I firmly believe that permanent key fusing to lock bootloaders should be outlawed. At the very least the keys (and schematics) should be released once the device reaches EOL.

Otherwise we're just manufacturing e-waste.

Agreed. We really need some sort of regulation that prevents companies from bricking devices they sold. It's just so unethical, and wasteful, to put these devices out there and then just turn them into trash.

Or just stop this nonsense of needing updates to keep things working, which then allows updates that break things.

Have proper standards how music is transmitted. Have devices support those standards. Have those standards be long-running.

Any connected device NEEDS continual updates in order to continue to be secure.

This is particularly true of internet connected devices, but is also true for IOT devices that only connect to the internet indirectly. Security holes get found, if you can't patch and update devices in the field then you are leaving your customers unprotected.

> Any connected device NEEDS continual updates in order to continue to be secure.

And I feel that updates are being abused too much by device makers now:

-allows making devices worse, say "optimizing" the UI e.g. to make you spend more time in the parts they (not necessarily the user) want you to see

-allows releasing half-finished games since they can just be updated later anyway

-allows breaking old functionality for whatever reason

-allows the device makers to choose when to do the update rather than the user, say just when you want to start playing a game

It's a shame there's no less invasive way to ensure devices are secure. It sure is convenient for the device makers that the solution to security also gives them continuous control over your device's features and when you can actually use it

There is security and there is cargo cult. "unprotected" really depends on what the user is using the device for, what the vulnerabilities are, and what's the worst thing someone with total root level access to the device can actually do.

If the device is using a read-only firmware, has a secure boot chain of trust, lives behind a firewall and only makes outgoing connections, the risk is very limited. You can't directly connect to it, so your only option is to tamper with traffic in transit and exploit some buffer overflow in how it parses replies to its requests - that's already a very targeted attack that's really hard to scale, and with an intact secure/trusted boot chain it still means you can't persist so you'd need to redo this every time the device is rebooted.

And finally, assuming you manage to do all the above, what't the payoff? For a "Car Thing", the payoff is quite limited. I guess you can blast obnoxious music at full volume against the user's wishes?

It's not just security, but simple functionality too. Connected devices rely on remote services, by definition. Those services' APIs will change and get deprecated over time. At the very least, you need to keep clients up-to-date to conform to those API changes.

I would argue that connected devices should only rely on your services - otherwise how do you know that they're not going away?

And if they're your services then you can maintain their stability.

"Your services" aren't entirely yours. Practically speaking, no one builds systems entirely from scratch. A service likely has remote dependencies too, some of which will trickle down to the clients of your service. For Spotify specifically, they rely on SSO providers and third-party payments services; if those APIs change, then the client will likely require updates even though Spotify didn't change anything in their own core functionality.

I have never updated my ethernet switches. Ever.

Doesn't sound like its an update that bricks them, thought the article is a bit confusing on that point. Sounds to me like they broke the API (or just blocked this particular User-Agent)

Situation: there are now 15 competing music streaming standards.

EU legislation on power chords gave us micro-USB phones, when USB-C could have been a better option, but a real solution would be let consumers decide inputs/outputs.

Micro-USB was legislated years ago when each phone had a different charger plug. Currently the standard is USB-C. I also suspect that the EU only mandates a charging & plug standard but it's up to the industry to choose one.

> EU legislation on power chords

Regular major and minor chords were unaffected though :)

(I actually started reading this comment as a pun, as in "The EU can regulate music streaming - they already regulated power chords", and that made me smile)

I thought the same thing and was going to reply before I saw your comment. I wonder if there’s a term for typos/mis-spellings that form an unintended word or phrase that still makes sense for that particular context.

https://en.wikipedia.org/wiki/Power_chord

Whatever it is, it needs to be a pun on "oak trees", because they're _eggcorns_ that grew up.

The EU legislation will require USB-C, not micro USB

> but a real solution would be let consumers decide inputs/outputs.

When trillion-dollar companies consider a serial connector to be a proprietary and DRM-enabled apparatus I think the "real solution" is precluded by entirely unnecessary corporate greed.

A regulation requiring companies to "let consumers decide inputs/outputs" would be much more burdensome than merely standardizing one specific connector per ~decade. With the compactness of modern devices, they'd basically have to spin a new board for every connector type a consumer might what. But you're right - it would be kind of neat if I could have Google make me a new Pixel 8 with the bespoke data connector from my old SPH-A580, so I'd finally once again have a use for that cable that's just sitting around in a box. This is what you meant, right?

