Palm Pre gets upgraded to 1.0.4 (update: homebrew installs via email dead for now)
By Chris Ziegler 
posted Jun 29th 2009 1:50PM
posted Jun 29th 2009 1:50PM
Update: Looks like the only changes here address security vulnerabilities -- and interestingly, Palm gives a shout-out to Townsend Ladd Harris (a Pre homebrewer no less) who helped find them. Cheers to that.
Update 2: Sadly, Palm's plugged the hole that allowed homebrew apps on the phone without a jailbreak, though software you've already installed on the phone will continue to work. The hole that's been plugged was admittedly dangerous to leave open (installing apps via a link in email), though rooting and installing otherwise remain unchanged as far as we know.
Fail.
because...?
Oh I know, because you are ugly.
Yo Face is a Fail
Yes, if you try to put it on your ifone it will fail.
Right back atcha.
If you notice, the way his avatar ("i") interacts with his text he says "i Fail"
couldn't be any closer to the truth.
WOW, APPLE ARE A-HOLE CONTROL FREAKS! I CAN'T BELIEVE THEY'RE DOING THIS! I HATESSSSS THEM!
Wait, what? This is about Palm, not Apple?
NOTHING TO SEE HERE. MOVE ALONG.
Quix, were all those capitals a compensatory measure for lack of substance?
I hope this update allows for turning on/off task syncing. Both e-mail and calendars have a preferences menu item where you can turn the syncing on or off. I don't want to be reminded about my work tasks on saturday morning!
Lemmings, the lot of you.
@iLoveApple
I think you're being a bit too obvious. Seriously, saying that on the first post of a Pre article with your name and avatar is simply begging for trouble.
No, it's more like offering a million dollars in exchange for trouble. And imagining for a moment that you actually intended to say something rational, I fail to see how Palm providing upgrades to fix security holes is different from Apple doing the same thing.
Tehre
I like updates.
also if u guys didnt notice and im shure u all did .. whats with sprint 1.5 going to 1.6.
Is it over-the-air update?
All updates are OTA.
(hates the comment system, that of course was suppose to go above)
yeah says so right there, no not there up abit.
they all are
You don't read too well, do you?
Or, perhaps you're one of those "reading is for losers" types.
the updates supposedly closes the ability to install apps by the email method. So you either update now or you update later when the phone does it for you.
Hurry up and release some more apps or publish a full SDK so i dont have to continue playing the cat and mouse game..
Or you could hold your horses and wait for the SDK to be officially released.
If you didn't like the game you wouldn't be playing it right now.
Version information
■Version: 1.0.4
■Release date: 29 June 2009
■Configuration: Sprint 1.6
New applications
No new applications in update 1.0.4
Feature changes to existing applications
This release addresses several security issues with Palm webOS software.
Note We'd like to thank Townsend Ladd Harris for his help in identifying some of the issues addressed in this release. Individuals interested in contacting Palm to report suspected security issues can find more information at palm.com/security.
http://kb.palm.com/wps/portal/kb/na/pre/p100eww/sprint/solutions/article/50607_en.html#N0674ECC8.0674F194
Seems pretty Apple-esque to me. Releasing more firmware so the jailbreaking devs have to do it all over again. It's a never-ending cycle, and the jailbreakers will always win, so why try Palm? Just let the Pre owners have their homebrew apps already!
You missed the point.
They probably will eventually, the current way of installing homebrew needed a fix first anyway. They even gave Palm the code to add a approval before installing apps through an email link. I hope they implement it.
Problem is, the email method is insecure. It installs without any user acknowledgment, meaning simply clicking a link in the email could install an app that could do all kinds of bad things. Imagine if simply clicking on a link to an exe in Outlook would run it without ever even mentioning it was doing anything. It doesn't even take you to another page, an icon just appears in you applications launcher.
did outlook express used to do that with certain mime type?
It fixes a security hole that lets you send an app through e-mail. You can still put on apps if you log in via USB.
There is not much of a "jail" to be broken on the Pre. You enter a code and connect with a program. Its not like the firmware has to be modified or anything. It takes like 2 seconds to get in if you have the terminal software installed.
That'd be +tharris, of Pre Dev Wiki fame, I think. One of the lead homebrew dev's. So far the homebrew community and Palm have been playing very nice and polite together, IMO.
The hole plugged here was that apps linked to in emails would install with no security checks or even dialogs - a gaping hole with legitimate security implications and opportunity for harm to end users.
AFAIK, the Pre's still stupid easy to root and run whatever you want on, this update doesn't break that.
The bug was actually found by some guy whos working on homebrew stuff for the pre.
I really like OTA update and it seem went well speed on Evo
Sprint is dictating the rules to Palm for now which is why homebrew apps, 3rd party apps, tethering, etc. are all being taken away.
The same thing happens with Apple and AT&T.
