Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Pixel 4a's old firmware is gone, trapping users on buggy battery update

androidcentral.com

Post reply on HN
Print view View original

171–180 of 370 posts

Re: Google Pixel 4a's old firmware is gone, trapping users on buggy battery update

#171

Post by bmaupin »

NotPractical wrote: post #143
bmaupin wrote: post #102

I'm trying to figure out what the actual latest update is doing regarding the battery. I found an update to the kernel binary but it doesn't seem the source has been updated. Can I submit a GPL request to Google to get the kernel source? https://github.com/bmaupin/pixel4a-battery-research

If you're reversing this: I was curious if Google determines if your device is "affected" using the phone's serial, or the battery's serial. I've seen reports that people who replace the battery manually outside of the program still experience diminished performance. But of course that could just be because they replaced their defective battery with another defective battery.

I'm going through the kernel with Ghidra but not very good at it and not having much luck.

I do have an idea about what it's checking to determine if a battery is affected, but I don't have enough data yet to know if it's just a coincidence.

Re: Google Pixel 4a's old firmware is gone, trapping users on buggy battery update

#172

Post by encom »

sidewndr46 wrote: post #115
TonyTrapp wrote: post #65

Earlier quoted context omitted.

Stuff like this is why I keep printing entrance tickets and the like. I don't want to end up in a situation where I have to trust software that is known to have new bugs every months to get into a place without any sort of backup.

This works until you start attending events that require you to present your cell phone for entrance

What? For what purpose? I've never heard of or encountered this.

Re: Google Pixel 4a's old firmware is gone, trapping users on buggy battery update

#173

Post by chasil »

wanderingmind wrote: post #163
chasil wrote: post #104

Earlier quoted context omitted.

Unless your Pixel 4a is from Verizon (locked), keep it. Unlock the bootloader, then install LineageOS, MindTheGapps, and Magisk. Once you have Magisk stabilized, install the Advanced Charging Controller, and configure it to halt charging at 80%. That should solve your problems, and turn the updates back on. I don't think there is a way to make Google Pay work in this configuration, which is a drawback. I can put all…

Why go all through that pain when graphene OS gives you a straightforward install?

Because the 4a is on extended support, is not recommended, and cessation can happen any time now?

https://grapheneos.org/faq#supported-devices

Re: Google Pixel 4a's old firmware is gone, trapping users on buggy battery update

#174

Post by chasil »

aquasync wrote: post #164
chasil wrote: post #104

Earlier quoted context omitted.

Unless your Pixel 4a is from Verizon (locked), keep it. Unlock the bootloader, then install LineageOS, MindTheGapps, and Magisk. Once you have Magisk stabilized, install the Advanced Charging Controller, and configure it to halt charging at 80%. That should solve your problems, and turn the updates back on. I don't think there is a way to make Google Pay work in this configuration, which is a drawback. I can put all…

Thanks for the info! My pixel has already applied the update unfortunately - any ideas if switching to lineageos is still helpful in that case? They’re not offering the free battery replacement in Aus otherwise I’d do that - hard to be sure that getting a new battery in a local repair shop wouldn’t be similarly affected by the new limits (presumably some sort of blacklist on serial numbers?).

The new battery behavior is probably just some POSIX userspace process running under Linux, or perhaps some kernel tweak.

The whole of userspace will be replaced when LineageOS reformats all of the partitions.

It is possible that the new battery behavior has been injected into some deeper part of the hardware, but LineageOS is unlikely to make that worse.

Re: Google Pixel 4a's old firmware is gone, trapping users on buggy battery update

#175

Post by hysan »

coldpie wrote: post #83
hysan wrote: post #80

Earlier quoted context omitted.

It’s not an ad thing. It was an OS level accessibility feature dealing with text sizing and other reading related settings.

Sorry, I should have quoted your post. I was responding to this portion: > now I’m trying to think of what I can do to secure their devices if they’re not going to update

Gotcha. That might help somewhat but it wouldn’t solve the “never update Android or any other app” problem. I’d also have to get them used to using a new browser. It’s a larger problem that their trust in tech was easily (possibly irreversibly) broken after years of me slowly convincing them and getting them used to letting their devices update. They are even older now and having had a stint working in the senior care tech space, I know that trying to tech the older generation to use tech safely is a very high hurdle. Now that I don’t live near them, I’m not sure that’s a hurdle that can be easily overcome.

Re: Google Pixel 4a's old firmware is gone, trapping users on buggy battery update

#176

Post by hysan »

xethos wrote: post #111
hysan wrote: post #73

Earlier quoted context omitted.

I was visiting my parents for the holidays and came across this exact mindset. I usually push them to update for security, but I learned that they stopped doing that this year. Apparently some update broke/removed/changed an accessibility feature on their phone in a way that I couldn’t figure out how to revert. My mom had updated her phone first so only she was affected. My dad now refuses to update his phone and bot…

Frankly, even the scarequotes around break feel misplaced. Your Mom can't use the device like she wants to. An accessibility feature is gone to the point you can't get it back. That feels pretty broken to me.

