily. I find it to be a fantastic phone.
Re:Remote Code Execution on Most Dell Computers by maxerickson on Wednesday May 01, 2019 @10:15PM (#19803965)
Those things are available on cheaper phones that don't come with so many ads.

(for example, the Moto G7. Of course, lots of people have Lenovo concerns)

Re:Remote Code Execution on Most Dell Computers by King-Aaron on Thursday May 02, 2019 @02:01AM (#19805165)
Except cheaper phones tend to be worse consumer products.
Re:Remote Code Execution on Most Dell Computers by esalman on Thursday May 02, 2019 @03:23AM (#19805561)
> I don't understand why folks subject themselves to this for $1000 when other options are available.

After my "flagship" HTC10 became unusable within 2 years because of battery issues, I was in the market for a new phone. But I was determined to not spend over $250. I ended up with Nokia 6.1. The only issue with it is that it is just a little slow because it uses snapdragon 435 (I think). However for the same reason it's battery lasts up to 2 days. Other stand-out features are unibody metal design, and Android One (meaning no bloatware). I bought it for only $180 from Best Buy after price match, and sold the HTC for $60 at decluttr.com. I think this is one of the best value purchase I ever made- up there with a Toyota Corolla.

Re:Remote Code Execution on Most Dell Computers by voltagex_ on Thursday May 02, 2019 @03:35AM (#19805612)
If I wanted the best camera in a phone on the market, my choices were the Note 9 (before the Pixel 3, I think) or one of the iPhones. I have enough invested in the Google/Android ecosystem that moving would be painful, plus I'm not a fan of Apple.
Re:Remote Code Execution on Most Dell Computers by sizzle on Wednesday May 01, 2019 @07:44PM (#19802851)
Do Google pixel phones offer an unadulterated, bloatware free Android experience?
Re:Remote Code Execution on Most Dell Computers by gilrain on Wednesday May 01, 2019 @07:57PM (#19802976)
As long as you don’t consider bundled Google apps bloatware, yes.
Re:Remote Code Execution on Most Dell Computers by nextos on Wednesday May 01, 2019 @09:18PM (#19803588)
You can always build your own AOSP (which is essentially Android minus Google). In case of Pixels, this is particularly easy. I use a Pixel to avoid Google, which is a bit paradoxical.
Re:Remote Code Execution on Most Dell Computers by flukus on Wednesday May 01, 2019 @10:33PM (#19804058)
And as long as you don't consider google a spyware company, which they are.
Re:Remote Code Execution on Most Dell Computers by frankhorrigan on Wednesday May 01, 2019 @07:50PM (#19802911)
Yes, that was always the draw of the Nexus and Pixel lines. "Vanilla Android." Really hope that's still the case, though I've switched back to iPhone for a number of reasons.
Re:Remote Code Execution on Most Dell Computers by sizzle on Wednesday May 01, 2019 @08:52PM (#19803399)
I used to buy Nexus phones and jailbreak them for SU root privileges so I could deny apps (mostly by google) from using permissions without my consent on app launch.

With that being said, I'll be switching to an iPhone for privacy reasons, starting with my next phone and I've been a loyal Android user since Google started with the G1. How times have changed...

Re:Remote Code Execution on Most Dell Computers by rhizome on Wednesday May 01, 2019 @09:48PM (#19803782)
You can use LineageOS for a zero-GOOG experience from first run without uninstalling anything.
Re:Remote Code Execution on Most Dell Computers by robocat on Thursday May 02, 2019 @12:07AM (#19804618)
FYI I have a Nokia 7+ and it is fairly good for giving a pure Google experience ("Android One"), without being quite so expensive.

Also HMD Global seem to be reliable at giving the security updates OTA.

I haven't looked at the newer Nokia 7.1.

Re:Remote Code Execution on Most Dell Computers by kingosticks on Thursday May 02, 2019 @05:29AM (#19806118)
Re:Remote Code Execution on Most Dell Computers by robocat on Thursday May 02, 2019 @04:33PM (#19812571)
Sure, awful, but HMD Global fixed the problem which I respect.

My other choices are Google (expensive, multiple Nexus letdowns in past), Samsung/LG (awful software), Chinese phones (crapware, I don't trust), Sony (abusive relationship), a bunch of other brands with other reasons I dislike, or iPhone (costly and I don't like the UI).