Yup, or alternately mandate a standard and incorporate the charging port into an open-source case, or some such.

This is a fascinating misunderstanding of history. Were you not around when phones all had unique, non USB charging cables? It was a nightmare trying to charge a phone or device if you forgot your charger.

FM and AM were only 2 and were long running

Realistically how many people are going to bother reflashing their devices? This case is exceptional because it was EOLed so early, but for the typical phone that reaches EOL in 2 years I doubt more than 1% of people are going to make use of this ability.

It's a chicken and egg problem. There isn't much firmware being developed for these devices because there is no easy path for users to install them.

If installing alternative/third-party firmware becomes easy and normalized, there will also be more options to choose from, because it will actually become worthwhile for people/companies to develop said firmware.

People? Not that many. Companies? quite a few.

If you have an easy way to flash any phone and plenty of firmware available, it makes sense to turn flashing into a business. Buy used phones off people who don't need them any more, reflash them with a newer and debloated Android, and then sell them off for more than you got them for.

This would very quickly lead to abuses though. If PC OEMs are bad, imagine what a small mom-and-pop shop, subject to a lot less scrutiny and having much less respect for the law could do.

I think if the process was made easy, it would save quite a bit more than 1% of these devices from the landfill, assuming you have enough power users to build a community. Plenty of people flash their chromebooks to MrChromebox UEFI to give them a new life, because it's easy enough for mere mortals, and because Google doesn't lock them down.

I believe if given the tools, people would gladly donate their time to make something fun with it. Heck, that's what I do in my spare time. But it's impossible if everything is completely locked down, as if a music streaming box contains nuclear launch codes that must be protected at all costs.

You are saying you can reduce e waste by whole integer percent with a simple bit of legislation? That's a clear win.

>You are saying you can reduce e waste by whole integer percent with a simple bit of legislation?

Well no, because not all e-waste are devices that you can conceivably reflash. For instance a monitor equals at least 10 phones in terms of e-waste volume, but I doubt legislation like this is going to make a dent in monitor e-waste. The proposal only realistically makes a difference for computing devices with short EOL periods and locked bootloaders, so basically phones and tablets.

It should be required from day one. This tying of specific user-environment software to hardware is a straightforward antitrust issue, and frankly should never have been allowed to fester as long as it has.

The industry should be made to move to security models that don't revolve around baking in manufacturer-privileged keys (verification or attestation). Internal groups developing any default user-environment software should have to stay at an arms length from the hardware team, and only be using published documentation.

I was suspicious when they advertised on sale for $30 last year. Maybe Lina Khan will peruse the emails that lead to that clearance.

Though it's no surprise Spotify failed at hardware given their general software competency. Broke the Chromecast app for years after the big mobile redesign. Not sure how it's possible to have such bugs in an app that shows three buttons, a progress bar, and a picture, but 2,000 engineers will find a way. Liked page on the phone app doesn't even load with bad service, which is like your umbrella not opening in the rain.

Anyone know of alternatives, even alternative clients?

This largely feels like a failure of consumer protection. Perhaps my understanding of the legal situation is wrong but as a UK resident - regardless of additional warranties provided or not provided by the vendor - products should work for a "reasonable" length of time and you are entitled to replacement or refund if they fail.

Obviously I would expect an electronic device like this to last more than 2 years, so if Spotify is going to cause it to stop working then they'd have to refund me. Having to do that for their entire customer base would probably result in some different decision making!

Obviously this product was only sold in the US (AFAIK), which has much less in the way of consumer protection, which allows for this crappy treatment of consumers.

Incidentally, I just installed Navidrome on my Alpine Linux server for test, and it's currently scanning all my local music library. The heck if I'm going to depend to any proprietary device/format that is going to become a brick, then e-waste, as soon as the company behind it makes it obsolete. Happened a million times and will happen again.

https://www.navidrome.org/

Yes, I would totally push for legislation forcing manufacturers to unlock bootloaders and release tech info when they stop selling devices, so that hardware can be repurposed; landfills are already full of perfectly functioning stuff that could be put again in operation if manufacturers weren't so stubbornly hostile to anything Open Source.