Yeah, you’re probably right. I just wanted to write my anecdotal experience in a way that would avoid the “you’re holding it wrong” crowd because the point is how this leads to broken trust, not whatever broken feature it is.

Re: Google Pixel 4a's old firmware is gone, trapping users on buggy battery update

#178

Post by jennyholzer »

AnthonyMouse wrote: post #124
kevincox wrote: post #86

Earlier quoted context omitted.

But it isn't this simple, because you wouldn't need a single "maintaining" branch. You would need one for each feature release that the user may stop at. So if you release the feature branch every 3 months after a few years you will have a dozen maintaining branches to backport fixes to, and in which to carefully test that the fix actually works. The problem is linearly worse if you release the feature branch more of…

> So if you release the feature branch every 3 months after a few years you will have a dozen maintaining branches to backport fixes to, and in which to carefully test that the fix actually works. The problem is linearly worse if you release the feature branch more often. This has been solved by LTS releases for some time. You have a newest release branch that gets feature updates immediately and an LTS branch which…

"This has been solved" is an arrogant way to put it.

Re: Google Pixel 4a's old firmware is gone, trapping users on buggy battery update

#179

Post by ndriscoll »

deng wrote: post #165
ndriscoll wrote: post #150

Earlier quoted context omitted.

So I'm not terribly familiar with Bluetooth. Are these something that can be exploited by an unpaired device? "Google Android on a Pixel 4a is vulnerable to remote code execution by arbitrary nearby wireless devices" is certainly a better reason to not use one than "security updates have ended".

> So I'm not terribly familiar with Bluetooth. Are these something that can be exploited by an unpaired device? Who knows, someone would need to write an actual exploit for these. Just quickly skim through the Android security bulletins at https://source.android.com/docs/security/bulletin and you'll see that every month lots and lots of CVEs are fixed with at least high or even critical severity in various stacks. If…

The fact that their bulletins say that there are high and critical vulnerabilities every month is sort of my point. Is this thing actually critical? Can you only send the vulnerable commands after you have paired? [0] suggests these are used after pairing, but like I said I'm not familiar enough with BT. If that's the case though, "User interaction is not needed for exploitation" is misleading; I'm not going to pair with random devices, so I'm not concerned. I see that with other vulnerabilities too. e.g. CVE-2024-31320 from last year is "critical", and says "there is a possible way to establish a companion device association without any confirmation due to CDM. User interaction is not needed for exploitation." Except if I'm understanding correctly, you need to install a malicious app, and what it does is let that app use a bluetooth device without asking. Big whoop, that's how everything works on desktop, and it's fine.

The problem is the security industry has such a low signal:noise ratio that it makes sense to just ignore everything they say as a user. They're constantly lying and saying there are important security updates when there aren't, and that everything is high/critical severity when it isn't. In a corporate setting, you just unthinkingly update to check boxes, but as an individual, it makes no sense to do that. And with Android, you have to take possibly undesirable feature updates to get kernel or system library updates. For some products, security updates are to "secure" the device against its owner! Advisories are often lacking enough information to be able to evaluate impact, which further makes it clear that the people publishing them are to be viewed with a skeptical eye.

It should be immediately obvious whether this is exploitable by random passersby (if it actually is) without me having to go learn how bluetooth works at a protocol level. "Don't think about it and just update, install a new OS, or buy new devices" is not a useful attitude.

Things don't become end of life when they stop receiving updates. They become finished. Whether and for what purposes they continue to be useful requires ongoing judgement.

[0] https://learn.adafruit.com/introduction-to-bluetooth-low-ene...

Re: Google Pixel 4a's old firmware is gone, trapping users on buggy battery update

#180

Post by keyringlight »

Zak wrote: post #27
timerol wrote: post #23

Earlier quoted context omitted.

What makes the form factor better than others in the series? I'm curious since I've only owned a Pixel 3a and a Pixel 6a

No current phone from any manufacturer that's reasonably desirable is as small as the 4a, and few of any size have a headphone jack.

I looked into this because I find I want something I can stuff into a trouser pocket. The only reasonably viable android option was a Sony Xperia XZ2 compact, from 2018 on android 10. You can put lineage on it which is currently maintained, but that has the downsides of not passing device integrity which some apps will check, or being willing to constantly play cat and mouse to spoof it. Sony also apparently wipe a partition with a little DRM blob for the camera, which degrades some aspect of its post processing capabilities so image quality might be less. There's also the iPhone SE3 which is currently in support

I ended up getting a 'regular' sized samsung only slightly larger than the one it's replacing, but at least modern phones seem to be getting longer software support periods (assuming there's no nasty surprises included).

Post reply on HN