C
Commander Kinsey
Guest
Just wondering if I can change the main program in a Google Home, or is it hard coded? It must allow updates to the software, so can I fool it this way and give it an altered version?
S
Sylvia Else
Guest
On 16-Oct-22 4:15 pm, Commander Kinsey wrote:
I\'d be very surprised if the updates did not have to be
cryptographically signed by Google. Since you would have no way to sign
a substitute program, it is unlikely that you\'ll be able to replace the
software via the usual update process.
Depriving people of control of things they own is perhaps the most
egregious use of cryptographic signing that exists, but until
legislators get involved (don\'t hold your breath), that\'s where we stand.
This is not to say it\'s impossible to do, but will probably require
considerable technical knowledge, and time, if it can be done at all.
Sylvia.
I\'d be very surprised if the updates did not have to be
cryptographically signed by Google. Since you would have no way to sign
a substitute program, it is unlikely that you\'ll be able to replace the
software via the usual update process.
Depriving people of control of things they own is perhaps the most
egregious use of cryptographic signing that exists, but until
legislators get involved (don\'t hold your breath), that\'s where we stand.
This is not to say it\'s impossible to do, but will probably require
considerable technical knowledge, and time, if it can be done at all.
Sylvia.
C
Commander Kinsey
Guest
On Sun, 16 Oct 2022 06:26:49 +0100, Sylvia Else <sylvia@email.invalid> wrote:
I have virtually no knowledge of hacking, but isn\'t the program in there kinda like an OS? Or the only program running under the OS? No matter what Microsoft put in Windows, they cannot stop me deleting it and inserting Linux onto my desktop. Why can\'t I do the same with the Google Home?
I have virtually no knowledge of hacking, but isn\'t the program in there kinda like an OS? Or the only program running under the OS? No matter what Microsoft put in Windows, they cannot stop me deleting it and inserting Linux onto my desktop. Why can\'t I do the same with the Google Home?
D
Don Y
Guest
On 10/15/2022 10:26 PM, Sylvia Else wrote:
You may not be able to *overwrite* the installed code but, likely can
substitute a new image to run. Witness hacks of the Nest thermostat
(another google product)
There is an ongoing effort to make this impossible but there always
seems to be a trick to subvert protections built into devices. Even
if it means wiping the existing firmware completely.
Depriving people of OWNING the things they \"own\" is the most egregious.
What value is a device if I can\'t continue to use it as/when *I* want
(without a subscription, phoning in to an online service, etc.)
You may not be able to *overwrite* the installed code but, likely can
substitute a new image to run. Witness hacks of the Nest thermostat
(another google product)
There is an ongoing effort to make this impossible but there always
seems to be a trick to subvert protections built into devices. Even
if it means wiping the existing firmware completely.
Depriving people of OWNING the things they \"own\" is the most egregious.
What value is a device if I can\'t continue to use it as/when *I* want
(without a subscription, phoning in to an online service, etc.)
D
David Brooks
Guest
On 16/10/2022 06:38, Commander Kinsey wrote:
Make sure you are fully aware of what you can ALREADY do!
https://www.youtube.com/watch?v=ICOmPm5xtzk
https://www.youtube.com/watch?v=eZDyAi3BxN8
HTH
--
David
Make sure you are fully aware of what you can ALREADY do!
https://www.youtube.com/watch?v=ICOmPm5xtzk
https://www.youtube.com/watch?v=eZDyAi3BxN8
HTH
--
David
S
Sylvia Else
Guest
On 16-Oct-22 4:38 pm, Commander Kinsey wrote:
It really comes down to what code the system runs when it starts,
whether that\'s called a BIOS, a boot loader, or whatever (hereinafter
boot loader). If the boot loader is not willing to load and run code
that\'s not been signed with a signature that it will accept, then that\'s
a significant obstacle. You\'d have to replace the boot loader, which
could involve physically removing a ROM and supplying a different one
(whose code you got from....?), or re-flashing it (ditto), if it allows
itself to be re-flashed, and again you have the issue of whether the
replacement needs to be signed.
Your Google Home may well not even have a separate boot ROM - everything
could be on a single chip.
