WebOS: the other Linux-based mobile platform [LWN.net]

By Jonathan Corbet
June 14, 2011

Android handsets may get a lot of attention, but they are far from the only Linux-based devices on the market. HP's webOS is also very much a Linux-based system; it can be found on a handful of handsets and an upcoming tablet product. The folks at HP were kind enough to send your editor a Pre 2 handset to play with; what follows are some impressions from that experience. In summary: the Pre 2 is an open device and webOS is an interesting alternative, but webOS devices will have a hard time pushing Android handsets aside.

The Pre 2 is a smallish device with a somewhat rounded shape. Your editor's wife described it as "girlish," pointing out that it even has a mirror on the back side of the slider. The phone slides vertically when it is held in the portrait orientation, exposing a small QWERTY keyboard. Actually, [Pre2] it must be said that the keyboard is very small; it is difficult for your fat-fingered editor to use. Use of the keyboard is obligatory, though; there is no on-screen keyboard provided with the device. Charging is via a standard micro-USB port. One nice feature is a separate switch for putting the phone into a silent mode; the switch, unlike the profiles on many other handsets, is difficult to change accidentally.

The handset has an ARM OMAP processor with a mighty 300 bogomips of performance; it has 512MB of main memory and 16GB of flash storage. The screen is 320x480 - on the small side for contemporary devices, but the Pre 2 is a small device. The unlocked GSM version of the device has, in addition to the four standard GSM bands, support for 3G at both 850MHz and 1900MHz. 850MHz support, of course, is nice for those of us using a certain US-based carrier which, despite its size and appetite for competing carriers, tends to be overlooked by unlocked Android devices.

The webOS interface takes some getting used to, but it has its good points. The "home" screen is called the "card view"; it contains five application icons at the bottom. Whenever a new application is run, it is placed on the card view much like playing cards on a table. Each application's "card" tracks the current state of its screen, so it is possible to scroll through the card view and see what every running application is up to.

WebOS makes heavy use of gestures for control, to the point that the device wants first-time users to go through a tutorial (with tests at the end) before doing much of anything else. There is no "back" button; that functionality comes with a right-to-left swipe along the bottom of the screen. An upward swipe from the bottom goes to the card view; a second swipe pulls up the application menu. Running applications are stopped by flinging their cards off the top of the display. It takes a bit of practice to get used to the interface, but, before long, it feels quick and natural.

Other aspects of the interface are a little harder to get used to. A depth-first traversal of the Android settings menu will expose the user to almost every option the device has; webOS, instead, tends to hide things. A user wishing to turn off mobile data use, for example, will search for vain in the system settings menus; one must, instead, pull up the dialer application and hit the button in the upper left which contains the current mobile carrier's name. The "location services" screen controls access to a number of location-based options, but not whether GPS is enabled - that option is under a separate "preferences" menu. There may be some consistent philosophy behind the placement of these options but, to your editor, it seems somewhat arbitrary and confusing.

In some ways, the interoperability of the device is quite nice; contacts and calendar data, for example, can be obtained from a variety of sources and integrated on the phone. An Android user wanting to make the switch to webOS will find that much of the information stored in the Google mothership is equally accessible. In other places it falls down; it was not possible to test the email application because LWN's self-signed IMAP server certificate was not "trusted." Your editor, who created that certificate, trusts it just fine; it should be possible to impress that trust upon a phone. There is an involved series of steps said to force that trust; it would be much easier if the application simply asked.

Naturally enough there is a market for add-on applications; there is a fair amount of stuff there, but nowhere near as many applications as Android offers. Android users may be surprised at the lack of permissions questions; webOS seems to lack the set of privileges that Android provides. There is exactly one exception: users will be warned about applications which will request location data. It is also possible to configure the phone to ask before providing location information to any application, yielding an experience similar to that of configuring a web browser to ask about every cookie. But any other sort of access - network access, for example - seems to be entirely uncontrolled.

Various other little things seem to be missing. The camera hardware seems reasonable, but the associated application is minimal. The music player cannot play Ogg files. There's no indication when GPS or mobile data are in use. The Pre 2 cannot simultaneously function as a phone and as a USB storage device. The web browser lacks the semi-magic "format the page for the screen" mode that works so well on Android. There is no word completion or typo correction for keyboard input. And so on. Fans of webOS say that the system is more tightly integrated and consistent than Android, and that it handles multitasking in a more natural way. All of these may be true. Had your editor come to webOS directly from less-smart phones, he would certainly have been much impressed. As it is, it is hard not to conclude that this platform needs some work to become truly competitive in today's market.

Hackability and community

If one opens the phone while it is in the card view and types "upupdowndownleftrightleftrightbastart" (a spelled out version of the famous Konami Code), the result is a new icon offering to put the phone into developer mode. That turns out to be the key to what is a nicely open and hackable device. There's little that will get in the way of anybody wanting to make their Pre 2 do a number of interesting things. The first step is to get and build novacom, a tool which is the webOS analog to Android's adb. Plugging the phone to a computer's USB port, putting it into developer mode, and running novacom will yield a root shell on the device. From this point of view, webOS looks like a straightforward Debian-derived distribution (correction: it's actually based on OpenEmbedded); it is much easier to move around in and inspect than Android's minimal shell. It actually feels like Linux.

After that, there's a lot to be found on webos-internals.org, starting with Preware, a sort of alternative application repository. Through Preware, one can install application tweaks, useful features, and more. Your editor started with the "developer mode" button which took away the pain of typing the Konami Code on the Pre 2 keyboard. There is an on-screen keyboard (though, alas, it was not yet working with webOS 2.1.0) and a WiFi tethering application which, unlike the official one, works regardless of whether one's mobile carrier has blessed it. Some of what's in Preware looks more useful than the rest, but, as a whole, it's a repository that serious webOS users are likely to want to enable.