Re:Remote Code Execution on Most Dell Computers by kingosticks on Thursday May 02, 2019 @06:02PM (#19813408)
True. And i totally agree with your roundup of the main alternatives. I went for a Chinese phone last time and it's probably the best one I've had in terms of quality and features. But Lord knows what stuff I'm sending back to China. I've been meaning to try lineage out.
Re:Remote Code Execution on Most Dell Computers by fletchowns on Wednesday May 01, 2019 @07:46PM (#19802868)
It was bad enough with the fucking Bixby button that can't be disabled on my Samsung S8 Active. Hearing about the S10 solidifies that my next phone will absolutely not be a Samsung. Which is a shame since the hardware is otherwise great.
Re:Remote Code Execution on Most Dell Computers by weq on Wednesday May 01, 2019 @10:04PM (#19803887)
Bixby remapper has worked of me since i bought my S8
Re:Remote Code Execution on Most Dell Computers by fletchowns on Wednesday May 01, 2019 @10:39PM (#19804091)
I'm not interested in giving some random app a bunch of permissions.
Re:Remote Code Execution on Most Dell Computers by j16sdiz on Wednesday May 01, 2019 @11:54PM (#19804549)
In S10, you can check bixby to double click. No extra app install needed.
Re:Remote Code Execution on Most Dell Computers by dethac on Thursday May 02, 2019 @12:21AM (#19804690)
These criticisms exist because Samsung does not offer first-party solutions to things such as malware detection, location sharing, storage management, caller ID, VPN, music streaming, and news aggregation. It's unclear how exactly these services are being used (Samsung should be more clear on this front) and what parts of it are integrated (Samsung should be more clear here as well).

But, well, put it this way. If Google or Apple had offered first-party solutions to each of those services, would they be criticized for offering bloatware as well? No, probably not. So, is the issue here that the services aren't first-party (Spotify) or that they aren't from traditionally trustworthy sources (McAfee)? If it's the former, why does it matter? If it's the latter, then Samsung should be more clear about the extent of the influence of the other company, which they are not, but that shouldn't necessarily exclude them from collaborating.

Now, there are some key issues that should be criticized. Hard. A persistent notification? It's unforgivable. Facebook? The amount of tracking they can do makes them a threat to the device. It's basically spyware. It can be disabled, sure, but it shouldn't be enabled in the first place (except to enable Gear VR, I guess).

But really, can you trust any major tech company, considering programs like PRISM exist and are in operation? What differentiates Google from Apple when the device is still able to transmit whatever it wants to whoever it wants however it wants? Apple or Google may or may not be tracking some piece of data, but that doesn't necessarily mean that it isn't being collected and tracked by someone. That the companies themselves don't happen to store the data that happens to be the very thing they make their money protecting and using? It's definitely better in that your data isn't being used for the company's profit, but is it really any better for privacy from, say, the government?

Re:Remote Code Execution on Most Dell Computers by wtracy on Thursday May 02, 2019 @12:45AM (#19804818)
> If Google or Apple had offered first-party solutions to each of those services, would they be criticized for offering bloatware as well?

The tech community seems to assume that software from Apple and Google will be well-thought-out and useful, and will be easy to dismiss if the user doesn't want it. The community seems to assume the opposite of anything from any other hardware company.

Honestly, those assumptions seem correct about 80% of the time.

Re:Remote Code Execution on Most Dell Computers by DoofusOfDeath on Wednesday May 01, 2019 @10:11PM (#19803925)
Thanks for the warning. My Galaxy Note 4 is getting long in the tooth, and I've been considering moving to a new[ish] Galaxy. Now I'm not.
Re:Remote Code Execution on Most Dell Computers by LeoPanthera on Wednesday May 01, 2019 @07:38PM (#19802797)
That's astounding

ly bad

Re:Remote Code Execution on Most Dell Computers by koala_man on Wednesday May 01, 2019 @07:29PM (#19802730)
>Verizon had locked them down so that they all opened the Verizon ringtone store

I had a similar issue with a phone I bought around 2005. I wanted an unlocked device, and by EU law, a carrier can't refuse to sell you that. So just pop into any store, right?

