frontpage.
newsnewestaskshowjobs

Made with ♥ by @iamnishanth

Open Source @Github

fp.

Open in hackernews

OnePlus update blocks downgrades and custom ROMs by blowing a fuse

https://consumerrights.wiki/w/Oneplus_phone_update_introduces_hardware_anti-rollback
162•validatori•1h ago

Comments

raizer88•1h ago
You either die a hero, or live long enough to see yourself become the villain
Raed667•47m ago
I think the writing has been on the wall since they started their Nord line.
alluro2•36m ago
Do you mean because the previous "flagship killer" company now needed a "flagship killer" sub-brand, since they could no longer be categorised as such?
Raed667•35m ago
Exactly, why did they end up in a situation where they are making killers of their "main" phones ?
zozbot234•20m ago
Because all midrange phones are "flagship killers" on a features basis now, flagships are just about the exclusivity. The market has adapted and the term no longer makes much sense. OnePlus still leads on custom ROM support though, e.g. no special codes or waiting times needed for unlocking the bootloader, it all works out of the box with standard commands.
Sebb767•33m ago
What was the issue with the Nord line?
jsheard•9m ago
I think the turning point was when they stopped developing their own Android distro and started using a variant of Oppo's ColorOS. OnePlus was always affiliated with Oppo, but at that point they lost any semblance of independence and turned into an Oppo sub-brand.
Retr0id•49m ago
Blind speculation: I wonder if this is in some way related to DRM getting broken at a firmware level, leading to a choice being made between "users complain that they can't watch netflix" and "users complain that they can't install custom ROMs".
dcdc123•33m ago
It was because a method was discovered to bypass the lockout of stolen devices.
userbinator•8m ago
In other words the same old boogeyman they always use to justify this crap.
IshKebab•48m ago
Why? What advantage do they get from this? I'm assuming it's not a good one but I'm struggling to see what it is at all.
hexagonwin•36m ago
They can kill custom roms and force the latest vendor firmware. If they push a shitty update that slows down the phone or something, users have no choice other than buying a new device.
bcraven•30m ago
The article suggests custom roms can just be updated to be 'newer' than this.

At the moment they're 'older' and would class as a rollback, which this fuse prevents.

WaitWaitWha•47m ago
Is this for just one or several OnePlus models?

If so, is this 'fuse' per-planned in the hardware? My understanding is cell phones take 12 to 24 months from design to market. so, initial deployment of the model where this OS can trigger the 'fuse' less one year is how far back the company decided to be ready to do this?

TomatoCo•42m ago
Lots of CPUs that have secure enclaves have a section of memory that can be written to only once. It's generally used for cryptographic keys, serials, etcetera. It's also frequently used like this.
scbzzzzz•46m ago
What do OnePlus gain from this? Can someone explain me what are the advantages of OnePlus doing all this? A failed update resulting in motherboard replacement? More money, more shareholders are happy?

I still sometimes ponder if oneplus green line fiasco is a failed hardware fuse type thing that got accidentally triggered during software update. (Insert I can't prove meme here).

TomatoCo•40m ago
My understanding is there was a bug that let you wipe and re-enable a phone that had been disabled due to theft. This prevents a downgrade attack. It's in OnePlus's interest to make their phones less appealing for theft, or, in their interest to comply with requirements to be disableable from carriers, Google, etc.
scbzzzzz•30m ago
Make perfect sense, Thanks kind stranger. Hope it is the reason and not some corporate greed. It on me, lately my thoughts are defaulted towards corporates sabotaging consumers. I need to work on it.

The effects on custom os community is causing me worried ( I am still rocking my oneplus 7t with crdroid and oneplus used to most geek friendly) Now I am wondering if there are other ways they could achieved the same without blowing a fuse or be more transparent about this.

zozbot234•26m ago
I don't think so. Blowing a fuse is just how the "no downgrades" policy for firmware is implemented. No different for other vendors actually, though the software usually warns you prior to installing an update that can't be manually rolled back.
chasil•14m ago
Are you quite certain?

Google pushed a non-downgradable final update to the Pixel 6a.

I was able to install Graphene on such a device. Lineage was advertised and completely incompatible, but some hinted it would work.

cess11•14m ago
As I understand it, this is a similar thing on Samsung handhelds:

https://en.wikipedia.org/wiki/Samsung_Knox

itsdesmond•8m ago
> It on me, lately my thoughts are defaulted towards corporates sabotaging consumers. I need to work on it.

You absolutely do not, this is an extremely healthy starting position for evaluating a corporations behavior. Any benefit you receive is incidental, if they made more money by worsening your experience they would.

wnevets•22m ago
> My understanding is there was a bug that let you wipe and re-enable a phone that had been disabled due to theft. This prevents a downgrade attack.