The device comes with a 2.6.24 kernel. HP has put up a nice page where source for all of its open-source components can be found; they provide original tarballs and the patches they have applied as separate files. The webOS 2.1.0 kernel patch is a daunting 10MB monster which touches almost 1200 files and adds nearly 350,000 lines of code. Much of that code is clearly post-2.6.24 backports, some of it is board support for the handset, and some is drivers. There is also a custom cpufreq governor. There are instructions for building and installing kernels on the device, but it's not possible to build the whole thing: webOS includes a small number of binary-only modules for wireless networking, graphics, and more. As a result, there are a lot of tweaked 2.6.24 kernels out there for webOS devices, but no current kernels.

The binary-only modules are unfortunate, even if the Pre 2 is far from unique in requiring them. The same could be said of the mostly proprietary application space. WebOS also has a development process which is even less open than Android's; source for shipped code is thrown over the wall, but there is no repository, no associated open source project, and no way for others to even try to add changes. That makes the generation of a high level of enthusiasm in the development community hard; that may explain why there does not appear to be an equivalent to CyanogenMod in the WebOS world.

That is a bit of a shame; the Pre 2 otherwise is a remarkably open device; one can get into it and hack away without having to go through any cumbersome rooting rituals. WebOS is a Linux-based handset (and, soon, tablet) platform that actually looks like Linux; unlike MeeGo, it is actually available on current handsets. It is an interesting platform which, one hopes, will continue to survive. Given the strength of the competition - Android has a much larger user base, more features, many more handsets, and many more applications - one might think that webOS could use all the help it can get. WebOS seems to have a crowd of dedicated users and developers who would likely provide that help if HP would just let them.

to post comments

WebOS: the other Linux-based mobile platform

Posted Jun 14, 2011 16:08 UTC (Tue) by pabs (subscriber, #43278) [Link] (12 responses)

I thought WebOS was based on OpenEmbedded rather than Debian. Did they switch or is that an error in the article?

OpenEmbedded

Posted Jun 14, 2011 16:11 UTC (Tue) by corbet (editor, #1) [Link] (11 responses)

That was my mistake; I've put in a correction, thanks.

OpenEmbedded

Posted Jun 16, 2011 0:22 UTC (Thu) by Lennie (subscriber, #49641) [Link] (10 responses)

Can you now also switch to use a 'real certificate' instead of selfsigned ?

Security without authentication just isn't.

Here it is really easy and it is free from StartSSL:

https://github.com/ioerror/duraconf/blob/master/startssl/...

OpenEmbedded

Posted Jun 16, 2011 18:45 UTC (Thu) by iabervon (subscriber, #722) [Link]

CA-signed certs aren't all that secure. The most secure certificate is a self-signed one whose fingerprint you know. (Or a cert signed by a CA you personally know and trust, if you trust that someone you personally know can run a CA without introducing insecurities.)

Jon's obviously got a "real" certificate (from Equifax) that lwn.net provides to authenticate itself to strangers, but why should Jon have to trust Equifax to authenticate himself to himself?

Security != authentication, authentication != certificates

Posted Jun 19, 2011 3:17 UTC (Sun) by djao (guest, #4263) [Link] (6 responses)

SSH is a program that many people (including Jon, I'm sure) trust for use on root shells. SSH doesn't use real certificates. SSH doesn't even use self-signed certificates. As a matter of fact, SSH doesn't use any certificates whatsoever. Authentication is done using plain public keys. The first time you connect to a server, you don't even get that (you're asked to manually accept a key, which could potentially be a forgery).

According to you, without authentication, SSH "just isn't [secure]." Really? If so, how do you reconcile this claim with the mountain of real-world evidence that indicates otherwise?

Let's compare the two using a simple attack tree. Consider SSL. A typical web browser has some 500 certificate authorities that it trusts by default. If any one of those CAs is compromised (even if it's one that you don't use for your own certificates), then the attacker can man-in-the-middle everyone in the world. This has actually happened at least once (Comodo attack).

Now consider SSH. To launch a man-in-the-middle attack, the easiest way is to intercept and alter the victim's initial connection to the server. (Has this ever actually happened outside of a lab? My guess is no.) Failing that, you'll have to alter the victim's key cache in memory or on disk. Obviously if you have access to the victim's disk/memory then you can trivially break SSL as well.

The inescapable conclusion is that, if you want real security, you should cache and compare key fingerprints yourself rather than relying on a third party (or worse, 500 different third parties) to do the job for you.

Security != authentication, authentication != certificates

Posted Jun 19, 2011 9:36 UTC (Sun) by Lennie (subscriber, #49641) [Link] (5 responses)

I'm sorry, but the general public is not educated enough in this field to know the difference between the right fingerprint and the wrong one. They have nothing to compare it to.

And usually the people that should be educated about it also don't check the fingerprints on SSH.

I don't know of any browser or email client which keeps a cache of fingerprints.

But I should probably not have mentioned what I mentioned.

Because manually addding a CA is obviously fine, as long as you transfer the CA-cert to the device through a secure channel.

Security != authentication, authentication != certificates

Posted Jun 19, 2011 10:00 UTC (Sun) by djao (guest, #4263) [Link] (4 responses)

As you just said, users aren't educated enough to know the difference between the right key and the wrong one, and users don't check the fingerprints on SSH, even though they should.

Yet, despite all this, SSH does in fact work very well. When was the last time you ever heard of a successful man-in-the-middle attack against SSH in the wild? I know I've never heard of any. It can't possibly be for lack of trying, given the huge payoff for a successful attack (root shell in many cases).

Rather than dismissing SSH's lack of authentication, I think it's worth trying to understand why SSH works so well. Maybe browsers and email clients should start caching fingerprints. (You're right that none currently does.) I don't have all the answers, but I can tell you one thing for sure: certificates aren't the reason why SSH works, since SSH doesn't use certificates.

