Spotify: the new Sonos
Didn’t even sonos end up walking that decision back and let people keep the devices and get the rebate rather than bricking the traded in speakers? But only after public outcry.
Spotify Car Thing will be discontinued
161–170 of 240 posts
Re: Spotify Car Thing will be discontinued
#162I guess Spotify has made the strategic decision not to pursue the consumer car market and instead to cede that space to Sirius. Because this absolutely poisons the well against anyone buying hardware from Spotify again.
This product was always doomed. Android Auto and CarPlay entirely negate the need for this.
Re: Spotify Car Thing will be discontinued
#163Earlier quoted context omitted.
Or just stop this nonsense of needing updates to keep things working, which then allows updates that break things. Have proper standards how music is transmitted. Have devices support those standards. Have those standards be long-running.
Any connected device NEEDS continual updates in order to continue to be secure. This is particularly true of internet connected devices, but is also true for IOT devices that only connect to the internet indirectly. Security holes get found, if you can't patch and update devices in the field then you are leaving your customers unprotected.
There is security and there is cargo cult. "unprotected" really depends on what the user is using the device for, what the vulnerabilities are, and what's the worst thing someone with total root level access to the device can actually do.
If the device is using a read-only firmware, has a secure boot chain of trust, lives behind a firewall and only makes outgoing connections, the risk is very limited. You can't directly connect to it, so your only option is to tamper with traffic in transit and exploit some buffer overflow in how it parses replies to its requests - that's already a very targeted attack that's really hard to scale, and with an intact secure/trusted boot chain it still means you can't persist so you'd need to redo this every time the device is rebooted.
And finally, assuming you manage to do all the above, what't the payoff? For a "Car Thing", the payoff is quite limited. I guess you can blast obnoxious music at full volume against the user's wishes?
Re: Spotify Car Thing will be discontinued
#164Unrelated but what's going on with the cookie prompt on this site. There's a bunch of cookies used for advertising that you cannot say no to. I can't imagine that this is allowed.
Well this is about as legal as bricking (aka vandalizing) a device people paid money for, but hey when you're a company breaking the law/regulations is just normal business practice.
Re: Spotify Car Thing will be discontinued
#165[flagged]
Re: Spotify Car Thing will be discontinued
#166I firmly believe that permanent key fusing to lock bootloaders should be outlawed. At the very least the keys (and schematics) should be released once the device reaches EOL. Otherwise we're just manufacturing e-waste.
Realistically how many people are going to bother reflashing their devices? This case is exceptional because it was EOLed so early, but for the typical phone that reaches EOL in 2 years I doubt more than 1% of people are going to make use of this ability.
People? Not that many. Companies? quite a few.
If you have an easy way to flash any phone and plenty of firmware available, it makes sense to turn flashing into a business. Buy used phones off people who don't need them any more, reflash them with a newer and debloated Android, and then sell them off for more than you got them for.
This would very quickly lead to abuses though. If PC OEMs are bad, imagine what a small mom-and-pop shop, subject to a lot less scrutiny and having much less respect for the law could do.
Re: Spotify Car Thing will be discontinued
#167I firmly believe that permanent key fusing to lock bootloaders should be outlawed. At the very least the keys (and schematics) should be released once the device reaches EOL. Otherwise we're just manufacturing e-waste.
It should be required from day one. This tying of specific user-environment software to hardware is a straightforward antitrust issue, and frankly should never have been allowed to fester as long as it has.
The industry should be made to move to security models that don't revolve around baking in manufacturer-privileged keys (verification or attestation). Internal groups developing any default user-environment software should have to stay at an arms length from the hardware team, and only be using published documentation.
Re: Spotify Car Thing will be discontinued
#168What the hell are they discontinuing? The hardware won't change. Streaming MP3 shouldn't be rocket science that requires 50 engineers. Even if the internal API-s change, can't they just create mappings the devices need? They are not even willing to put that effort in. So sad to see software companies treat hardware as a failed hobby project then flat out say customers to bring their devices to an e-waste dump like th…
> 50 engineers 50?? Try 1600+ (from https://engineering.atspotify.com/opensource/ )
I was referring to the team to maintain Car Thing :)
Re: Spotify Car Thing will be discontinued
#169At first I thought it was an Onion headline, as if "Car Thing" was a real name...
Re: Spotify Car Thing will be discontinued
#170Are there not already "right to repair" laws that clearly give the user of a legally purchased device that stops functioning because of a defect (even if the defect's origin is that Spotify has defectuous management) the right to repair that device?
I do not see how the right to repair does not mandate that Spotify publish any and all keys and documentation to allow the purchased devices to be repaired.
RIGHT?