This makes sense and much less dystopia than some of the other commenters are suggesting.

Zigurd•4m ago
Carriers can check a registry of stolen phone IMEIs and block them from their networks.
rvnx•40m ago
It is the same concept on an iPhone, you have 7 days to downgrade, then it is permanently impossible. Not for technical reasons, but because of an arbitrary lock (achieved through signature).

OnePlus just chose the hardware way, versus Apple the signature way

Whether for OnePlus or Apple, there should definitively be a way to let users sign and run the operating system of their choice, like any other software.

(still hating this iOS 26, and the fact that even after losing all my data and downgrading back iOS 18 it refused to re-sync my Apple Watch until iOS 26 was installed again, shitty company policy)

drnick1•5m ago
> What do OnePlus gain from this? Can someone explain me what are the advantages of OnePlus doing all this?

They don't want the hardware to be under your control. In the mind of tech executives, selling hardware does not make enough money, the user must stay captive to the stock OS where "software as a service" can be sold, and data about the user can be extracted.

syntaxing•45m ago
OnePlus has pretty much become irrelevant since Carl Pei left the company. Its more or less just a rebranded Oppo nowadays. I'm not an android user anymore but I'm rooting for his new(ish) Nothing company. Hopefully it carries the torch for the old OnePlus feel.
Raed667•35m ago
As an early OnePlus user (1, 3, 5, 7, 13) i find myself unimpressed with what Nothing is proposing, feels more like a design exercise than a flagship killer
skeledrew•12m ago
I've been with OnePlus since the beginning, and am not at all impressed by the Nothing. Primary missing feature which I've come to depend on, off screen gestures, is missing. And the device just comes across as foreign in general; makes me think of the iPhone, which is not something I want to think of.
opan•10m ago
They consistently have allowed bootloader unlocking without extra fuss and have had good LineageOS support. That is their main appeal, IMO. Nothing phones had no LineageOS support until recently (spacewar is now supported, unsure about other models), and it's not clear if there's enough of a community/following to keep putting LineageOS on them. I do not want any phone where I'm stuck with the stock ROM.
bflesch•44m ago
How likely is it that such software-activated fuse-based kill switches are built into iPhones? Any insights?
jacquesm•41m ago
I'd say for commercial hardware it is a near certainty even if you won't ever know until it is much too late.

Realize that many of these manufacturers sell their hardware in and employ companies in highly policed societies. Just the fact that they are allowed to continue to operate implies that they are playing ball and may well have to perform a couple of favors. And that's assuming they are fully aware of what they are shipping, which may not be always the case.

I don't think it is a bad model at all to consider any cell phone to be compromised in multiple ways even though you don't have hard proof.

hexagonwin•40m ago
iPhones already cannot be downgraded, they can only install OS versions signed by apple during the install time. (search SHSH blobs) They also can't run unsigned IPA files (apps). Not sure if they have a physical fuse, but it's not much different.
hoistbypetard•18m ago
The significant difference is that if it were placed into DFU mode and connected to an appropriate device that had access to appropriately signed things, it could be "unbricked" without replacing the mainboard.
Retr0id•38m ago
The M-series CPUs found in iPads (which cannot boot custom payloads) are the same as the M-series CPUs found in Macbooks (which can boot custom payloads) - just with different fuses pre-burnt during manufacturing.

Pre-prod (etc.) devices will also have different fuses burnt.

mort96•18m ago
So this article isn't about a kill switch, just blocking downgrades and custom ROMs.

But to answer your question: we know iPhones have a foolproof kill switch, it's a feature. Just mark your device as lost in Find My and it'll be locked until someone can provide your login details. Assuming it requires logging in to your Apple account (which it does, AFAIK; I don't think logging in to a local account is enough), this is the same as a remote kill switch; Apple could simply make a device enter this locked-down state and then tweak their server systems to deny logins.

tripdout•44m ago
> When the device powers on, the Primary Boot Loader in the processor's ROM loads and verifies the eXtensible Boot Loader (XBL). XBL reads the current anti-rollback version from the Qfprom fuses and compares it against the firmware's embedded version number. If the firmware version is lower than the fuse value, boot is rejected. When newer firmware successfully boots, the bootloader issues commands through Qualcomm's TrustZone to blow additional fuses, permanently recording the new minimum version

What exactly is it comparing? What is the “firmware embedded version number”? With an unlocked bootloader you can flash boot and super (system, vendor, etc) partitions, but I must be missing something because it seems like this would be bypassable.