Are you going to hook speakers up to your server? I'm planning my Google Home replacement strategy for if/when they add a subscription like Alexa. I want an offline whole home sound system with independent room controls, seems like Navidrome might work...

No need to use the server, Navidrome allows any client to connect remotely (WAN included) and play music that is hosted on the server. It also can be set up to transcode on the fly uncompressed music when it is accessed from a metered connection to minimize bandwidth usage. I barely scratched its surface, but it looks promising. The only requirement is that it needs the correct metadata to identify songs and download the correct lyrics, album images etc. There's a software called Musicbrainz Picard however that can be used to identify songs with incomplete or missing id3 tags data and it works using audio fingerprinting against a remote database so it should be accurate.

https://picard.musicbrainz.org/

Back to your post, if you need to play music from the server, take a look at the mpd daemon and its remote interfaces. It does the opposite as it plays from the server while the clients would be used as remote controls so that you can for example install mpd on a small single board computer (or more scattered around the house), configure them to access local or remote mount point, then grab your phone and tell the server to play the desired song.

https://www.musicpd.org/

Spotify stopped making Car Thing around July 2022 [0] But the device has also been jailbroken for a couple of years now [1] It even runs Debian [2]

[0] https://www.theverge.com/2022/7/27/23280357/spotify-stops-ma...

[1] https://github.com/err4o4/spotify-car-thing-reverse-engineer...

[2] https://github.com/bishopdynamics/superbird-debian-kiosk

I think at some point we’re going to have to start regulating this. You can’t just sell people some piece of hardware and then make it unuseable a few years later.

s/think/hope/g

What are the actual practical nuts and bolts problems with making bricking devices like this illegal? Someone in comments mentioned licensing contracts and things that might require them to but that seems resolvable. This seems so anti-social, anti-environment and not even benefitting them selfishly. Just a waste

I suspect it’s just a matter of it being easier to tell people to bin it than going through the hurdles of opening it (legal, drm, engineering, getting a budget, publishing instructions…) Plus doing anything at all beyond pulling the plug sounds like it will cost some amount of money (no matter how little) so someone somewhere will have to convince bean counters to allocate a budget for and capacity it.

Remind me why I shouldn't be able to put my own version of Android on this again?

You might incorrectly assume you owned the device you bought.

What I always find so disappointing in these scenarios is when companies are too chicken-shit to just give a reasonable honest explanation to requests like open sourcing this to avoid them all turning into e-waste.

It feels like adding insult to injury for everyone who put faith in the product/company.

I've been a long-time premium subscriber of Spotify, but I've already decided I will never buy a hardware device from them (even before Car Thing came out) or do something like pay annually for their services, because I don't trust their commitment to anything for more than 30 days at a time at this point.

I agree. It’s so obvious that they’re trying way too hard to _not_ be the thing that I’m paying them for (music streaming).

The honest explanation is that they lost so much money on the idea that they grimace at spending even another hour of developer time on them.

They don't care about waste, they don't care about the consumers, all decisions boil down to profit.

Unrelated but what's going on with the cookie prompt on this site. There's a bunch of cookies used for advertising that you cannot say no to. I can't imagine that this is allowed.

Well this is about as legal as bricking (aka vandalizing) a device people paid money for, but hey when you're a company breaking the law/regulations is just normal business practice.

It seemed clear they were at end of life when they started selling them for next to nothing last year.

We really need legislation to unlock devices like this when they reach EOL, the hardware here is very simple and could easily be reused.

Would be nice if they just open sourced it but that would require Spotify to allow playback control outside of their terrible, janky apps.

Not surprising, given the awkward position the product was in, targeting customers who don’t already have CarPlay or Android Auto (lower end of the market), but are also willing to pay for Spotify Premium and a good smartphone data plan (higher end of the market).

I think its less about high-end/low-end, after all carplay did not hit Toyota until around 2018. Its simply that you still need a phone to use the device, might as well connect your phone to your cars audio and use your phones screen.

But the real question is why brick it? What requires so much maintenance?

A wild guess? Maybe enhanced DRM so the audio path can't be MITM'd, and the digital audio data captured?

Not that it's an acceptable reason, but could they be paying some kind of ongoing license for a codec or some other licensed software on the thing?

DevOps, monitoring, support costs, ongoing security burden. You can’t just ship a device specific API anymore and call it done. Those services will have at least monthly security updates, plus all the shimming and API back-compact work that has to be done as the backend Spotify services change.