The device was unlocked but carrier branded, so the useless menu locked in place front-and-center was doubly useless because none of the carrier services worked.

I made sure to never get any phone through any carrier after that, and now that Android phones are having the same problem I'm so glad I did. Mine have always been crap free.

Re:Remote Code Execution on Most Dell Computers by cryptonector on Wednesday May 01, 2019 @06:13PM (#19802193)
Exactly. Doing better by your customers is a differentiator. It's worked very well for Apple. Microsoft could easily take a consumer-friendly stance on OEMs preinstalling software. Microsoft please!
Re:Remote Code Execution on Most Dell Computers by mroche on Wednesday May 01, 2019 @07:18PM (#19802650)
Microsoft themselves would have to practice that before they can preach it. All the start menu apps they try and force on users...
Re:Remote Code Execution on Most Dell Computers by cryptonector on Wednesday May 01, 2019 @07:43PM (#19802836)
Microsoft is changing lately.
Re:Remote Code Execution on Most Dell Computers by saagarjha on Wednesday May 01, 2019 @10:46PM (#19804134)
The Candy Crush in my fresh Windows install (using media downloaded straight from microsoft.com) suggests otherwise.
Re:Remote Code Execution on Most Dell Computers by rohit2412 on Wednesday May 01, 2019 @06:14PM (#19802200)
> often had hardware features locked out by software so that you could pay extra to unlock them.

Funny, apple did this to iPod touch

Re:Remote Code Execution on Most Dell Computers by dontbenebby on Wednesday May 01, 2019 @06:24PM (#19802278)
>Funny, apple did this to iPod touch

What feature did you pay to unlock on iPod touch? I'm struggling to remember...

Re:Remote Code Execution on Most Dell Computers by rohit2412 on Wednesday May 01, 2019 @10:52PM (#19804175)
https://www.intego.com/mac-security-blog/iphone-20-and-ipod-...

The first iPod touch had a broadcom chip that supported Bluetooth, but wasn't supported in the software stack. You needed to upgrade to use the Bluetooth hardware that you had already paid for.

Re:Remote Code Execution on Most Dell Computers by beamatronic on Thursday May 02, 2019 @12:57AM (#19804876)
For that matter, all iPhones contain an FM radio that you can’t use either. Even if you want to pay.
Re:Remote Code Execution on Most Dell Computers by mjcohen on Thursday May 02, 2019 @03:39PM (#19811858)
That's wrong in two ways. First, many Android phones, including my Galaxy S7, can use the FM radio via the NextRadio app. Second, iPhones do not have an FM radio.
Re:Remote Code Execution on Most Dell Computers by beamatronic on Thursday May 02, 2019 @06:28PM (#19813580)
Re:Remote Code Execution on Most Dell Computers by sleepychu on Wednesday May 01, 2019 @06:48PM (#19802445)
Apps, initial few software updates were paid. Version 1 didn't have the app store, they pushed web apps initially
Re:Remote Code Execution on Most Dell Computers by coin on Wednesday May 01, 2019 @07:58PM (#19802981)
They charged for OS upgrades to be compliant with I believed the Sarbanes-Oxley Act. As providing free upgrades would amount to pre booking revenue.
Re:Remote Code Execution on Most Dell Computers by Wowfunhappy on Wednesday May 01, 2019 @07:23PM (#19802683)
That's paying for a software update. I can understand why you're conflating the two, but I don't think it's correct to do so.

By making updates paid, Apple was charging users for work that had been done on the software side after the user made their initial purchase.