Ditto to what Brian Goode said. They're not taking away developer mode for folks that want it or making it less stupid-easy to get into. They're just correcting the real problem that the Pre's e-mail program would install arbitrary software on a non-rooted phone -- like an olde-tyme e-mail program happily opening an .exe.
Et tu, Sprint?
please get your facts straight. homebrew isn't dead. Now that the SDK is everywhere, you can use that to install homebew apps, it's quite easy. and now people have a reason to create an app installer app. expect it soon.
all this did was close the email install "feature", which is a good thing, to keep malicious code out.
I switched to sprint for the pre yesterday, and so far It's been great, besides the lack of apps.
Engadget,
Please do not refer to "rooting" the Palm Pre as "jailbreaking." It's not a damned iPhone!!!
What's your point? Jailbreaking as a term isn't iPhone-specific. The same term is used, for example, when referring to the act of breaking out of a *nix chroot jail (a similar concept from the mile-high level) And it would seem to be the correct term in this instance.
Saying that this shouldn't be called jailbreaking is akin to saying "Don't call the Pre a 'telephone', it's not a damned iPhone!"
What exactly is the point of locking down the OS so much? It can't be the carriers, because they let Windows Mobile run free
Seriously, until Palm, Apple, or Google get their act together, Microsoft is going to keep getting my business
how exactly does winmo run free? it runs free for all of about 2 minutes before the battery is dead, and that is assuming it hasn't crashed 15 times during those few minutes it had battery.
dont worry, you can stay with microsoft. we don't want you anyways.
Awww, how cute, someone is trying to tie all exaggerated downsides of a platform into one little post.
They probably figure most people with WM phones won't figure out how to use any of the functionality. I'm 100% serious about that too -- not a joke. Newer SmartPhones with good UIs, easy to use app stores, good modern web browsers, etc are pretty heavily utilized by consumers. Many WM phones are checking an Exchange server all day -- nothing more, nothing less.
Had a feeling there'd be an update
Now only waiting for a more substantial one
This is a lot worse than Apple's plugging holes via updates. This is installed automatically, so you have no choice whether to keep the old software with your hacks or the new software that plugs the hole. What's to stop them from locking out homebrew software (or any unauthorized software) via automatic update?
palm is pretty down on their game if the update can't prevent the further use of already installed homebrew apps. not saying thats a good thing they can't, but...
Maybe Palm doesn't mind the installed apps? They closed a vulnerability than can be pretty dangerous- installing apps by clicking on a link. Palm seems to be pretty ok with homebrew so far.
"We'll download it over the next couple of days..." Gaaaaaaaaaaaaaaah.
"over the next couple of days"... I'd much rather just download that small 12MB right then and get the update over with, haha
You realize you can run the update manually, right?
his name starts with i, therefore he's used to doing what he's told to by iJobs.
You named this screenshot file "updates_2009-29-06_133808.jpg"? Year-Day-Month is the last thing we need on this planet - another completely new standard by Engadget! You are risking to ruin the only one standard date format that always was recognizable and unmodified: yyyy-mm-dd. Fighting for unified power supplies with the left hand, and introducing a new date format with the right hand!
@Takeo: "Year-Day-Month is the last thing we need on this planet - another completely new standard by Engadget!"
I was going to ask you if you've never heard of Europe, but I checked with Wikipedia, and yyyy-dd-mm is, indeed, not a globally-accepted format.
Source (Wikipedia): http://tr.im/qdvC
Why do you care about how we're naming our images? (Do I *want* to know?)
Have you ever tried to *sort* your files? Much easier when they're labelled yyyy-mm-dd. Otherwise you get every 6-29 from each year lining up, which is useless. A new format hasn't been invented -- it's just easier when dealing with computers. And why do you care?
They need to fix my random shut downs. I might return it soon.
I think you're confusing the Pre with the Blackberry Storm. My wife's Pre has YET to randomly reboot, while my Blackberry Storm was doing that up until the June 5th update. Fail, iPhone L(user)!
does it happen when you pop the slider open or close really fast? I had that. It's to be a hardware issue that some users have. Apparently the battery cover is not tight enough for some of them. Take it to the Sprint store (you're definitely within the trial time period). I got a new one without any hassle and it seems to be crash free.
Had someone written a malicious hack and emailed it to a bevy of pre users, or published it on a pre forum as a prank and ended up wiping out thousands of pre handsets, Palm would have been castigated. This update closes a legitimate, gaping security hole. So far Palm has been pretty cool and respectful of the homebrew community, posting in the precentral.net forums occasionally and checkout out what people are doing. I'm sure they are taking a lot of heat from Sprint, but I hope Sprint also recognizes the benefit of having an energized fanbase of people who like to tinker and harness this very cool device.
Palm's going about this quite nicely, the only thing keeping me from getting a Pre is the lack of apps. If not now then at least we need to know that developers will focus on making stuff for the Pre. Don't want to invest in the thing and then six months down the road find out nobody really cares about writing proggies for it.