Security != authentication, authentication != certificates

Posted Jun 19, 2011 10:33 UTC (Sun) by dlang (guest, #313) [Link]

I haven't heard of SSH being attacked via man-in-the-middle, but I have heard of cases where SSH has been used as the method of attacking by stealing copies of the keys on the client side.

this isn't a flaw in SSH, it's a flaw in the common deployment scenario where SSH is configured to trust client keys without some other (strong) form of authentication

Security != authentication, authentication != certificates

Posted Jun 20, 2011 8:56 UTC (Mon) by Lennie (subscriber, #49641) [Link] (2 responses)

Actually, how often do you hear about man-in-the-middle-attacks against HTTPS ?

In the whole history of Mozilla & Firefox there was exactly one bugreport of a user who was on a wireless that tried (for a longer period of time*) to redirect the traffic somewhere else than intended.

Now I know this is just the top of the iceberg, but still that isn't much either.

I think the real solution to HTTPS or TLS in general is to hook it up to DNSSEC. Although it still has deployment issues at the moment, but when IPv6 gets going it will automatically solve most of the DNSSEC deployment issues.

It can't be long now until IPv6 gets going, I would think. It is also being deployed as fast as IPv4. it has a very similair growth curve.

SSH also supports DNSSEC btw and it already works, it solve the fingerprint problem.

Also SSH can use certificates too. ;-) It is a bit new and isn't much used yet though.

* That is why the user created the bugreport, she has a lot of HTTPS untrusted warnings/errors.

Security != authentication, authentication != certificates

Posted Jun 20, 2011 14:24 UTC (Mon) by djao (guest, #4263) [Link]

I mentioned a man-in-the-middle attack in my post -- the Comodo attack. Another example is the RapidSSL MD5 attack. That's already two more examples than SSH.

Security != authentication, authentication != certificates

Posted Jun 30, 2011 10:33 UTC (Thu) by robbe (guest, #16131) [Link]

> Actually, how often do you hear about man-in-the-middle-attacks against HTTPS ?

We don't hear about incidents affecting single users very often, unless they are a celebrity.

But there are GUI tools (e.g. Cain and Able) available to perpetrate this MITM attack that make it easy enough for the typical Windows kiddie. I am pretty this happens all the time in networks where these abound (schools, anyone?).

On the enterprise side, there is security software doing https MITM for virus scanning (and optionally other) purposes. Of course here the admin does it on purpose, and proper deployment means that he will install the MITM's CA certifacte as trusted on every user machine.

OpenEmbedded

Posted Jun 20, 2011 9:43 UTC (Mon) by jschrod (subscriber, #1646) [Link]

"[citation needed]"

Please explain the security advantage of a "real" certificate for an IMAP server in one's own company that's used by ca. 4 persons, to be used on one's own workstations and one's own (self-configured) notebooks, compared to a self-signed certificate. This use case obviously includes import of that specific certificate (or of one's own CA, more likely) into respective applications like MUAs.

I don't see any.

Please list specific risks that are mitigated by the "real" certificate in that use case. Also consider the cost-risk relationshiop of generic CA's trustworthiness in your answer, and explain why authentication by a self-signed cert is no authentication in that specific use-case. Thank you.

OpenEmbedded

Posted Jun 23, 2011 20:35 UTC (Thu) by foom (subscriber, #14868) [Link]

Funny. Have you checked their website recently? :)
https://www.startssl.com/?app=11&action=true

"Due to an attack on our systems and a security breach that occurred at the 15th of June, issuance of digital certificates and related services have been temporarily suspended as a defensive measure. Our services will be gradually reinstated as the situation allows."

This is doubtful...

Posted Jun 14, 2011 17:54 UTC (Tue) by khim (subscriber, #9252) [Link] (18 responses)

WebOS is a Linux-based handset (and, soon, tablet) platform that actually looks like Linux; unlike MeeGo, it is actually available on current handsets. It is an interesting platform which, one hopes, will continue to survive.

This is doubtful. There are small hope for the tablet (small hope indeed), but for phone...
1. If one opens the phone while it is in the card view and types "upupdowndownleftrightleftrightbastart" (a spelled out version of the famous Konami Code), the result is a new icon offering to put the phone into developer mode.
2. There is [...] a WiFi tethering application which, unlike the official one, works regardless of whether one's mobile carrier has blessed it.

"Upupdowndownleftrightleftrightbastart" does not void the warranty, right? It means that most carriers will boycott Pre2 like they did Pre. And that mean webOS is undeed like MeeGo was last year. Perhaps soon it'll be like MeeGo this year and will finally be dead...

It's funny. Handset makers forget the simple rule again and again: don't ever fight your customers. Customers for handset makers are carriers first and end-users second. Situation is changing - but slowly.

This is why Nokia's fate is now between Ericsson (at best) and Siemens (at worst). When Elop poured gasoline on his "platform" and set it on fire there was small hope for survival. But then Microsoft went and bought Skype. This immediately made WP7 persona non grata for most carriers. And what hope is there for Nokia when it's resellers boycott it?

Free phone can be a dominant platform only in a world where most buyers buy prepaid phones, not subsidized ones from carriers. We'll get there... eventually. But to ignore the reality that right now, today, that's not the case. What the HP is thinking?

This is doubtful...

Posted Jun 14, 2011 18:39 UTC (Tue) by blitzkrieg3 (guest, #57873) [Link]

> Free phone can be a dominant platform only in a world where most buyers buy prepaid phones, not subsidized ones from carriers. We'll get there... eventually. But to ignore the reality that right now, today, that's not the case. What the HP is thinking?

I really hate the iPhone, but it did that one thing right. It got people out of ATT stores and into Apple stores to buy their handset, which is a total paradigm shift.

This is doubtful...