As for PCs so far, the likes of Microsoft have not been able to
persuade/cajole/threaten/bribe the manufacturers of CPUs, laptops and
motherboards to allow only programs signed by said likes to run, and
this is why you can install other software.
Sylvia.
It really comes down to what code the system runs when it starts,
whether that\'s called a BIOS, a boot loader, or whatever (hereinafter
boot loader). If the boot loader is not willing to load and run code
that\'s not been signed with a signature that it will accept, then that\'s
a significant obstacle. You\'d have to replace the boot loader, which
could involve physically removing a ROM and supplying a different one
(whose code you got from....?), or re-flashing it (ditto), if it allows
itself to be re-flashed, and again you have the issue of whether the
replacement needs to be signed.
Your Google Home may well not even have a separate boot ROM - everything
could be on a single chip.
As for PCs so far, the likes of Microsoft have not been able to
persuade/cajole/threaten/bribe the manufacturers of CPUs, laptops and
motherboards to allow only programs signed by said likes to run, and
this is why you can install other software.
Sylvia.
C
Commander Kinsey
Guest
On Sun, 16 Oct 2022 07:42:22 +0100, David Brooks <BDB@not.on.your.life> wrote:
Yes I\'m aware of the phone app. Actually you don\'t even need a Google Home, you can just use your phone!
And I\'ve already used the phone app to get free Spotify music, bypassing the £10 per month fee which lets you choose tracks
Yes I\'m aware of the phone app. Actually you don\'t even need a Google Home, you can just use your phone!
And I\'ve already used the phone app to get free Spotify music, bypassing the £10 per month fee which lets you choose tracks
C
Commander Kinsey
Guest
On Sun, 16 Oct 2022 07:37:14 +0100, Don Y <blockedofcourse@foo.invalid> wrote:
Not that it\'s any use. A burglar needs to be in your home to hack it to get into your home. Er.... catch 22.
Indeed, I wonder why the Google Home is resistant to the same hack? I guess the thermostat is a simpler device.
Indeed. This stupid rental idea of software like MS Office is insanity. Anything within my property should be mine to keep forever. And that includes my neighbour\'s wife tied up in the garage.
Not that it\'s any use. A burglar needs to be in your home to hack it to get into your home. Er.... catch 22.
Indeed, I wonder why the Google Home is resistant to the same hack? I guess the thermostat is a simpler device.
Indeed. This stupid rental idea of software like MS Office is insanity. Anything within my property should be mine to keep forever. And that includes my neighbour\'s wife tied up in the garage.
S
Sylvia Else
Guest
On 16-Oct-22 7:01 pm, Commander Kinsey wrote:
Well, there\'s nothing wrong with the concept of software rental, any
more than of the rental of anything else.
But you know when you\'re getting into a rental agreement. For much
locked-down hardware, there\'s no indication at the time of purchase that
the contract is anything more than a transfer of ownership. Yet in some
cases, the vendor continues to apply updates, even when the new owner
tells them not to.
Sylvia.
Well, there\'s nothing wrong with the concept of software rental, any
more than of the rental of anything else.
But you know when you\'re getting into a rental agreement. For much
locked-down hardware, there\'s no indication at the time of purchase that
the contract is anything more than a transfer of ownership. Yet in some
cases, the vendor continues to apply updates, even when the new owner
tells them not to.
Sylvia.
C
Chris
Guest
Commander Kinsey <CK1@nospam.com> wrote:
Remote execution of (arbitrary) code is the most valuable type of hack and
also the hardest to achieve. Even if you do achieve it the mechanism used
is often fixed quickly by the vendor as it\'s the most critical
vulnerability.
Remote execution of (arbitrary) code is the most valuable type of hack and
also the hardest to achieve. Even if you do achieve it the mechanism used
is often fixed quickly by the vendor as it\'s the most critical
vulnerability.
D
Don Y
Guest
On 10/16/2022 4:30 AM, Chris wrote:
A hack need not be nefarious in nature. I hacked our Nest as it was
easier than trying to *build* a sexy, round, full-graphic display
that would look appropriate hanging on a wall to interact with the
automation system!
