Palm Pre gets upgraded to 1.0.4 (update: homebrew installs via email dead for now)
By Chris Ziegler 
posted June 29th 2009 1:50PM
posted June 29th 2009 1:50PM
Update: Looks like the only changes here address security vulnerabilities -- and interestingly, Palm gives a shout-out to Townsend Ladd Harris (a Pre homebrewer no less) who helped find them. Cheers to that.
Update 2: Sadly, Palm's plugged the hole that allowed homebrew apps on the phone without a jailbreak, though software you've already installed on the phone will continue to work. The hole that's been plugged was admittedly dangerous to leave open (installing apps via a link in email), though rooting and installing otherwise remain unchanged as far as we know.
Fail.
because...?
Oh I know, because you are ugly.
Yo Face is a Fail
Yes, if you try to put it on your ifone it will fail.
Right back atcha.
If you notice, the way his avatar ("i") interacts with his text he says "i Fail"
couldn't be any closer to the truth.
WOW, APPLE ARE A-HOLE CONTROL FREAKS! I CAN'T BELIEVE THEY'RE DOING THIS! I HATESSSSS THEM!
Wait, what? This is about Palm, not Apple?
NOTHING TO SEE HERE. MOVE ALONG.
Quix, were all those capitals a compensatory measure for lack of substance?
I hope this update allows for turning on/off task syncing. Both e-mail and calendars have a preferences menu item where you can turn the syncing on or off. I don't want to be reminded about my work tasks on saturday morning!
Lemmings, the lot of you.
@iLoveApple
I think you're being a bit too obvious. Seriously, saying that on the first post of a Pre article with your name and avatar is simply begging for trouble.
No, it's more like offering a million dollars in exchange for trouble. And imagining for a moment that you actually intended to say something rational, I fail to see how Palm providing upgrades to fix security holes is different from Apple doing the same thing.
Tehre
I like updates.
also if u guys didnt notice and im shure u all did .. whats with sprint 1.5 going to 1.6.
Is it over-the-air update?
All updates are OTA.
(hates the comment system, that of course was suppose to go above)
yeah says so right there, no not there up abit.
they all are
You don't read too well, do you?
Or, perhaps you're one of those "reading is for losers" types.
the updates supposedly closes the ability to install apps by the email method. So you either update now or you update later when the phone does it for you.
Hurry up and release some more apps or publish a full SDK so i dont have to continue playing the cat and mouse game..
Or you could hold your horses and wait for the SDK to be officially released.
If you didn't like the game you wouldn't be playing it right now.
Version information
■Version: 1.0.4
■Release date: 29 June 2009
■Configuration: Sprint 1.6
New applications
No new applications in update 1.0.4
Feature changes to existing applications
This release addresses several security issues with Palm webOS software.
Note We'd like to thank Townsend Ladd Harris for his help in identifying some of the issues addressed in this release. Individuals interested in contacting Palm to report suspected security issues can find more information at palm.com/security.
http://kb.palm.com/wps/portal/kb/na/pre/p100eww/sprint/solutions/article/50607_en.html#N0674ECC8.0674F194
Seems pretty Apple-esque to me. Releasing more firmware so the jailbreaking devs have to do it all over again. It's a never-ending cycle, and the jailbreakers will always win, so why try Palm? Just let the Pre owners have their homebrew apps already!
You missed the point.
They probably will eventually, the current way of installing homebrew needed a fix first anyway. They even gave Palm the code to add a approval before installing apps through an email link. I hope they implement it.
Problem is, the email method is insecure. It installs without any user acknowledgment, meaning simply clicking a link in the email could install an app that could do all kinds of bad things. Imagine if simply clicking on a link to an exe in Outlook would run it without ever even mentioning it was doing anything. It doesn't even take you to another page, an icon just appears in you applications launcher.
did outlook express used to do that with certain mime type?
It fixes a security hole that lets you send an app through e-mail. You can still put on apps if you log in via USB.
There is not much of a "jail" to be broken on the Pre. You enter a code and connect with a program. Its not like the firmware has to be modified or anything. It takes like 2 seconds to get in if you have the terminal software installed.
That'd be +tharris, of Pre Dev Wiki fame, I think. One of the lead homebrew dev's. So far the homebrew community and Palm have been playing very nice and polite together, IMO.
The hole plugged here was that apps linked to in emails would install with no security checks or even dialogs - a gaping hole with legitimate security implications and opportunity for harm to end users.
AFAIK, the Pre's still stupid easy to root and run whatever you want on, this update doesn't break that.
The bug was actually found by some guy whos working on homebrew stuff for the pre.
I really like OTA update and it seem went well speed on Evo
Sprint is dictating the rules to Palm for now which is why homebrew apps, 3rd party apps, tethering, etc. are all being taken away.
The same thing happens with Apple and AT&T.
Ditto to what Brian Goode said. They're not taking away developer mode for folks that want it or making it less stupid-easy to get into. They're just correcting the real problem that the Pre's e-mail program would install arbitrary software on a non-rooted phone -- like an olde-tyme e-mail program happily opening an .exe.
Et tu, Sprint?
please get your facts straight. homebrew isn't dead. Now that the SDK is everywhere, you can use that to install homebew apps, it's quite easy. and now people have a reason to create an app installer app. expect it soon.
all this did was close the email install "feature", which is a good thing, to keep malicious code out.
I switched to sprint for the pre yesterday, and so far It's been great, besides the lack of apps.
Engadget,
Please do not refer to "rooting" the Palm Pre as "jailbreaking." It's not a damned iPhone!!!
What's your point? Jailbreaking as a term isn't iPhone-specific. The same term is used, for example, when referring to the act of breaking out of a *nix chroot jail (a similar concept from the mile-high level) And it would seem to be the correct term in this instance.
Saying that this shouldn't be called jailbreaking is akin to saying "Don't call the Pre a 'telephone', it's not a damned iPhone!"
What exactly is the point of locking down the OS so much? It can't be the carriers, because they let Windows Mobile run free
Seriously, until Palm, Apple, or Google get their act together, Microsoft is going to keep getting my business
how exactly does winmo run free? it runs free for all of about 2 minutes before the battery is dead, and that is assuming it hasn't crashed 15 times during those few minutes it had battery.
dont worry, you can stay with microsoft. we don't want you anyways.
Awww, how cute, someone is trying to tie all exaggerated downsides of a platform into one little post.
They probably figure most people with WM phones won't figure out how to use any of the functionality. I'm 100% serious about that too -- not a joke. Newer SmartPhones with good UIs, easy to use app stores, good modern web browsers, etc are pretty heavily utilized by consumers. Many WM phones are checking an Exchange server all day -- nothing more, nothing less.
Had a feeling there'd be an update
Now only waiting for a more substantial one
This is a lot worse than Apple's plugging holes via updates. This is installed automatically, so you have no choice whether to keep the old software with your hacks or the new software that plugs the hole. What's to stop them from locking out homebrew software (or any unauthorized software) via automatic update?
palm is pretty down on their game if the update can't prevent the further use of already installed homebrew apps. not saying thats a good thing they can't, but...
Maybe Palm doesn't mind the installed apps? They closed a vulnerability than can be pretty dangerous- installing apps by clicking on a link. Palm seems to be pretty ok with homebrew so far.
"We'll download it over the next couple of days..." Gaaaaaaaaaaaaaaah.
"over the next couple of days"... I'd much rather just download that small 12MB right then and get the update over with, haha
You realize you can run the update manually, right?