Posted Jun 14, 2011 20:15 UTC (Tue) by marcH (subscriber, #57642) [Link] (8 responses)

> Free phone can be a dominant platform only in a world where most buyers buy prepaid phones, not subsidized ones from carriers.

Multiply by their minimum duration the price of contracts that offer you a "free" smartphone, then compare that to a SIM-only offer and realize it is quite often not a subsidy but rather a cleverly engineered credit.

Caveat: I only know about Europe.

US carriers charge the same price with or without a contract

Posted Jun 15, 2011 2:41 UTC (Wed) by jhhaller (guest, #56103) [Link] (7 responses)

Unfortunately, the carriers want to own the relationship, so there is no advantage to getting a SIM-only contract - the price of the contract includes a new phone credit every 1.5-2 years. T-Mobile USA tried a different model, but I suspect it was not very successful. So, other than being comfortable with a phone, there is little advantage of keeping a phone more than the contract length. This leads to the premature disposal and environmental waste of millions of phones. It makes replacing the battery cost-inefficient, as it's cheaper to get a new phone than a new battery. [Many smart phones are more expensive, and it may be cheaper to get a new battery].

US carriers charge the same price with or without a contract

Posted Jun 16, 2011 0:33 UTC (Thu) by Lennie (subscriber, #49641) [Link] (4 responses)

Atleast in my country (the Netherlands in Europe) a SIM-only is a lot cheaper than a contract which subsidies a phone.

There is also a law which says that if a provider locked the phone you should be able to get it unlocked by the provider.

So if you have a phone from such a contract and it runs out your provider has to unlock it and you can get a SIM-only contract and pay less.

US carriers charge the same price with or without a contract

Posted Jun 16, 2011 9:31 UTC (Thu) by fb (guest, #53265) [Link] (3 responses)

I lived in the NL, and it was indeed cheaper to take a sim-only contract. I moved to France, and here I could not find a sim-only contract that was financially advantageous.

One curious thing about France mobile phone market is that the law requires that every phone sold locked to also be available for purchase unlocked.

French telcos

Posted Jun 16, 2011 10:14 UTC (Thu) by marcH (subscriber, #57642) [Link] (2 responses)

> I lived in the NL, and it was indeed cheaper to take a sim-only contract. I moved to France, and here I could not find a sim-only contract that was financially advantageous.

The French land line broadband market is one of the best in Europe. No limit triple play set top box for 30 euros per month. For this price the only limit is usually just the bandwidth of your copper line and that's it. Fiber is being actively deployed in all major cities right now.

On the other hand, the French mobile phone market is probably the worst in Europe because of the collusion between mobile operators. They were fined 534 millions euros for that (just search "French mobile phones fined") yet things have not changed much.

As one consequence of that, French mobile phone operators have collectively decided to make SIM-only plans uninteresting.

There is some hope at the moment since one of the landline operator is entering the mobile market after finally defeating intense lobbying from the incumbents.

> One curious thing about France mobile phone market is that the law requires that every phone sold locked to also be available for purchase unlocked.

This is not specific to mobile phones: laws against tying are very strong in France. You generally must offer the products separately as well.

http://en.wikipedia.org/wiki/Tying_(commerce)

French telcos

Posted Jun 16, 2011 12:09 UTC (Thu) by marcH (subscriber, #57642) [Link]

> As one consequence of that, French mobile phone operators have collectively decided to make SIM-only plans uninteresting.

... and pre-paid plans even less interesting.

Anything cheap... isn't!

French telcos

Posted Jun 16, 2011 15:33 UTC (Thu) by yaap (subscriber, #71398) [Link]

> As one consequence of that, French mobile phone operators have collectively decided to make SIM-only plans uninteresting.

True, but this is changing right now. A new law will force cheaper SIM only contract (the contract will not include mandatory subsidy for a new phone, like "old" SIM only contacts where you didn't get a phone at first, but were still enrolled in their subsidy plan to get discount or free phone every couple years) soon, and one operator has started this already --- I just saw an add for it yesterday.
I don't know for sure, but I wouldn't be surprised if the law was a transposition of an EU directive.

US carriers charge the same price with or without a contract

Posted Jun 16, 2011 9:40 UTC (Thu) by ekj (guest, #1524) [Link]

Is this really the case for USA ?

Up here (Norway) the best no-phone contracts are *SIGNIFICANTLY* cheaper than the best phone-included contracts, and most of the time the difference is enough that the price-differential over the length of the contract comes out to the same, or more, than what buying a unlocked phone costs.

Indeed, many of the with-phone contracts have two distinct prices, one for the first year (that covers the phone) and one thereafter, which makes it pretty darn clear that it's just a credit-buy.

For example, on the way to work today, I saw an offer for an Iphone for no-money-down, but you had to sign up for a 12-month contract that costs $120/month -- the *exact* same contract, from the same provider, is available for $70/month without a phone.

This makes it -perfectly- clear that you're paying $50/month, or $600 over that year for the phone.

US carriers charge the same price with or without a contract

Posted Jun 16, 2011 10:02 UTC (Thu) by mitchskin (subscriber, #32405) [Link]

I had the T-Mobile plan that I think you're talking about (the "Even More Plus" one), and it's true that they've taken it off of the website (although apparently you can still get it if you call in or go to a store). Now, though, I have a t-mobile prepaid plan (no subsidy, no contract) that's roughly as nice as the even more plus ones. They have unlimited prepaid plans that renew monthly, and some of those monthly plans include data. I'm paying about as much as before, but I now have unlimited minutes which I didn't have with my "even more plus" plan.

Prepaid is growing a lot, and it doesn't lend itself to a contract subsidy, and it's aimed at a very price-conscious market, so I'm hopeful that there'll continue to be useful no-contract options. In the past it was hard to get data in a prepaid context, but as data becomes more and more important, I think that'll change.

I agree that carriers want to own the relationship, but I'm hopeful that it'll get more difficult for them to do that with prepaid.