I\'m sure the folks who designed it didn\'t have that in mind, at
the time and likely would prefer for NO foreign code to execute on
their platform.
A hack need not be nefarious in nature. I hacked our Nest as it was
easier than trying to *build* a sexy, round, full-graphic display
that would look appropriate hanging on a wall to interact with the
automation system!
I\'m sure the folks who designed it didn\'t have that in mind, at
the time and likely would prefer for NO foreign code to execute on
their platform.
B
boB
Guest
On Sun, 16 Oct 2022 06:15:42 +0100, \"Commander Kinsey\"
<CK1@nospam.com> wrote:
Here is one place to start... Find out what is inside of a Google
Home Mini which should be close to the other GOogle Homes...
Good to know what you are trying to deal with before you try anything.
No a lot to see here but...
https://youtu.be/OexI0LzYnVE?t=1492
Same guy... A closer look into some of the parts.
http://mobilemodding.info/google-home-mini-closer-look/
You might be able to start from scratch on firmware by knowing what
the processor is (ARM of course) but I\'m sure it is code read
protected and so you would have to write EVERYTHING yourself or find
libraries for that part. Marvel I think.
I wish that the Google Homes were stereo like the Amazon Echos and
Alexas are.
boB
<CK1@nospam.com> wrote:
Here is one place to start... Find out what is inside of a Google
Home Mini which should be close to the other GOogle Homes...
Good to know what you are trying to deal with before you try anything.
No a lot to see here but...
https://youtu.be/OexI0LzYnVE?t=1492
Same guy... A closer look into some of the parts.
http://mobilemodding.info/google-home-mini-closer-look/
You might be able to start from scratch on firmware by knowing what
the processor is (ARM of course) but I\'m sure it is code read
protected and so you would have to write EVERYTHING yourself or find
libraries for that part. Marvel I think.
I wish that the Google Homes were stereo like the Amazon Echos and
Alexas are.
boB
J
Joe Gwinn
Guest
On Sun, 16 Oct 2022 18:17:18 +1100, Sylvia Else <sylvia@email.invalid>
wrote:
It is tried from time to time. Usually the US Justice Department
brings an anti-trust case, which stops this train. But this only
happens if the then President allows the Justice Dept to bring such a
case.
A big fight in the US is John Deere not allowing farmers to repair
their million-dollar harvesters and combines. Multiple states have
enacted right-to-repair laws (often by referendum) to prevent this
kind of abuse.
I voted for just such in Massachusetts. Not that I am a farmer, but
we do need competition to maintain discipline in the vendor ranks.
Joe Gwinn
wrote:
It is tried from time to time. Usually the US Justice Department
brings an anti-trust case, which stops this train. But this only
happens if the then President allows the Justice Dept to bring such a
case.
A big fight in the US is John Deere not allowing farmers to repair
their million-dollar harvesters and combines. Multiple states have
enacted right-to-repair laws (often by referendum) to prevent this
kind of abuse.
I voted for just such in Massachusetts. Not that I am a farmer, but
we do need competition to maintain discipline in the vendor ranks.
Joe Gwinn
D
Don Y
Guest
On 10/16/2022 1:12 PM, Joe Gwinn wrote:
There are too many ways (for the supplier) around that.
I\'d wager there are many \"component assemblies\" for which Deere finds
itself at the mercy of other suppliers.
What\'s to stop Deere from buying critical assemblies from Dear, Inc.
Dear, Inc, inflates the cost of those assemblies prior to sale
so even if Deere makes those assemblies available as spares
\"at cost\", the user is still screwed -- especially if Deere
sees a volume discount because it is such a good customer
of Dear\'s.
Should legislators be able to force you to sell at a (paper) loss?
Should Deere be forced to sell any spares that it has prepurchased
to have on-hand to avoid long lead times for customers wanting to
purchase JUST the spares? What if Dear quotes 36 week lead times
to those customers (i.e., like the difference between owning
DEC kit and IBM kit when it comes to service)
Vendors should make their customers WANT to do business with them.