Re:Remote Code Execution on Most Dell Computers by Flockster on Wednesday May 01, 2019 @06:27PM (#19802302)
Yes, I can remember the update to iPhone OS 2.0 was a paid update for the iPod Touch 1Gen.
Re:Remote Code Execution on Most Dell Computers by DEADBEEFC0FFEE on Wednesday May 01, 2019 @06:17PM (#19802232)
Yep. FM Radio was a common feature back in the day.
Re:Remote Code Execution on Most Dell Computers by mises on Wednesday May 01, 2019 @07:06PM (#19802568)
My S7 can still do it. The reason newer phones can't is because they lack an aux jack: the wire is used as an antenna. Another great reason to keep the headphone jack.
Re:Remote Code Execution on Most Dell Computers by maxerickson on Wednesday May 01, 2019 @10:17PM (#19803973)
I don't know the current situation, but in the past most US carrier-sold phones have not had the antenna pin connected on the chip.
Re:Remote Code Execution on Most Dell Computers by mises on Wednesday May 01, 2019 @10:52PM (#19804174)
I'm not sure exactly what it is, though I know all the S7s do. I suppose it may be carrier-locked? I bought mine unlocked, not via a carrier. It's a handy feature, though. Free music and entertainment with zero data spent. I've got to wonder why people moved away from it. No signal issues either.
Re:Remote Code Execution on Most Dell Computers by wtracy on Thursday May 02, 2019 @12:52AM (#19804847)
> Free music and entertainment with zero data spent.

<conspiracytheory>That's probably why the phone manufactures were asked by Google and the carriers to remove that feature.</conspiracytheory>

Re:Remote Code Execution on Most Dell Computers by esalman on Thursday May 02, 2019 @03:16AM (#19805534)
I bought a Nokia 6.1 phone and was pleasantly surprised to discover FM radio on it.
Re:Remote Code Execution on Most Dell Computers by abacadaba on Thursday May 02, 2019 @11:20PM (#19815240)
Still is, on moto's at least not sure about other.
Re:Remote Code Execution on Most Dell Computers by pjmlp on Thursday May 02, 2019 @02:48AM (#19805394)
All my Android and WP phones are perfectly able to do it.
Re:Remote Code Execution on Most Dell Computers by nv-vn on Wednesday May 01, 2019 @08:12PM (#19803093)
Yep. Only Android phones worth buying are Google/OnePlus because they don't pull that crap.
Re:Remote Code Execution on Most Dell Computers by berbec on Wednesday May 01, 2019 @08:26PM (#19803209)
While I love oneplus, and a 5T will be my next phone, ther are not completely clean.

https://news.ycombinator.com/item?id=16240485

Re:Remote Code Execution on Most Dell Computers by jpking on Thursday May 02, 2019 @06:09AM (#19806302)
The thing which worries me about OnePlus and similar cheaper options is the security patches. They seem to be very slow/non-existent and the devices aren't supported for very long.
Re:Remote Code Execution on Most Dell Computers by pjmlp on Thursday May 02, 2019 @02:47AM (#19805387)
So the bundled FB app on iPhone is a trick my mind is playing on me?
Re:Remote Code Execution on Most Dell Computers by jpking on Thursday May 02, 2019 @06:07AM (#19806287)
>> bundled

My iPhone bought direct from Apple didn't have anything like that. Nor did my friends who buy on contract with carriers (UK).

What carrier did you buy from and did you restore from a backup/iCloud?

Re:Remote Code Execution on Most Dell Computers by pjmlp on Thursday May 02, 2019 @06:48AM (#19806487)
Company provided iPhone SE with Vodafone support contract.

Backup/iCloud access are forbiden as per company IT securiy data management rules.

Re:Remote Code Execution on Most Dell Computers by LeoPanthera on Thursday May 02, 2019 @02:12PM (#19810794)
...I mean, it might be, because iPhones don't come bundled with the Facebook app.
Re:Remote Code Execution on Most Dell Computers by pjmlp on Thursday May 02, 2019 @02:35PM (#19811057)
The ones provided by Vodafone on my previous company contract sure do.
Re:Remote Code Execution on Most Dell Computers by jrochkind1 on Wednesday May 01, 2019 @10:00PM (#19803862)
There were smartphones before the iPhone?
Re:Remote Code Execution on Most Dell Computers by wtracy on Thursday May 02, 2019 @12:57AM (#19804874)
Windows Mobile, Symbian, and Maemo all predate the iPhone.
Re:Remote Code Execution on Most Dell Computers by pjmlp on Thursday May 02, 2019 @02:49AM (#19805397)
Windows Mobile, Symbian, Maemo, Blackberry and J2ME.
Re:Remote Code Execution on Most Dell Computers by saagarjha on Wednesday May 01, 2019 @10:46PM (#19804136)
Blackberry?
Re:Remote Code Execution on Most Dell Computers by throw_away on Wednesday May 01, 2019 @06:12PM (#19802189)
Second product for this mythical OEM should just be a TV with an instant-on button and as many hdmi ports that will fit given a small-as-possible bezel. One model per year per common size->one price. Big sale on thanksgiving and then the slightly better ones come out.
Re:Remote Code Execution on Most Dell Computers by kbenson on Wednesday May 01, 2019 @06:30PM (#19802328)
> a TV with an instant-on button