It does say

> Custom ROMs package firmware components from the stock firmware they were built against. If a user's device has been updated to a fused firmware version & they flash a custom ROM built against older firmware, the anti-rollback mechanism triggers immediately.

and I know custom ROMs will often say “make sure you flash stock version x.y beforehand” to ensure you’re on the right firmware, but I’m not sure what partitions that actually refers to (and it’s not the same as vendor blobs), or how much work it is to either build a custom ROM against a newer firmware or patch the (hundreds of) vendor blobs.

jacquesm•44m ago
This goes beyond the 'right to repair' to simply the right of ownership. These remote updates prove again and again that even though you paid for something you don't actually own it.
mystraline•16m ago
Indeed.

My ownership is proved by my receipt from the store I bought it from.

This vandalization at scale is a CFAA violation. I'd also argue it is a fraudulent sale since not all rights were transferred at sale, and misrepresented a sale instead of an indefinite rental.

And its likely a RICO act, since the C levels and BOD likely knew and/or ordered it.

And damn near everything's wire fraud.

But if anybody does manage to take them to court and win, what would we see? A $10 voucher for the next Oneplus phone? Like we'd buy another.

bloomingeek•4m ago
It's basically the same for our automobiles, just try to disable the "phone home" parts connected to the fin on the roof. Do we really own out cars if we can't stop the manufacturer from telling us we need to change our oil through email?
hypeatei•43m ago
It's my first time hearing about this "eFuse" functionality in Qualcomm CPUs. Are there non-dystopian uses for this as a manufacturer?
Retr0id•40m ago
eFuses are in most CPUs, often used for things like disabling hardware debug interfaces in production devices - and rollback prevention.
hexagonwin•38m ago
Samsung uses this for their Knox security feature. The fuse gets broken in initial bootloader unlock, and all features related to Knox (Samsung Pay, Secure Folder, etc) gets disabled permanently even after reverting to stock firmware.
thesh4d0w•35m ago
I use them in an esp32 to write a random password to each of my products, so when I sell them they can each have their own secure default wifi password while all using the same firmware.
zozbot234•38m ago
According to OP this does not disable bootloader unlocking in itself. It makes the up-versioned devices incompatible with all previous custom ROMs, but it should be possible to develop new ROM releases that are fully compatible with current eFuse states and don't blow the eFuse themselves.
charcircuit•30m ago
This is industry standard. Flashing old updates that are insecure to bypass security is a legitimate attack vector that needs to be defended against. Ideally it would still be possible up recover from such a scenario by flashing the latest update.
mystraline•20m ago
Its high time we start challenging these sorts of actions as the "vandalization and sabotage at scale" that these attacks really are. I dont see how these aren't a direct violation of the CFAA, over millions of customer-owned hardware.

They are no different than some shit ransomware, except there is no demand for money. However, there is a demonstrable proof of degradation and destruction of property in all these choices.

Frankly, criminal AND civil penalties should be levied. Criminally, the C levels and boars of directors should all be in scope as to encouraging/allowing/requiring this behavior. RICO act as well, since this smells like a criminal conspiracy. Let them spend time in prison for mass destruction of property.

Civally, start dissolving assets until the people are made whole with unbroken (and un-destroyed) hardware.

The next shitty silly-con valley company thinks about running this scam of 'customer-bought but forever company owned', will think long and hard about the choices of their network and cloud.

skeledrew•6m ago
> no demand for money

There is when the device becomes hard bricked and triggers an unnecessary need for a new one.

skeledrew•20m ago
This is absolutely cracked. I've been with OnePlus since the One, also getting the 2, 6 and now I have the 12. Stuck with them all these years because I really respected their - original - take on device freedom. I really should've seen the writing on the wall given how much pain it is to update it in the first place, as I have the NA version which only officially allows carrier updates, and I don't live in NA (and even if I did I'd still not be tied to a carrier).

Now I have to consider my device dead re updates, because if I haven't already gotten the killing update I'd rather avoid it. First thing I did was unlock the bootloader, and I intend to root/flash it at some point. Will be finding another brand whenever I'm ready to upgrade again.

dataflow•5m ago
[delayed]
RugnirViking•17m ago
isnt this just like... vandalism? nothing could give them the right to do this, they're damaging others property indescriminately.
jijji•9m ago
im sure that is not going to improve their sales numbers
pengaru•5m ago
Glad I didn't give these people any of my hard earned dollars.
userbinator•3m ago
I'm not sure if this is the case anymore, but many unbranded/generic Androids used to be completely unlocked by default (especially Mediatek SoCs) and nearly unbrickable, and that's what let the modding scene flourish. I believe they had efuses too, but software never used them.