Because they add value, in some way. If they are just a conduit to
an upstream supplier, then the vendor should gouge them REALLY HARD
at the time of the initial sale, knowing that it is the ONLY time
they will be able to extract monies from their customers, right?
Things get murkier when the vendor embeds reliance on a \"service\"
(like GPS, remote diagnostics, etc.) into the continued operation
of the product. On the one hand, it\'s possibly an unnecessary
dependency. Or, it may be a more effective way of delivering
a product than the alternatives (imagine if every PC had to crawl the
web to build its own \"search database\" to eliminate the need for
the likes of google). And, one can argue that you were aware of
this dependency when you purchased the product (or WOULD have been
if you\'d read all the fine print).
It seems like you can argue that having a (NEST) thermostat rely
on an external service to compensate for weather changes, predictions,
etc. is a rational tradeoff. Relying on an external service to
provide the result of \"temperature > setpoint\", OTOH, would be abusive!
And, of course, you can always buy a product from another manufacturer
with less restrictive constraints!
There are too many ways (for the supplier) around that.
I\'d wager there are many \"component assemblies\" for which Deere finds
itself at the mercy of other suppliers.
What\'s to stop Deere from buying critical assemblies from Dear, Inc.
Dear, Inc, inflates the cost of those assemblies prior to sale
so even if Deere makes those assemblies available as spares
\"at cost\", the user is still screwed -- especially if Deere
sees a volume discount because it is such a good customer
of Dear\'s.
Should legislators be able to force you to sell at a (paper) loss?
Should Deere be forced to sell any spares that it has prepurchased
to have on-hand to avoid long lead times for customers wanting to
purchase JUST the spares? What if Dear quotes 36 week lead times
to those customers (i.e., like the difference between owning
DEC kit and IBM kit when it comes to service)
Vendors should make their customers WANT to do business with them.
Because they add value, in some way. If they are just a conduit to
an upstream supplier, then the vendor should gouge them REALLY HARD
at the time of the initial sale, knowing that it is the ONLY time
they will be able to extract monies from their customers, right?
Things get murkier when the vendor embeds reliance on a \"service\"
(like GPS, remote diagnostics, etc.) into the continued operation
of the product. On the one hand, it\'s possibly an unnecessary
dependency. Or, it may be a more effective way of delivering
a product than the alternatives (imagine if every PC had to crawl the
web to build its own \"search database\" to eliminate the need for
the likes of google). And, one can argue that you were aware of
this dependency when you purchased the product (or WOULD have been
if you\'d read all the fine print).
It seems like you can argue that having a (NEST) thermostat rely
on an external service to compensate for weather changes, predictions,
etc. is a rational tradeoff. Relying on an external service to
provide the result of \"temperature > setpoint\", OTOH, would be abusive!
And, of course, you can always buy a product from another manufacturer
with less restrictive constraints!
C
Commander Kinsey
Guest
On Sun, 16 Oct 2022 10:10:02 +0100, Sylvia Else <sylvia@email.invalid> wrote:
I disagree. If I rent a lawnmower from you, I return it the next day so you can rent it to someone else. But if I rent software from you, you don\'t need it back, as it isn\'t eh only one. It\'s just a copy of it. If I don\'t give it back, you still have it!
> But you know when you\'re getting into a rental agreement.
But how do I avoid it? I have pirate MS Office, the old proper real one. When I thought my Powerpoint wasn\'t working, I looked it up and MS tried to sell me it on that horrid phone-type Metro app thing, which looked like I had to store the files on their server! So not only do I rent it, but they get to see my personal stuff! No thanks. My software and my files on my hardware in my property please. I don\'t believe in god and I don\'t believe in the cloud.
Tesla is worse. I heard of the following: Tesla sell cars in a base model, and if you want to upgrade at the time of purchase, or later, they just \"turn on\" the function, which was already in the car!!! Like air conditioning or faster acceleration. So when you buy the base model, that hardware is in your possession! But you can\'t use it! Even worse, if you buy it, then sell your car, advertised as having air conditioning, then Tesla notices it belongs to someone else, they turn it off again! Then the new owner buys the same thing. Again! Tesla sold one physical item twice! WTF?!