This is doubtful...

Posted Jun 14, 2011 20:35 UTC (Tue) by corbet (editor, #1) [Link]

It is worth noting that Verizon, the largest US carrier, offers the Pre 2 now. That said, I have not verified whether developer mode works on the Verizon phones; it would not surprise me to hear that it had been disabled on that version.

This is doubtful...

Posted Jun 15, 2011 4:28 UTC (Wed) by rsidd (subscriber, #2582) [Link] (5 responses)

You know, there is a world outside the US. Nokia was doing just fine in that world. Until Android came along. I agree that WP7 is a huge mistake for Nokia, but it's nothing to do with careers being their customers -- where I live (India), people buy phones from phone retailers and not mobile providers, all phones are unlocked, and you can install what you like on your phone. Nokia's problem is not the carriers. It is that Symbian is just not good enough for customers any more. It is a mystery to me why they don't just embrace Android.

In fact, it seems to me that it should be possible to run Android in some sort of chroot on top of Meego (with a suitably modified kernel). I have done the opposite -- installed linux (ubuntu) in a chroot on an android device, and Nokia with their corporate resources should be able to do much better.

Windows is a mistake for Nokia not because Microsoft bought Skype (in most of the world that would be a win), but because mobile customers simply don't care that much about Windows.

I speak as the owner of an over-two-years-old Nokia E63. It's not even close to Android in terms of software -- but I do have Opera Mini and the GMail app running on it and that's good enough most of the time. Meanwhile, it is very nice hardware -- the qwerty keyboard is remarkably easy to type on, it is easy to "tether" to a laptop using a USB cable or bluetooth (again, Indian carriers have no problem with that, and some of them even give instructions or custom software to do it), its built-in torch (which doubles as camera flash) is very handy, its battery life is excellent, and it takes a LOT of abuse.

Nokia's strong point is their hardware. I really hope they survive.

This is doubtful...

Posted Jun 15, 2011 9:21 UTC (Wed) by danieldk (guest, #27876) [Link] (1 responses)

There was talk about failed negotiations between Google and Nokia about Android. But Google did not give them enough room for differentiation.

http://www.cnet.com/8301-17918_1-20068397-85.html

This is doubtful...

Posted Jun 15, 2011 10:06 UTC (Wed) by rsidd (subscriber, #2582) [Link]

Interesting. Why doesn't Nokia think they can differentiate by providing a very good Android experience on high-quality hardware? And the only reason Windows will help them "differentiate" is that hardly any other vendor is using it. Elop's comments suggest a proprietary lock-in mentality (he does come from Microsoft, after all) -- but it seems even Microsoft realises that it doesn't work when you aren't already the market leader, hence their move away from Silverlight and towards HTML5. Looking at the WP8 previews, it may turn out to be a pretty good product -- but there will be no lock-in, since a standards-based web app will work on any device with a standards-based browser

And if Nokia does want to build a differentiated product based on Android, why not? It is open source, they don't need Google's permission (except for the Android trademark).

This is doubtful...

Posted Jun 15, 2011 11:01 UTC (Wed) by brendan_wright (guest, #7376) [Link]

> You know, there is a world outside the US.

That's right! There are something like 5 billion mobile phone users and only about 6% of them live in the US.

Sometimes I wonder how much Apple & Google etc understand that... greasing up to a carrier might be the Only Way to succeed in the US, but here in New Zealand where selling "locked" handsets is effectively illegal the carriers have much less ability to control which devices will succeed.

Please stop handicapping them in order to please 6% of the world market!

This is doubtful...

Posted Jun 16, 2011 0:36 UTC (Thu) by Lennie (subscriber, #49641) [Link] (1 responses)

An other reason Nokia went with Microsoft is they gave Nokia a large sum of money "as advertising budget".

This is doubtful...

Posted Jun 20, 2011 22:58 UTC (Mon) by sonnyrao (subscriber, #11351) [Link]

That's not the "other reason"
It's most likely *the* reason they went with Microsoft
They needed the money and apparently Google didn't want to pay them to use a free operating system

This is doubtful...

Posted Jun 17, 2011 10:16 UTC (Fri) by TRS-80 (guest, #1804) [Link]

If so, it'll be undead in the way that MeeGo is undead; HP bought Palm because they want to put WebOS in a lot of products, just like MeeGo is apparently used in quite a few embedded products. Except that unlike MeeGo, there's still a phone vendor who wants to use it.

WebOS: the other Linux-based mobile platform

Posted Jun 14, 2011 20:02 UTC (Tue) by bcombee (subscriber, #40068) [Link] (19 responses)

Thanks for the review. The device communication tool is actualy novacom, not novocom.

webOS 2.1 has text correction in editor fields. In the Preferences page of the launcher, go to Text Assist and you'll see all the settings.

The IMAP self-signed certificate issue is one that could use better UI. We've redesigned the accounts system and email application in webOS 3.0, but I don't think this particular issue has been addressed. It looks like the method of manually installing a certificate using the Certificate Manager UI will still work, but it's not as easy as a "accept this cert" dialog in the accounts UI.

And this is actually a good thing...

Posted Jun 15, 2011 6:48 UTC (Wed) by khim (subscriber, #9252) [Link] (18 responses)

Only on LWN you can see Your editor, who created that certificate, trusts it just fine; it should be possible to impress that trust upon a phone in a review. This shows such a fundamental disconnect it's not even funny.

The standard phrase applies: you don't exist. The number of people who can create and use certificate without outside help is so minuscule it's stupid to even think about them. If you'll add easy option to add certificate then people will go and happily accept certificates from all kinds of phishing sites.

In case of IMAP it's clearly task for the techsupport of your company (or ISP), not for end user - and instructions look good enough for such use case.

And this is actually a good thing...