Please. I use a 4k TV as my computer monitor. It's works fairly well for that because I researched it and found a good fit, but I use a remote to start it every time, and it takes 15-20 seconds before it's ready to receive input. That's a long time to be sitting in front of your computer waiting, especially when it happens 3-10 times a day.

Re:Remote Code Execution on Most Dell Computers by WrtCdEvrydy on Wednesday May 01, 2019 @08:05PM (#19803033)
It's because TVs have become computers with a display.

Try an analog TV and you'll see real speed!

Re:Remote Code Execution on Most Dell Computers by lopmotr on Wednesday May 01, 2019 @06:47PM (#19802433)
I avoid those problems by never turning my TV or monitor off. It does mean they light up the room at night so it wouldn't work if you had it in a bedroom.
Re:Remote Code Execution on Most Dell Computers by dgzl on Wednesday May 01, 2019 @06:57PM (#19802505)
Seems like a huge waste of electricity.
Re:Remote Code Execution on Most Dell Computers by ufo on Wednesday May 01, 2019 @07:17PM (#19802646)
I've heard that these exist,but are marked as “lcd pannels”, meant for displaying information in public places.
Re:Remote Code Execution on Most Dell Computers by swsieber on Wednesday May 01, 2019 @05:28PM (#19801797)
Really, I thought it was

  OEM: Let's make more money.
  OEM: We can sell out our users while claiming we aren't.
Re:Remote Code Execution on Most Dell Computers by p_b_r on Wednesday May 01, 2019 @10:49PM (#19804161)
Gates killed that idea dead, back in the 80's.

EDS - Remember that big huge company H.Ross Perot Ran? - We TRIED to buy PCs from hardware vendors without Windows. They refused due to how Bill locked them into contracts. If it was to run Windows, then Windows was shipped with every single hardware sale. On the bill of lading.

Government doesn't pay for stuff they don't use. Didn't want Windows if they were to run UNIX (Santa Cruz Operations XENIX System 5, to be precise). Wonder why some people at SCO went crazy and snorted their futures? Blame Bill.

Re:Remote Code Execution on Most Dell Computers by PascLeRasc on Thursday May 02, 2019 @12:01AM (#19804581)
I was just setting up a slightly older System76 desktop this evening when I came across how they handle firmware updates [1]. That's very impressive to me, showing concern about only using blobs when there's no other option, being transparent about signing, and explaining their QA process, not to mention the whole utility being open-sourced. That's worlds ahead of any other OEM PC manufacturer I've ever seen.

[1] https://github.com/system76/firmware-update

Re:Remote Code Execution on Most Dell Computers by carboy on Thursday May 02, 2019 @03:48AM (#19805672)
OEM: how can we make money on a commodity platform, when someone else controls most of the design parameters and they are dictated to us, and margins are razor thin, because most people who buy PC’s want to spend the least amount of money.

OEM Sales: we have companies lining up to bundle software on our computers and they are all willing to big money to be bundled, and even more money to be bundled and not be removable.

OEM: yay, we can be profitable!!!!!

Not one person really thinks the bundled software is of any value, other than the cash the bundling fee generates. If it was illegal for OEM’s to bundle software you’d see even more contraction in the PC OEM market.

Re:Remote Code Execution on Most Dell Computers by tssva on Wednesday May 01, 2019 @03:54PM (#19800965)
The author chose to download the software from the OEM and the software can be uninstalled.
Re:Remote Code Execution on Most Dell Computers by useerup on Wednesday May 01, 2019 @04:59PM (#19801584)
> The author chose to download the software from the OEM and the software can be uninstalled.

I take issue with that. Apx. one year ago it was using excessive CPU on my Dell. I tried to uninstall, but the uninstaller crashed.

I turned to dell.com and then google. Turned out that throusands of people had the same problem, but no solution from Dell.