I understand, at the same time the api shouldn't be too different to what is used by other devices (otherwise they would be just shooting themselves in the foot)

That’s the crux of it. Someone already paying for Spotify and practically any smartphone can just buy a car mount and get pretty much the same experience. My high/low comment missed the mark. Someone in that position (without CarPlay) is more likely buy a $20 mount for their phone than a $100 one-trick pony device.

This seems like a very US-centric view or the world. If you make a decent amount of money you have to spend it on a car? Lots of people don’t care about cars and/or don’t spend a enough time in them to justify spending a lot on it.

What a weird critique. American or not, if you don't have a car you're probably not in the target market for a CarThing

I purchased mine without any intent on using it in a car, and in fact I never did, but it was clear that I was engaging in out-of-bounds behavior in doing so.

> What a weird critique. American or not, if you don't have a car you're probably not in the target market for a CarThing

It wasn't about having a car or not. It was the assumption that if you have a higher income you are automatically willing to spend a sizeable chunk on it on a car. Not all people are as obsessed with cars as the average American.

I do pretty well for myself and I can think of a thousand things I'd rather spend my money on than on a car.

The American assumption is that cars are purchased new, and are recent enough to have integrated android auto/carplay.

Or it means that the people who can afford fast phones and expensive internet are capable of buying a $300 car stereo with AA/CP capability.

My 2001 Jeep Wrangler has both

My phone plan costs $14/month and could power music indefinitely at high speeds. Notably, it's something I already have and already pay for.

$300 more for a new stereo is still a lot to many people. Plus, if I buy beater cars but put a nice stereo in them I'm at risk of theft. And I have to pay install fees again if I buy my next beater.

This just further illustrates OP's point, of how very limited this market segment must be

The buyers of this product are people who:

  - spend enough time in their car to want streaming audio

  - spend money on phone and internet 

  - have a desire to improve their car to have streaming audio

  - but not enough to replace the car

  - and also not enough to replace the stereo

  - but definitely enough to pay money to add it

  - and are willing to remove the item they are paying for every time they leave the car to prevent its attractiveness to thieves

The parent didn't say "no car" they said "cheap car". Most people can't afford to buy new cars.

I was recently looking at starter cars for my daughter as a college graduation present, and I think you'd be surprised how far down-market those features have moved.

A brand new Toyota Corolla is $22k and comes with both. For older cars, you can get a nice stereo for $300. If you aren't an audiophile, probably $100.

I drive a 20+ year old SUV, mostly just for commute. It’s too noisy to bother with a good stereo.

You can get a Bluetooth-capable stereo with hands-free microphone for around $100, and while I haven’t yet installed it, I just bought a 7” screen double-DIN stereo for under $300 that has (wired) CarPlay and Android Auto integration, plus a backup camera. It even has ports for a front camera if you want one, though you’ll have to buy it separately. That’s a huge capability upgrade for very little money, and not at a discount retailer either. I got it from Crutchfield, whose value proposition is extensive installation advice and lifetime tech support from actual experts based in the US.

> I just bought a 7” screen double-DIN stereo for under $300 that has (wired) CarPlay and Android Auto integration, plus a backup camera

$300 is more than I spend on gas each year. Not worth it.

What does the price of gasoline have to do with whether or not it's worth it. You have to spend that on gas regardless, so why not have a nice screen while you're doing that driving that you have to do anyway for?

It’s not about the price of gas, it’s to illustrate how little I use my car.

I mean, if you don't really drive it, then yeah, it's a waste. But if so, why do you even own a car? Renting is pretty cheap if you only need one occasionally.

Backup cameras aren't necessary, but they're damned handy. I thought front cameras were kind of silly until I drove a car with one, but it turns out they're very useful in the right situations.

> why do you even own a car? Renting is pretty cheap if you only need one occasionally.

Because owning a small, cheap car doesn’t cost much and is way more convenient than renting one.

For example. I use my car when I need to transport something I can’t take on my bike. I might need to pick up a package from the nearest parcel point that’s too big or too heavy to transport otherwise. This is about 500 meters from my house, just too far to walk with a heavy package (done that, not fun) but renting a car for a 2 minute trip seems a bit ridiculous.