Posted Jun 15, 2011 8:04 UTC (Wed) by jku (subscriber, #42379) [Link] (17 responses)

Your advice is good and describes well how things should work. Unfortunately that's not always what happens in the real world: self-signed certs do get used in intranets ("it's inside the VPN, why bother?") that can be accessed by devices that do not recognise the certs, proper certificates get forgotten and are no longer valid, etc.

Your advice to device manufacturers is "just leave these people without the service: you didn't do anything wrong, their IT support is to blame". In a way this is sound advice but it also means these real customers could be a bit annoyed when you first deny them service and then doubt their existence :) .

Why it's there in the first place, then?

Posted Jun 15, 2011 8:30 UTC (Wed) by khim (subscriber, #9252) [Link] (16 responses)

Unfortunately that's not always what happens in the real world: self-signed certs do get used in intranets ("it's inside the VPN, why bother?") that can be accessed by devices that do not recognise the certs, proper certificates get forgotten and are no longer valid, etc.

Right. And the advice is simple for such cases: remove the SSL, it'll be more honest. And simpler to setup for everyone involved.

Your advice to device manufacturers is "just leave these people without the service: you didn't do anything wrong, their IT support is to blame".

Actually it's advice mostly to the government (which will ignore it till few real tragedies will strike and billions will be lost). Manufacturers have little choice: the "easiest to use" platform wins. Classic tragedy of commons: companies drop security safeguards to win marketshare then people are complaining that their systems are infected by all kinds of malware, their private data is sent to god knows where and their money is transferred to Congo.

In a way this is sound advice but it also means these real customers could be a bit annoyed when you first deny them service and then doubt their existence :)

Right. That's why I expect that HP will eventually make it simple to add self-signed certificate with just one click. They are not Google, they are not market leader, they must please customer in any way they can. The fact that later this same customer will be outraged when his private mail will be published in web is irrelevant as Facebook success shows.

We'll see how bad it'll be before some mandatory security requirements will be imposed by law.

Why it's there in the first place, then?

Posted Jun 15, 2011 10:54 UTC (Wed) by Cyberax (✭ supporter ✭, #52523) [Link] (14 responses)

WTF?

Self-signed certs are WAY more secure than plain-text passwords. You can't passively eavesdrop on communications, you need to be able to perform active attacks.

It's only partially true

Posted Jun 15, 2011 13:06 UTC (Wed) by khim (subscriber, #9252) [Link] (9 responses)

This is only true when you explicitly install them. I said as much before.

But if it's easy to accept them with a single click then you are training people to ignore security warnings. The net effect on security is strictly negative: the fact that now you need active attack is more then compensated by the fact that users are now ignoring security messages.

It's only partially true

Posted Jun 15, 2011 14:28 UTC (Wed) by marcH (subscriber, #57642) [Link]

What makes you think people who self-sign their certificates care about educating the masses?

Actually... what makes you think anyone anywhere still cares about educating the masses?

Sorry to be cynical - I am just trying to be realistic.

SSH?

Posted Jun 19, 2011 2:48 UTC (Sun) by djao (guest, #4263) [Link] (5 responses)

It's instructive to compare SSL to SSH before you go off overblowing the importance of certificates.

SSH doesn't use certificates at all, self-signed or otherwise. In SSH, almost every real-world user (more or less) automatically responds "yes, trust this public key" whenever connecting to a server for the first time. The procedure is equivalent in both user experience and security to your proverbial one-click acceptance of self-signed certificates.

Are you therefore claiming that the net effect of SSH on security is strictly negative? If so, that's a very surprising, almost ludicrous, assertion. I can imagine someone making some sort of argument that SSH does not provide as much security as a hypothetical optimal variant that used certificates, but to claim that SSH is even worse than telnet is a stance that has no credibility.

Moreover, there is ample objective evidence that SSH in fact achieves better real-world security than SSL. When was the last time you heard of a man-in-the-middle attack against SSH? Have there been any reports of successful SSH key forgeries? Which of SSH or SSL has the greater market share? (Hint: you can't argue that SSH is a less attractive target on the basis of its market share.) Which of the two userbases (SSH or SSL) would you say has better-trained users? (Is this a pre-existing effect, or is it possible, just maybe, that ease-of-use has a positive effect on user training?)

You might want to think carefully about how SSH managed to reach 99% market share without using any certificates or PKI authentication. The easy option is not always insecure. Sometimes it's exactly what's needed.

SSH?

Posted Jun 20, 2011 22:13 UTC (Mon) by elanthis (guest, #6227) [Link] (4 responses)

SHH is hacked all the time. It's trivial to do so because the lack of a central key authority puts the onus of verifying the remote host's authenticity on the user, almost every single one of which just says "yes add this host key" without even thinking of checking the key's fingerprint.

That you don't _hear_ about these is irrelevant. SSH is far less prevalent amongst the masses and hence is far less newsworthy. There are papers and CVEs publisheds on it all the time nonetheless.

SSH?

Posted Jun 21, 2011 0:23 UTC (Tue) by djao (guest, #4263) [Link] (3 responses)

That you don't _hear_ about these is irrelevant. SSH is far less prevalent amongst the masses and hence is far less newsworthy. There are papers and CVEs publisheds on it all the time nonetheless.

1. Could you cite any such papers or CVEs?

2. If you consider the big picture (total number or proportion of security incidents against browsers as opposed to login shells), I'm sure the number and proportion of unreported browser attacks far exceeds the number of unreported attacks against login programs. Many of these browser attacks (phishing etc.) have nothing to do with SSL, but that's my point: A security protocol, such as SSL, which fails to achieve widespread mandatory use, is by definition incapable of preventing most attacks.

The best security protocol in the world is of no use whatsoever if an attacker can simply trick unsuspecting users into not using it. This happens all the time with SSL. Failure to achieve market share is in and of itself disastrous for security, and I believe this shortcoming of SSL outweighs all its other achievements.