This is a sorry PoS application. In my experience, OEMs like Dell, HP create horrible software and drivers.

https://www.google.com/search?q=can%27t+uninstall+dell+suppo...

Re:Remote Code Execution on Most Dell Computers by naikrovek on Wednesday May 01, 2019 @09:30PM (#19803670)
The blog post isn't about your experience, it's about the blog post author's experience.

Do try to stay on target when communicating with people. It is impolite to suddenly change a topic of discussion to yourself.

Re:Remote Code Execution on Most Dell Computers by mwexler on Wednesday May 01, 2019 @04:11PM (#19801136)
Dell SupportAssistant was preinstalled on my machine. It was the easiest way to find Dell's customized driver updates since they are difficult to find (which of the many network drivers does my machine need?). It's sad that it has problems, but it's supposed to make maintenance easier. HP has something similar.
Re:Remote Code Execution on Most Dell Computers by DKnoll on Wednesday May 01, 2019 @04:26PM (#19801274)
You only have that issue if you search by the model of your PC. For Dell, search by the service tag (short string of letters and numbers) and you will get the drivers for only the hardware that PC shipped with. For HP enter the serial number.
Re:Remote Code Execution on Most Dell Computers by DEADBEEFC0FFEE on Wednesday May 01, 2019 @06:21PM (#19802257)
Not withstanding the vulnerability outlined by the article, the concept and utility has merit. For vast amount of users, sorting out chipset drivers is a hard problem.
Re:Remote Code Execution on Most Dell Computers by tssva on Wednesday May 01, 2019 @04:30PM (#19801302)
It may come preinstalled but in this case the author wiped the computer, reinstalled Windows and then voluntarily installed the software while visiting the Dell support site checking for updated drivers. It is also able to be uninstalled which the original comment suggested it could not be.
Re:Remote Code Execution on Most Dell Computers by cryptonector on Wednesday May 01, 2019 @05:17PM (#19801724)
Because the author was doing research? Come on.
Re:Remote Code Execution on Most Dell Computers by tssva on Thursday May 02, 2019 @12:54PM (#19809907)
According to the article the author wasn't doing research when first downloading and installing the application.
Re:Remote Code Execution on Most Dell Computers by BillDemirkapi on Wednesday May 01, 2019 @10:50PM (#19804170)
Dell SupportAssist comes pre-installed on most new Dell machines. The only reason it wasn't installed on my machine is because the drive I used was not prepared by Dell. Your average Dell user will have SupportAssist installed though you are right that it can be uninstalled.
Re:Remote Code Execution on Most Dell Computers by gerardnll on Wednesday May 01, 2019 @05:17PM (#19801722)
"The agent wasn’t installed on my computer because it was a fresh Windows installation, but I decided to install it to investigate further."
Re:Remote Code Execution on Most Dell Computers by cryptonector on Wednesday May 01, 2019 @04:01PM (#19801035)
My impression was that a normal user wouldn't know not to take the offer, but fair point.
Re:Remote Code Execution on Most Dell Computers by dontbenebby on Wednesday May 01, 2019 @09:59PM (#19803860)
>The author chose to download the software from the OEM

Is a user expecting to be able to trust their manufacturer an unreasonable?

Re:Remote Code Execution on Most Dell Computers by zanny on Wednesday May 01, 2019 @05:14PM (#19801700)
In both the phone and PC space I do not understand the need to do this at all. There is commoditization of the market on the low end, but high end products that compete with iphones and macbooks are definitely not commodity and there is ample differentiation to be had on quality where mindshare can reap substantial margins on a smart investment of good design.
Re:Remote Code Execution on Most Dell Computers by naikrovek on Wednesday May 01, 2019 @09:33PM (#19803697)
There is no need for this stuff, of course. It's added because marketing want to improve the company's image in the eye of Joe/Jane Consumer, and probably someone in a support organization was honestly trying to make a customer's life easier. It was just implemented poorly.

The day that hardware vendors get over the idea that they need to "add value" to software that they resell will be a very good day for everyone.