Or I may want to buy a few crates of beer for a party. A bit inconvenient to get by bike (although possible). This is a 1 kilometer trip. Again, not worth the trouble renting a car for but not a problem if I already have a car anyway.

Or I may need to take some stuff to the recycling center. Again a short trip (2 kilometers).

You may start to see a pattern here. If I had to rent a car for those situations then it would take me more time to pick up and retrieve a rental than for the trip I need it for.

Fine, but if you own a car that you use for that level of convenience, you shouldn’t care that much about a $300 one-time expense. It’s just not that much compared to the cost of owning a car.

You may not care about the features of that sound system, and so don’t want one, but that’s a different story than “it’s too expensive”.

This is somewhat out of touch.

Even a cheap car car costs £1000's up front (or £100's/mo financed), with recurring > £100 a month in insurances, fuel, and repairs.

A spotify subscription costs £12/mo, and a family plan £20/mo.

A more than good enough data plan is £10/mo.

A more than good enough smartphone is £100.

The vast majority of older car owners can easily afford a Spotify subscription.

I guess the US has more of a culture of buying new cars but here in Ireland, basically everyone I know has some form of unlimited data and no one has a car from the last two years. Our new car sales are about 120,000/yr compared to a licensed vehicle count of 2,800,000, which implies that most cars get driven for 20 years before being retired, which from the distribution of cars I see on the road seems entirely plausible. Our registration plates have the year of first licensing printed prominently on them, and there are many 2008 cars still on the road.

In short, the top ~10% might have modern cars. The top ~90% have unlimited data or data where the limits will not be reached by playing Spotify. I could see someone going "Hmm, that's 80% of the market we could sell this too".

Spotify, another great example of the VC funded tech cancers that came to disrupt and turned out to be even worse then what came before…

We deserve this shit, because we keep buying into it

Spotify: the new Sonos

Didn’t even sonos end up walking that decision back and let people keep the devices and get the rebate rather than bricking the traded in speakers? But only after public outcry.

"If purchase isn't ownership, then stealing remotely-brickable devices isn't theft."

*cracking

Stealing devices is still theft.

When IoT means InOperable Technology! :-)

It's surprising to me that people see examples like this and somehow still think, "well, it's one bad apple. One bad decision from one company" rather than a systematic problem with incentive structures.

Capitalism, and particularly capitalism that emphasizes profit, warps incentives away from building things for people.

And we have other functioning models! Open source is about as close to anarchist theory in practice as there is, for example. "Wellbeing for all" isn't some pipe dream we could never achieve, FOSS is built on the principle of "I'll build it, use it if you like. Help me if you can."

Blaming the victim of a con is just intellectual elitism. Everyone, literally everyone is vulnerable to a con that's obvious to someone else.

Sure, tech cons are more obvious to us technical folk, but we have our own blind spots in other industries we are vulnerable to. (I cannot be as sure I I'm not being conned by construction, automotive, medical, or education industries, for example.)

Continue to hold the con artists in contempt, not their victims.

What the hell are they discontinuing? The hardware won't change. Streaming MP3 shouldn't be rocket science that requires 50 engineers.

Even if the internal API-s change, can't they just create mappings the devices need? They are not even willing to put that effort in.

So sad to see software companies treat hardware as a failed hobby project then flat out say customers to bring their devices to an e-waste dump like they do in their FAQ.

> 50 engineers

50?? Try 1600+ (from https://engineering.atspotify.com/opensource/)

I was referring to the team to maintain Car Thing :)

It should quite literally be illegal. Profit-seeking organisations simply don't care; they operate on a logic that has been compatible enough with human life for a while, but just isn't in the long term.

At first I thought it was an Onion headline, as if "Car Thing" was a real name...

Are there not already "right to repair" laws that clearly give the user of a legally purchased device that stops functioning because of a defect (even if the defect's origin is that Spotify has defectuous management) the right to repair that device?

I do not see how the right to repair does not mandate that Spotify publish any and all keys and documentation to allow the purchased devices to be repaired.

RIGHT?

[dupe]

Some more discussion: https://news.ycombinator.com/item?id=40456644

Comments moved thither. Thanks!

Friendly reminder that if a you agree to a terms of service for a hardware device you don't own it.

It's one thing for software to be a service. Hardware? No thanks. I will never, ever "buy "something still controlled by the manufacturer after I take it home, and I discourage everyone from doing so.