Google's business model

Posted Jan 16, 2026 11:39 UTC (Fri) by Wol (subscriber, #4433)
In reply to: Google's business model by rschroev
Parent article: A 0-click exploit chain for the Pixel 9 (Project Zero)

Which is fine until you actually want a *real* SD card. Having been in that position, it's a bit of a nightmare because nobody can understand what you're saying.

How does your hearer know whether you mean "That class of devices commonly referred to as SD cards", or "Those devices that actually comply with the formal SD specification"?

In this particular case, the OP was talking about "sending audio over SMS", so it's clear he wasn't actually talking about genuine SMS. But should he really have been saying "Don't use (genuine) SMS because those things that call themselves SMS but aren't can be abused"?

Cheers,
Wol

to post comments

Google's business model

Posted Jan 16, 2026 16:18 UTC (Fri) by cloehle (subscriber, #128160) [Link] (10 responses)

Am I missing something or should this be pretty simple?
All cards with <2GB are SDSC and must be.
They should then be fully SD spec compliant (with all the peculiarities like byte-addressing).
There's no way for the 'newer' spec cards to have >2GB and all features are constrained by that?
(advertised) card capacity being the one characteristic about SD cards that is always available when purchasing this shouldn't really be an issue?

Google's business model

Posted Jan 16, 2026 16:32 UTC (Fri) by pizza (subscriber, #46) [Link]

> There's no way for the 'newer' spec cards to have >2GB and all features are constrained by that?

SD cards >= 2GB (ie gen2 and newer) use block addressing instead of byte addressing and are incompatible with hosts that only speak 1st-gen SD.

The different SD generations report different card info versions, so the old host is expected to safely reject any card with an unknown version.

Google's business model

Posted Jan 16, 2026 17:06 UTC (Fri) by Wol (subscriber, #4433) [Link] (8 responses)

The problem is when you go into a shop and ask for an SD card because you *MEAN* *SD* because that's all your device will accept.

The shop assistant can't understand why you don't want a 4GB card because "it's an SD card". Been there done that.

Even worse, I've had devices that actually want a "genuine SD" 4GB card. I believe the spec does actually permit that - it requires unsigned arithmetic - but (almost?) without exception every 4GB card I've seen was SDHC. Try explaining THAT to your typical shop guy who rarely has a clue about what he's selling!

Cheers,
Wol

Google's business model

Posted Jan 16, 2026 17:25 UTC (Fri) by pizza (subscriber, #46) [Link] (3 responses)

> I've had devices that actually want a "genuine SD" 4GB card. [...] I believe the spec does actually permit that

To quote the actual SD spec:

* Standard Capacity SD Memory Card (SDSC) supports capacity up to and including 2 G bytes (2^31 bytes). All versions of the Physical Layer Specifications define the Standard Capacity SD Memory Card.
* High Capacity SD Memory Card (SDHC) supports capacity more than 2 G bytes (2^31 bytes) up to and including 32 G bytes and is defined from the Physical Layer Specification Version 2.00.

According to the spec, there is no such thing as a "4GB SDSC" card.

Google's business model

Posted Jan 17, 2026 11:58 UTC (Sat) by smurf (subscriber, #17840) [Link] (2 responses)

> According to the spec, there is no such thing as a "4GB SDSC" card.

Nobody disputes that – but silly reasons like not-quite-adherence to some spec or other never stopped people from making semi-compliant gadgets. Like, ever.

At the time, when the SDHC standard was new and not quite well supported, these things did exist. I think I had one of them too.

Today, with less than zero market for these cards (given that in a SDHC-compliant host they'd probably advertise a capacity of either two or zero GBytes)? Not so much.

Google's business model

Posted Jan 17, 2026 12:10 UTC (Sat) by pizza (subscriber, #46) [Link] (1 responses)

> Nobody disputes that – but silly reasons like not-quite-adherence to some spec or other never stopped people from making semi-compliant gadgets. Like, ever.

Sure. But when that happens they get to keep the pieces when things inevitably break.

And deliberately seeking out something that intentionally non-spec compliant tends to not go well.

Google's business model

Posted Jan 17, 2026 13:05 UTC (Sat) by Wol (subscriber, #4433) [Link]

The device in question was a Garmin Satnav, which took SDSC cards. When the map data went over 2GB you were supposed to use a 4GB card ...

Not so bad in that they said the largest card my Father-in-law's Olympus would support was 128MB, I wanted to put a bigger one in, and it clearly could not address all the available memory. Quite why they limited the camera (or card, I think it was an MMC) to 128MB I don't know.

Nowadays, of course, capacity is so huge it's hard to fill up a chip (my DSLR has 100GB, which it tells me is enough for 1100 photos - I can't see me getting through that in a day out ...) but back then I wanted to make sure their cameras had a decent amount of storage ...

Cheers,
Wol

Google's business model

Posted Jan 16, 2026 17:39 UTC (Fri) by iabervon (subscriber, #722) [Link]

I could see devices wanting a "genuine SD" card in the sense that it supports the DRM extensions relative to MMC, and actually wanting it to conform to a standard from the SD Association that isn't their first one.

Google's business model

Posted Jan 16, 2026 19:10 UTC (Fri) by NYKevin (subscriber, #129325) [Link] (1 responses)

Y'know, Microsoft had a long-running habit of referring to UTF-16 as "Unicode," because a long time ago, that was the standard terminology.

It isn't anymore.

Language changes over time. If you want an "SD card" that conforms to the original standard, you're just going to have to ask for an SDSC card. If you want a card that does not conform to the standard (by using unsigned arithmetic where the standard specifies otherwise), then you're probably out of luck.

Google's business model

Posted Jan 19, 2026 9:59 UTC (Mon) by taladar (subscriber, #68407) [Link]

Technically most of the time they also refer to UTF-16 when they actually means UCS-2

Google's business model

Posted Jan 16, 2026 20:49 UTC (Fri) by rschroev (subscriber, #4164) [Link]

Then you specify that you need an SDSC (SD Standard Capicity) card, because that unambiguously refers to the max 2 GB type of cards.