Palm Pre gets upgraded to 1.0.4 (update: homebrew installs via email dead for now)

We don't know exactly what's new yet, but Palm's released firmware version 1.0.4 for Pres on Sprint (not to say there are any other Pres out there at the moment, anyhow). Stay tuned for details.

Update: Looks like the only changes here address security vulnerabilities -- and interestingly, Palm gives a shout-out to Townsend Ladd Harris (a Pre homebrewer no less) who helped find them. Cheers to that.

Update 2: Sadly, Palm's plugged the hole that allowed homebrew apps on the phone without a jailbreak, though software you've already installed on the phone will continue to work. The hole that's been plugged was admittedly dangerous to leave open (installing apps via a link in email), though rooting and installing otherwise remain unchanged as far as we know.

[iLoveApple @ Jun 29th 2009 1:55PM]

Fail.

[Malweran @ Jun 29th 2009 1:55PM]

because...?

Oh I know, because you are ugly.

[jjbecerra909 @ Jun 29th 2009 2:03PM]

Yo Face is a Fail

[Dayne @ Jun 29th 2009 1:57PM]

Yes, if you try to put it on your ifone it will fail.

[Loonie @ Jun 29th 2009 2:01PM]

Right back atcha.

[agroupofletters @ Jun 29th 2009 3:43PM]

If you notice, the way his avatar ("i") interacts with his text he says "i Fail"

couldn't be any closer to the truth.

[Quix @ Jun 29th 2009 4:10PM]

WOW, APPLE ARE A-HOLE CONTROL FREAKS! I CAN'T BELIEVE THEY'RE DOING THIS! I HATESSSSS THEM!

Wait, what? This is about Palm, not Apple?

NOTHING TO SEE HERE. MOVE ALONG.

[Loonie @ Jun 29th 2009 4:22PM]

Quix, were all those capitals a compensatory measure for lack of substance?

[Kevin @ Jun 29th 2009 4:27PM]

I hope this update allows for turning on/off task syncing. Both e-mail and calendars have a preferences menu item where you can turn the syncing on or off. I don't want to be reminded about my work tasks on saturday morning!

[logicbomb.de @ Jun 29th 2009 5:30PM]

Lemmings, the lot of you.

[ED @ Jun 29th 2009 7:21PM]

@iLoveApple
I think you're being a bit too obvious. Seriously, saying that on the first post of a Pre article with your name and avatar is simply begging for trouble.

No, it's more like offering a million dollars in exchange for trouble. And imagining for a moment that you actually intended to say something rational, I fail to see how Palm providing upgrades to fix security holes is different from Apple doing the same thing.

[Greg @ Jun 29th 2009 1:56PM]

Tehre

[William Bennett @ Jun 29th 2009 1:57PM]

I like updates.

[Fir3lord @ Jun 29th 2009 2:15PM]

also if u guys didnt notice and im shure u all did .. whats with sprint 1.5 going to 1.6.

[pika2000 @ Jun 29th 2009 2:00PM]

Is it over-the-air update?

[Templarian @ Jun 29th 2009 2:10PM]

All updates are OTA.

[Templarian @ Jun 29th 2009 2:11PM]

(hates the comment system, that of course was suppose to go above)

[GingerFox @ Jun 29th 2009 2:45PM]

yeah says so right there, no not there up abit.

[joshua @ Jun 29th 2009 2:46PM]

they all are

[TomServo @ Jun 29th 2009 5:29PM]

You don't read too well, do you?

Or, perhaps you're one of those "reading is for losers" types.

[Neeko @ Jun 29th 2009 2:00PM]

the updates supposedly closes the ability to install apps by the email method. So you either update now or you update later when the phone does it for you.

Hurry up and release some more apps or publish a full SDK so i dont have to continue playing the cat and mouse game..

[Forrest @ Jun 29th 2009 4:36PM]

Or you could hold your horses and wait for the SDK to be officially released.

If you didn't like the game you wouldn't be playing it right now.

[Gipionocheiyort @ Jun 29th 2009 2:00PM]

Version information
■Version: 1.0.4
■Release date: 29 June 2009
■Configuration: Sprint 1.6
New applications
No new applications in update 1.0.4

Feature changes to existing applications
This release addresses several security issues with Palm webOS software.

Note We'd like to thank Townsend Ladd Harris for his help in identifying some of the issues addressed in this release. Individuals interested in contacting Palm to report suspected security issues can find more information at palm.com/security.



http://kb.palm.com/wps/portal/kb/na/pre/p100eww/sprint/solutions/article/50607_en.html#N0674ECC8.0674F194

[Zachary Boe @ Jun 29th 2009 2:09PM]

Seems pretty Apple-esque to me. Releasing more firmware so the jailbreaking devs have to do it all over again. It's a never-ending cycle, and the jailbreakers will always win, so why try Palm? Just let the Pre owners have their homebrew apps already!

[godisgov @ Jun 29th 2009 5:14PM]

You missed the point.

[Templarian @ Jun 29th 2009 2:14PM]

They probably will eventually, the current way of installing homebrew needed a fix first anyway. They even gave Palm the code to add a approval before installing apps through an email link. I hope they implement it.

[Danial @ Jun 29th 2009 2:20PM]

Problem is, the email method is insecure. It installs without any user acknowledgment, meaning simply clicking a link in the email could install an app that could do all kinds of bad things. Imagine if simply clicking on a link to an exe in Outlook would run it without ever even mentioning it was doing anything. It doesn't even take you to another page, an icon just appears in you applications launcher.