SSH?

Posted Jun 21, 2011 0:46 UTC (Tue) by dlang (guest, #313) [Link] (2 responses)

there are definantly CVEs with SSH itself, and there are papers that show problems with how SSH is used. There have been a number of well publicised cases where someone's laptop/desktop was compromised and their SSH keys were then used to go login to other systems and continue the attack from there.

but that's not the same as a man-in-the-middle attack, which is the particular issue that was being discussed here.

SSH?

Posted Jun 21, 2011 1:48 UTC (Tue) by djao (guest, #4263) [Link] (1 responses)

You keep mentioning the type of attacks where "someone's laptop/desktop was compromised and their SSH keys were then used to go login to other systems." This is not a fair comparison. The reason SSH keys are attacked in this way is because SSH keys are actually used. Believe it or not, SSL also supports client-side keys for authentication. The reason why you never hear about this feature getting attacked in SSL is because, I believe, the number of people in the world who use this feature in SSL is approximately zero. If they were actually used, then the same attack would also work against SSL.

My whole point all along is that SSL's failure to achieve marketplace acceptance is the one thing that above all else renders SSL useless as a security protocol. It hardly seems fair to attack SSH on this basis. A security protocol or protocol feature, such as SSL client-side keys, which nobody uses is certainly invulnerable to attack, but it also does not contribute to security in the slightest.

SSH?

Posted Jun 21, 2011 3:26 UTC (Tue) by dlang (guest, #313) [Link]

you are misunderstanding me.

I am not attacking ssh because of the cases where the client certs have been compromised, I am mentioning them and saying that such attacks do not count as SSH vulnerabilities (they count as bad deployment decisions on how to use SSH, relying solely on the possession of the client side cert, not requiring anything else)

another poster claimed that SSL without CA validation is meaningless, someone else pointed out that that basically matched what SSH does, and that SSH is therefor vulnerable to the same types of attacks as SSL without CA validation. So the question I am raising is, given that there is far more extensive use of SSH, can anyone show attacks against this supposed severe mitm vulnerability?

programming bugs in SSH don't count (which is what most CVE things are)

attacks that involve compromising the client key don't count as they aren't mitm attacks.

It's only partially true

Posted Jun 19, 2011 21:52 UTC (Sun) by kleptog (subscriber, #1183) [Link]

IMHO the big mistake with SSL was conflating the encryption with authentication. Sometimes indeed you trust the network enough (local LAN) enough not to misroute your packets, but you just don't want the bits to go unencrypted over the wire. With SSL the only way to achieve this is a self-signed certificate.

I think browsers should start recognising this use case and have a mode where they don't have the padlock, coloured URL bars, etc but still encrypt everything and don't complain. Make it look like normal HTTP. Add a cache to check the certificate against the previous one and you're all set.

Unverified certs do prevent passive attacks

Posted Jun 24, 2011 6:12 UTC (Fri) by cypherpunks (guest, #1288) [Link]

You're wrong. Unverified certs do prevent passive attacks. That's
the founding principle of public key crypto. When Alice and Bob
exchange keys and proceed to communicate, Eve can't eavesdrop unless she performs an active attack.

Why it's there in the first place, then?

Posted Jun 16, 2011 0:42 UTC (Thu) by Lennie (subscriber, #49641) [Link] (3 responses)

But why deal with selfsigned if their is a free alternative ?

StartSSL is recognised by most systems out there. Every major browsers, just not some old mobile devices.

Here are the instructions:

https://github.com/ioerror/duraconf/blob/master/startssl/...

* I'm doing some free promotion for them because I think it is cool what they do, not because I'm getting payed or anything like that.

Why it's there in the first place, then?

Posted Jun 18, 2011 7:21 UTC (Sat) by speedster1 (guest, #8143) [Link]

> But why deal with selfsigned if their is a free alternative ?

This does sound like a useful service, but an experienced admin may still choose to use self-signed for non-public servers (e.g. the imap server) because they trust their own security measures better than those of some third party CA. Or, even if their security measures are not actually better, their server is much less interesting to attackers who love to get control of a widely accepted CA... so the risk of compromise is still lower.
It was not long ago that an official certificate authority was compromised and the attackers generated untrustworthy certificates.

Why it's there in the first place, then?

Posted Jun 20, 2011 15:33 UTC (Mon) by nye (guest, #51576) [Link]

>But why deal with selfsigned if their is a free alternative ?

Well, right now:
"Due to a security breach that occurred at the 15th of June, issuance of digital certificates and related services has been suspended. Our services will remain offline until further notice."

Why it's there in the first place, then?

Posted Jun 21, 2011 21:25 UTC (Tue) by job (guest, #670) [Link]

Because if you can install the certificate manually, it is much more secure since you don't have to delegate your trust to the CA (as evidenced by the current message visible at StartSSL).

Why it's there in the first place, then?

Posted Jun 16, 2011 19:14 UTC (Thu) by iabervon (subscriber, #722) [Link]

Actually, the sensible thing is to sync your self-signed certificate from your IT-imaged desktop. A very secure policy would be: the phone will not connect to an unrecognized IMAPS server, and won't let you ignore the issue or trust the certificate from the connection, but it will let you supply the root of trust that you expect the site to have and use that instead of the usual PKI root certificates. Sure, the vast majority of people won't be able to use this to authenticate their connections, but that's because they're using gmail. People who have some person relationship with their mail servers can get the correct root of trust in advance. (This also would mean that you'd generally have a configuration where you don't trust your employer in general, but you do trust your employer to authenticate your work email server.)

WebOS: the other Linux-based mobile platform

Posted Jun 14, 2011 20:24 UTC (Tue) by Kluge (subscriber, #2881) [Link] (7 responses)

So the keyboard is small, but is it smaller or less useful than the Blackberry's? Right now, AFAICS, the options for a pocketable, fairly full-featured smartphone with a decent physical keyboard are Blackberry, Nokia (running Symbian) and maybe, HP/Palm. It would be nice to be able to buy one that was open...