Re:Remote Code Execution on Most Dell Computers by cryptonector on Thursday May 02, 2019 @11:32AM (#19808945)
Hear hear!
Re:Remote Code Execution on Most Dell Computers by flattone on Wednesday May 01, 2019 @05:32PM (#19801832)
do not understand the not understanding that businesses seem to exist to monetize every possible aspect of their existence.
Re:Remote Code Execution on Most Dell Computers by cryptonector on Thursday May 02, 2019 @11:43AM (#19809103)
Any business (individual persons too!) has at least some conflicting goals and trade-offs to make. E.g., profit now, or profit later? The one in this thread is exactly that sort of trade-off: monetize consumer data vs. optimize for reputation.

It's not like reputation has no value. Reputation is an intangible. You'll be able to put a fairly accurate dollar value on reputation after ruining it, but you should be able to estimate it before trying to ruin it.

Problem is, intangibles have an out-of-sight, out-of-mind effect going on: because you don't see them when putting a dollar value on tangible things, you tend to ignore the intangibles.

Companies often find this out the hard way and end up taking tremendous PR damage. Remember United's PR damage when they had to have cops drag a passenger off the plane because they wanted to "bump" him? Yeah. That sort of thing. Or perhaps the 737-MAX saga. Or any number of such events.

Re:Remote Code Execution on Most Dell Computers by cheerlessbog on Wednesday May 01, 2019 @03:54PM (#19800969)
Plus, once it's gotten on the machine, why bother to patch it? You've achieved your goal and it was most likely written to spec by a vendor who has already been paid and moved on.
Re:Remote Code Execution on Most Dell Computers by baby on Wednesday May 01, 2019 @08:08PM (#19803061)
Can someone repost this with normal quotes? On my phone
Re:Remote Code Execution on Most Dell Computers by cryptonector on Wednesday May 01, 2019 @10:38PM (#19804082)
I wrapped it short so it would work on mobile. I guess it didn't.
Re:Remote Code Execution on Most Dell Computers by mro_master on Wednesday May 01, 2019 @03:16PM (#19800626)
You forgot the last part:

OEM: Profit

Re:Remote Code Execution on Most Dell Computers by agumonkey on Wednesday May 01, 2019 @03:27PM (#19800723)
it's almost a psychology experiment where brands con you just enough and let you absorb the pain long enough that they forgot and start browsing for a new machine, repeating the cycle
Re:Remote Code Execution on Most Dell Computers by mro_master on Wednesday May 01, 2019 @06:58PM (#19802516)
But then the engineer in you says "I'll objectively choose the best hardware", and you end up with another lenovo. I really think it is the Windows Wizard Warriors that complain about bloatware, I always wipe it and start with a fresh install.
Re:Remote Code Execution on Most Dell Computers by bayareanative on Wednesday May 01, 2019 @11:18PM (#19804328)
I don't use Windows, but Lenovos ship without any bloatware. Vanilla Windows plus their drivers. That's it.
Re:Remote Code Execution on Most Dell Computers by agumonkey on Thursday May 02, 2019 @03:28AM (#19805586)
They used to have malware/rootkits class programs preinstalled not long ago. Unless you mean thinkpads.
Re:Remote Code Execution on Most Dell Computers by cryptonector on Wednesday May 01, 2019 @03:42PM (#19800855)
That doesn't happen in the first case. The second case costs less in terms of engineering and PR/reputation, so there's more profit there.
Re:Remote Code Execution on Most Dell Computers by hammock on Wednesday May 01, 2019 @03:57PM (#19800997)
Tell that to Pixel.
Re:Remote Code Execution on Most Dell Computers by raehik on Thursday May 02, 2019 @03:43AM (#19805644)
Somehow I found this the other day when searching for a new laptop. 2 models, identical, one with Windows 10 pre-installed and one FreeDOS (of all OSes!). 100€ cheaper. Perhaps not to everyone, but that's a worthwhile difference to me as a non-Windows user.
Re:Remote Code Execution on Most Dell Computers by sonnyblarney on Wednesday May 01, 2019 @05:28PM (#19801800)
It's odd how powerful MS is in this equation, and how the don't step in and add some sanity.

It's possible to have pre-loaded software without ruining everything.

Re:Remote Code Execution on Most Dell Computers by cryptonector on Wednesday May 01, 2019 @06:11PM (#19802188)
Right? MSFT could easily put an end to this nonsense.
Re:Remote Code Execution on Most Dell Computers by sonnyblarney on Wednesday May 01, 2019 @07:28PM (#19802714)
The reason they don't apparently is that this supply chain is their bread and butter, and they don't want to mess with it.