[Puggs @ Jun 29th 2009 2:43PM]

did outlook express used to do that with certain mime type?

[joshua @ Jun 29th 2009 2:49PM]

It fixes a security hole that lets you send an app through e-mail. You can still put on apps if you log in via USB.

There is not much of a "jail" to be broken on the Pre. You enter a code and connect with a program. Its not like the firmware has to be modified or anything. It takes like 2 seconds to get in if you have the terminal software installed.

[Brian Goode @ Jun 29th 2009 2:17PM]

That'd be +tharris, of Pre Dev Wiki fame, I think. One of the lead homebrew dev's. So far the homebrew community and Palm have been playing very nice and polite together, IMO.

The hole plugged here was that apps linked to in emails would install with no security checks or even dialogs - a gaping hole with legitimate security implications and opportunity for harm to end users.

AFAIK, the Pre's still stupid easy to root and run whatever you want on, this update doesn't break that.

[Nomi @ Jun 29th 2009 2:25PM]

The bug was actually found by some guy whos working on homebrew stuff for the pre.

[Blu-Sam @ Jun 29th 2009 2:27PM]

I really like OTA update and it seem went well speed on Evo

[htowngator @ Jun 29th 2009 2:30PM]

Sprint is dictating the rules to Palm for now which is why homebrew apps, 3rd party apps, tethering, etc. are all being taken away.

The same thing happens with Apple and AT&T.

[two2twotwo22two2 @ Jun 29th 2009 2:31PM]

Ditto to what Brian Goode said. They're not taking away developer mode for folks that want it or making it less stupid-easy to get into. They're just correcting the real problem that the Pre's e-mail program would install arbitrary software on a non-rooted phone -- like an olde-tyme e-mail program happily opening an .exe.

[JamesR @ Jun 29th 2009 2:32PM]

Et tu, Sprint?

[Jonyah @ Jun 29th 2009 2:35PM]

please get your facts straight. homebrew isn't dead. Now that the SDK is everywhere, you can use that to install homebew apps, it's quite easy. and now people have a reason to create an app installer app. expect it soon.

all this did was close the email install "feature", which is a good thing, to keep malicious code out.

[AlDeezy @ Jun 29th 2009 2:49PM]

I switched to sprint for the pre yesterday, and so far It's been great, besides the lack of apps.

[tweak @ Jun 29th 2009 2:50PM]

Engadget,

Please do not refer to "rooting" the Palm Pre as "jailbreaking." It's not a damned iPhone!!!

[Adam Zey @ Jun 29th 2009 3:21PM]

What's your point? Jailbreaking as a term isn't iPhone-specific. The same term is used, for example, when referring to the act of breaking out of a *nix chroot jail (a similar concept from the mile-high level) And it would seem to be the correct term in this instance.

Saying that this shouldn't be called jailbreaking is akin to saying "Don't call the Pre a 'telephone', it's not a damned iPhone!"

[EGOvoruhk @ Jun 29th 2009 2:51PM]

What exactly is the point of locking down the OS so much? It can't be the carriers, because they let Windows Mobile run free

Seriously, until Palm, Apple, or Google get their act together, Microsoft is going to keep getting my business

[oneMadRssn @ Jun 29th 2009 3:14PM]

how exactly does winmo run free? it runs free for all of about 2 minutes before the battery is dead, and that is assuming it hasn't crashed 15 times during those few minutes it had battery.

dont worry, you can stay with microsoft. we don't want you anyways.

[Brandon @ Jun 29th 2009 3:22PM]

Awww, how cute, someone is trying to tie all exaggerated downsides of a platform into one little post.

[Sinister Joe @ Jun 29th 2009 3:36PM]

They probably figure most people with WM phones won't figure out how to use any of the functionality. I'm 100% serious about that too -- not a joke. Newer SmartPhones with good UIs, easy to use app stores, good modern web browsers, etc are pretty heavily utilized by consumers. Many WM phones are checking an Exchange server all day -- nothing more, nothing less.

[Gi @ Jun 29th 2009 3:11PM]

Had a feeling there'd be an update
Now only waiting for a more substantial one

[DT @ Jun 29th 2009 3:36PM]

This is a lot worse than Apple's plugging holes via updates. This is installed automatically, so you have no choice whether to keep the old software with your hacks or the new software that plugs the hole. What's to stop them from locking out homebrew software (or any unauthorized software) via automatic update?

[Art @ Jun 29th 2009 4:17PM]

palm is pretty down on their game if the update can't prevent the further use of already installed homebrew apps. not saying thats a good thing they can't, but...

[oddlou @ Jun 29th 2009 4:18PM]

Maybe Palm doesn't mind the installed apps? They closed a vulnerability than can be pretty dangerous- installing apps by clicking on a link. Palm seems to be pretty ok with homebrew so far.

[Jamus @ Jun 29th 2009 4:28PM]

"We'll download it over the next couple of days..." Gaaaaaaaaaaaaaaah.

[iFargle @ Jun 29th 2009 4:29PM]

"over the next couple of days"... I'd much rather just download that small 12MB right then and get the update over with, haha

[paultakeda @ Jun 29th 2009 6:30PM]

You realize you can run the update manually, right?