WebOS: the other Linux-based mobile platform

Posted Jun 14, 2011 23:10 UTC (Tue) by skx (subscriber, #14652) [Link]

I had a Palm Pre for the past 18 months and although the keyboard was small it often received positive comments from my friends - purely for having a real keyboard.

I liked the phone. It was fatter, but smaller, than an iphone or similar device and it did just enough to be useful. I could read email, I could sync my contacts, and send messages easily.

Nowadays I have a HTC Desire. Primarily because the battery life of 4-5 days is better than that available from the pre (#1).

Everybody who ever saw the Pre seemed to like it, but despite that it wasn't a popular phone - I never saw anybody else using one in the street in the 18 months or so that I had mine.

WebOS: the other Linux-based mobile platform

Posted Jun 14, 2011 23:28 UTC (Tue) by paravoid (subscriber, #32869) [Link] (2 responses)

What about HTC Desire Z (or T-Mobile G2 in the US) and Sony Ericsson Xperia Pro?

WebOS: the other Linux-based mobile platform

Posted Jun 15, 2011 1:38 UTC (Wed) by bronson (subscriber, #4806) [Link]

The G2 was just cancelled.

http://www.tmonews.com/2011/06/t-mobile-g2-discontinued-s...

Personally, I didn't care for the G2's cramped 4-row keyboard or Z-hinge so I went for the keyboardless HTC Glacier / MyTouch 4G. Took a bit of getting used to but, I gotta say, I hardly miss a physical keyboard at all now (just for numbers, which 4-row keyboards don't have anyway).

Ah, if only someone would put the G1's keyboard in a modern phone...

WebOS: the other Linux-based mobile platform

Posted Jun 16, 2011 4:23 UTC (Thu) by Kluge (subscriber, #2881) [Link]

Thanks for the suggestions.

I'm being picky, I know (they are *personal* electronics, after all), but the big Android sliders aren't quite "pocketable" enough for my taste. Granted, they are much more suitable for email and browsing than a Blackberry bar phone, but I like having something that can sit in a pocket without being noticeable. A friend has the G2, and it's very nice, aside from the battery life. Just a little too big.

While I know Sony Ericsson isn't a *wholly* owned subsidiary of Sony, I still try to avoid any Sony-affiliated products, given their past behavior.

WebOS: the other Linux-based mobile platform

Posted Jun 15, 2011 13:50 UTC (Wed) by rillian (guest, #11344) [Link]

Perhaps my thumbs are smaller than our esteemed editor's, but I found the keyboard on the Pre 1 I had perfectly usable. For the first few hours it seemed impossibly small, but after a while I was able to type accurately without thinking about it. The keys are raised, so it's possible to press the correct one with one's fingertip without triggering adjacent keys.

I too had many positive comments on my Pre, and never saw anyone else with one. The initial version was annoyingly slow though. Hopefully that's improved in the newer versions.

WebOS: the other Linux-based mobile platform

Posted Jun 16, 2011 14:34 UTC (Thu) by wazoox (subscriber, #69624) [Link] (1 responses)

I find the Pre 1.5 keyboard perfectly usable, and I have hands large enough. It's not much different from the previous handspring/Palm keyboards, maybe very slightly smaller than the Treo 680.
However the form factor is excellent. Comparable phones are either much bigger, or lack a keyboard completely.

WebOS: the other Linux-based mobile platform

Posted Jun 18, 2011 7:28 UTC (Sat) by speedster1 (guest, #8143) [Link]

On my Pre, the keys are small but nicely separated so that you can get a feel for the keyboard pretty quickly. I use it sometimes for ssh sessions to my server; typing is not fast like a real keyboard, but not frustratingly inaccurate either.

WebOS: the other Linux-based mobile platform

Posted Jun 16, 2011 15:20 UTC (Thu) by a0321898@ti.com (guest, #74341) [Link]

Doesn't the "bogo" in "bogomips" essentially mean "bogus"? I don't really know much about bogomips, but I think this is one of those cases where it is especially misleading. I think the measurement is impacted by the cpufreq governor, which is likely ondemand, so the performance you are showing is in a low-power mode. You should expect the available "bogomips", whatever those really are, to be many times.

This really isn't that interesting of a point, but I would discourage the use of bogomips to talk about the performance of a device, despite the fact that you were saying that there is quite a bit of performance available. Some folks just might get the wrong idea if the number doesn't have some relevant meaning behind it.

WebOS: the other Linux-based mobile platform

Posted Jun 16, 2011 19:29 UTC (Thu) by iabervon (subscriber, #722) [Link] (2 responses)

The thing that makes WebOS make a lot more sense, from the odd UI to the lack of community interaction, is that it is targeted at the PalmOS user base, who don't want to change away from their late-90s PDAs and closed-source freeware apps (which were largely closed source because the authors didn't bother to distribute the source, and because the build environment was kind of ad-hoc). HP might like to make stuff more sane, but that requires dragging users into the 21st century, and the main market for these devices is really people who would rather have a Pilot than an iPhone.

WebOS: the other Linux-based mobile platform

Posted Jun 17, 2011 13:19 UTC (Fri) by marcH (subscriber, #57642) [Link] (1 responses)

Then please tell us more about these great and seamless Pilot->WebOS data migration solutions you are alluding to. I have not yet heard anything good about that.

WebOS: the other Linux-based mobile platform

Posted Jun 17, 2011 15:37 UTC (Fri) by iabervon (subscriber, #722) [Link]

Beats me; I'm still using my Treo 650. Just because HP's goal seems to be to migrate PalmOS users to WebOS seamlessly (and without having them all go to Apple or a random Android vendor) doesn't mean they're successful at it.