Show HN: Wächter – Traffic shaping and monitoring for Linux

https://github.com/univrsal/waechter
1•univrsal•47s ago•0 comments

Show HN: Protogen Beta

https://github.com/jzkool/Aetherius-sGiftsToHumanity/blob/main/Architectural%20Software/protogen_...
1•hiddenarchitect•1m ago•0 comments

The passive in English (2011)

https://languagelog.ldc.upenn.edu/nll/?p=2922
2•penetralium•1m ago•0 comments

Apple Mac turns 42 and we still are still using the same user paradigm

https://www.tomshardware.com/software/macos/the-apple-mac-turned-42-this-weekend-we-are-still-usi...
2•heresie-dabord•5m ago•0 comments

When two years of academic work vanished with a single click

https://www.nature.com/articles/d41586-025-04064-7
2•wawayanda•11m ago•0 comments

Munros, Corbetts, Grahams and Donalds: What's the Difference?

https://www.thehighlandmountaincompany.co.uk/post/munros-corbetts-grahams-and-donalds-what-s-the-...
1•RicoElectrico•11m ago•0 comments

A high-performance, minimalist visual board for spatial thinkers

https://vb.lokryn.com
1•jen_lokryn•13m ago•1 comments

A Codebase by an Agent for an Agent

https://ampcode.com/by-an-agent-for-an-agent
1•pbshgthm•16m ago•0 comments

Show HN: Ghostree is a Ghostty fork with worktree management built in

https://github.com/sidequery/ghostree
2•nicoritschel•17m ago•1 comments

Python 3.14 Remote Debugging and Claude Code = Pwnage

https://github.com/promptromp/python-remote-debug-skill
2•adamhadani•17m ago•1 comments

Show HN: Computer Chronicles

https://computerchronicles.tv
1•LeoPanthera•20m ago•0 comments

LED lighting undermines visual performance unless supplemented by wider spectra

https://www.nature.com/articles/s41598-026-35389-6
10•bookofjoe•20m ago•0 comments

What the world can learn from Paris's cycling revolution

https://momentummag.com/what-the-world-can-learn-from-pariss-cycling-revolution/
3•fanf2•23m ago•0 comments

Spreadsheets and Vi and JSON

https://awalgarg.me/untitled_project
2•todsacerdoti•23m ago•0 comments

Sagas (2012)

https://vasters.com/archive/Sagas.html
1•locknitpicker•23m ago•0 comments

Cori – Give agents safe DB write access without raw SQL (open source in Rust)

https://github.com/cori-do/cori-kernel
2•bringitup•23m ago•1 comments

UK to reimburse visa fees for AI and quantum researchers

https://www.timeshighereducation.com/news/uk-reimburse-visa-fees-ai-and-quantum-researchers
1•rbanffy•24m ago•0 comments

House of Lords votes for under-16s social media ban

https://www.computing.co.uk/news/2026/legislation-regulation/peers-vote-for-under-16-social-media...
2•rbanffy•25m ago•2 comments

Hand-Crafting Domain-Specific Compression with an LLM

https://engineering.nanit.com/hand-crafting-domain-specific-compression-with-an-llm-3c42f5c2b070
1•miedwar•28m ago•0 comments

RAG for Legacy Systems: 7,432 Pages to 3s Answers

https://clouatre.ca/posts/rag-legacy-systems/
3•french_exec•33m ago•0 comments

WorldChaosMap: A live map of global instability

https://www.worldchaosmap.app/
2•shawsuraj•33m ago•1 comments

VPN Comparison Spreadsheet

https://old.reddit.com/r/rateVPNs/comments/1gw58mk/the_ultimate_vpn_comparison_spreadsheet/
1•scapecast•35m ago•0 comments

Show HN: A lightweight, native macOS menubar app for monitoring with mini graphs

https://github.com/bluewave-labs/systempulse
1•gorkemcetin•36m ago•0 comments

Software Design Principles That Matter

https://newsletter.francofernando.com/p/software-design-principles-that-matter
2•rmason•37m ago•1 comments

The '3.5% rule': How a small minority can change the world

https://www.bbc.com/future/article/20190513-it-only-takes-35-of-people-to-change-the-world
14•choult•37m ago•1 comments

Watch This Futuristic Windshield Melt Ice Almost Instantly

https://www.thedrive.com/news/watch-this-futuristic-windshield-melt-ice-almost-instantly
2•PaulHoule•38m ago•0 comments

Gemba

https://en.wikipedia.org/wiki/Gemba
1•wjb3•39m ago•0 comments

PickYourVC: Find the right VC for your next round

https://pickyourvc.com/
1•panrobo•40m ago•1 comments

Semantic Attacks: Exploiting What Agents See

https://niyikiza.substack.com/p/semantic-attacks-exploiting-what
1•niyikiza•40m ago•1 comments

Guinness Adverts Project on Irish Film Institute's Archive Player

https://www.irishcentral.com/culture/guinness-adverts-project-irish-film-institute
1•gnabgib•40m ago•0 comments