I disagree. If I rent a lawnmower from you, I return it the next day so you can rent it to someone else. But if I rent software from you, you don\'t need it back, as it isn\'t eh only one. It\'s just a copy of it. If I don\'t give it back, you still have it!
> But you know when you\'re getting into a rental agreement.
But how do I avoid it? I have pirate MS Office, the old proper real one. When I thought my Powerpoint wasn\'t working, I looked it up and MS tried to sell me it on that horrid phone-type Metro app thing, which looked like I had to store the files on their server! So not only do I rent it, but they get to see my personal stuff! No thanks. My software and my files on my hardware in my property please. I don\'t believe in god and I don\'t believe in the cloud.
Tesla is worse. I heard of the following: Tesla sell cars in a base model, and if you want to upgrade at the time of purchase, or later, they just \"turn on\" the function, which was already in the car!!! Like air conditioning or faster acceleration. So when you buy the base model, that hardware is in your possession! But you can\'t use it! Even worse, if you buy it, then sell your car, advertised as having air conditioning, then Tesla notices it belongs to someone else, they turn it off again! Then the new owner buys the same thing. Again! Tesla sold one physical item twice! WTF?!
C
Commander Kinsey
Guest
On Sun, 16 Oct 2022 19:49:34 +0100, boB <boB@k7iq.com> wrote:
Can you not get two google home speakers and call one a left speaker and one a right? Once they\'re told this, they will output two channels? It is pointless to have stereo on a single unit in one place in your room (although mine is hard wired into my stereo!)
Can you not get two google home speakers and call one a left speaker and one a right? Once they\'re told this, they will output two channels? It is pointless to have stereo on a single unit in one place in your room (although mine is hard wired into my stereo!)
C
Commander Kinsey
Guest
On Sun, 16 Oct 2022 21:12:25 +0100, Joe Gwinn <joegwinn@comcast.net> wrote:
I would just buy from a different make. John Deere would lose sales and stop messing about.
I would just buy from a different make. John Deere would lose sales and stop messing about.
S
Snit
Guest
On Oct 16, 2022 at 3:41:07 PM MST, \"\"Commander Kinsey\"\" wrote
<op.1t5latd4mvhs6z@ryzen.home>:
Perhaps at some point in your life you will invent something of value.
--
Personal attacks from those who troll show their own insecurity. They cannot use reason to show the message to be wrong so they try to feel somehow superior by attacking the messenger.
They cling to their attacks and ignore the message time and time again.
<op.1t5latd4mvhs6z@ryzen.home>:
Perhaps at some point in your life you will invent something of value.
--
Personal attacks from those who troll show their own insecurity. They cannot use reason to show the message to be wrong so they try to feel somehow superior by attacking the messenger.
They cling to their attacks and ignore the message time and time again.
P
Paul
Guest
On 10/16/2022 6:44 PM, Commander Kinsey wrote:
You know better than that.
Electronics never work the way you want. It\'s a given.
Google can mix-down stereo to MONO and send to all your units.
Sending MONO cuts their data traffic in half. Bonus.
Only if the unit had a 1/8\" jack on it, might someone at
Google be tempted to send stereo.
Paul
You know better than that.
Electronics never work the way you want. It\'s a given.
Google can mix-down stereo to MONO and send to all your units.
Sending MONO cuts their data traffic in half. Bonus.
Only if the unit had a 1/8\" jack on it, might someone at
Google be tempted to send stereo.
Paul
C
Commander Kinsey
Guest
On Mon, 17 Oct 2022 05:06:26 +0100, Paul <nospam@needed.invalid> wrote:
Well Google must be lying then....
https://support.google.com/googlenest/answer/7559493?hl=en&co=GENIE.Platform%3DAndroid#zippy=
\"For an immersive music and media experience, you can connect 2 speakers to set up stereo sound.\"
Well Google must be lying then....
https://support.google.com/googlenest/answer/7559493?hl=en&co=GENIE.Platform%3DAndroid#zippy=
\"For an immersive music and media experience, you can connect 2 speakers to set up stereo sound.\"