But - I feel this is causing them harm in the long run.

I feel that there is a mostly win-win were they to step in and just try to move against the bad shenanigans. I feel that even big companies like Dell, Sony etc. shoot themselves in the foot with this stupidity.

I'm mac 10x years now, strongly looking for change, but I'm wary of that kind of Windows stupidity.

Re:Remote Code Execution on Most Dell Computers by pjmlp on Thursday May 02, 2019 @02:48AM (#19805390)
Sadly this is something as old as computing and I doubt it will ever change.
Re:Remote Code Execution on Most Dell Computers by jtdev on Wednesday May 01, 2019 @06:18PM (#19802236)
One of the many reasons I stopped buying Windows PCs and started buying Mac...
Re:Remote Code Execution on Most Dell Computers by JoeAltmaier on Wednesday May 01, 2019 @05:42PM (#19801918)
Dell sells to Enterprise A LOT. This sounds like a tool intended for behind-corporate-firewall deployment that got promoted to the public.
Re:Remote Code Execution on Most Dell Computers by owenmarshall on Wednesday May 01, 2019 @08:26PM (#19803213)
Enterprises will absolutely want nothing to do with this; they’ll have a team that handles endpoint provisioning and management from a gold image & other distribution tools. The endpoints will be as homogeneous as humanly possible because they are all leased in huge bulk orders, so you won’t need a tool for diverse drivers.

Besides, an end user will never have enough permission to download and install a driver - because if they did they’d be in a position to defeat the DLP, VPN posturing, shitty antivirus and disk encryption tools that have to be installed to satisfy the four nearly identical checklists produced by at least as many independent IT security organizations who most likely hired the same auditor multiple times.

Small to mid sized businesses would probably be all over this though.

Re:Remote Code Execution on Most Dell Computers by natmaka on Wednesday May 01, 2019 @08:57PM (#19803433)
AFAIK a fair fraction of mid-and-large enterprises use the Intel Management Engine, which seems to be considerably more dangerous than this.

It is "an autonomous subsystem ((...)) incorporated in virtually all of Intel's processor chipsets since 2008. ((One)) can use it to turn the computer on and off, and they can login remotely into the computer regardless of whether or not an operating system is installed. ((It)) always runs as long as the motherboard is receiving power, even when the computer is turned off."

According to the EFF it "has full access to memory (without the parent CPU having any knowledge); has full access to the TCP/IP stack and can send and receive network packets independently of the operating system, thus bypassing its firewall".

https://en.wikipedia.org/wiki/Intel_Management_Engine

Re:Remote Code Execution on Most Dell Computers by owenmarshall on Wednesday May 01, 2019 @10:04PM (#19803886)
I regret if my comment was misconstrued - I'm not claiming enterprises wouldn't use this specific tool because it is dangerous. I'm claiming they wouldn't use this specific tool because it does not fit within the "how do I manage tens of thousands of endpoints while meeting multiple defined and audited security and compliance goals" box.

You might even say that quality and security are orthogonal, at least in this particular case. That might not even be wrong.

Re:Remote Code Execution on Most Dell Computers by natmaka on Thursday May 02, 2019 @09:02AM (#19807409)
I understand and agree, thank you!
Re:Remote Code Execution on Most Dell Computers by danielhlockard on Wednesday May 01, 2019 @05:49PM (#19801979)
No, this is a tool for consumers too, has been for a LONG LONG time
Re:Remote Code Execution on Most Dell Computers by killjoywashere on Wednesday May 01, 2019 @05:50PM (#19801996)
yep, I remember this at least as far back as 2003.
Re:Remote Code Execution on Most Dell Computers by killjoywashere on Wednesday May 01, 2019 @05:50PM (#19801993)
If I were corporate IT, I would insist on rolling my own disk image starting from a "gold master" direct from Microsoft.
Re:Remote Code Execution on Most Dell Computers by triangleman on Wednesday May 01, 2019 @08:22PM (#19803175)
No, they have other tools for enterprise, or in some IT departments buy third party tools off the shelf for this purpose.