A warning about Zoleo (satellite communicator)

[glambx]

Hey everyone!

I felt I should probably warn the community of my recent experience with Zoleo (satellite communicator).

I was an inReach user for almost a decade, but the Android software has always been terrible, and it didn't assign you a fixed phone number which made business communications at sea challenging.

I bought a Zoleo in August, and my initial experience was fantastic. The app was great, and the fixed number could receive messages by Internet and Zoleo; it was great to hand out one number that always worked.

Unfortunately a mandatory app update in November changed all that. They'd decided to implement anti-root provisions for "security" reasons (which is nonsense for a variety of reasons). It's worth noting that no other satellite communicators have this issue.

Not only that - they implemented it poorly, affecting even some non-rooted devices. See the Play store app reviews (sorted by date) for almost exclusively 1-star reviews since the update. It's now going on two months later, and the issue remains; the app simply crashes on startup.

I worked with their customer service team (who to their credit were spectacular) the whole time, and they really tried to make their tech team understand the consequences of bricking a their customers' safety and communication devices, but I received word yesterday that it was official: our Zoleos were now paperweights. They offered to close my account.

To me, it's not a question of root, per se. In fact, it's not too difficult to bypass the anti-root provisions. It's about owning safety equipment that the company is willing to brick on a whim. Nowhere has this limitation ever been mentioned on the app, the web site, or purchasing agreement, nor does the app even give you a dialog explaining the problem. It just crashes without any useful error message... nearly two months after it was first reported.

I'm just glad it only cost me $250, and didn't happen while I was down cruising the leeward islands.

In short... buyer beware. It's back to Garmin for me.

Fair winds, everyone.

[sv_pelagia]

My Zoleo is on "suspend" for the Winter ($5/mo), and I'm not going to reinstate it early just to find out.

HOWEVER, from postings on the Zoleo Facebook group, many say customer service has been quick to respond AND fixed their problem:

https://m.facebook.com/groups/502802240850005/

Apparently they are crediting some accounts who had problem an extra 2 months "free" (not really free if it wasn't working for a while)

Guess I'll find out in early March....

[wholybee]

Was your device rooted?

[glambx]

Originally Posted by wholybee

Was your device rooted?

Aye. Always has been, as I'm an Android and Linux kernel developer.

Originally Posted by sv_pelagia

My Zoleo is on "suspend" for the Winter ($5/mo), and I'm not going to reinstate it early just to find out.

HOWEVER, from postings on the Zoleo Facebook group, many say customer service has been quick to respond AND fixed their problem:

https://m.facebook.com/groups/502802240850005/

Apparently they are crediting some accounts who had problem an extra 2 months "free" (not really free if it wasn't working for a while)

Guess I'll find out in early March....

Good to hear some people are having success, but according to the Play store reviews (sort by date), many users are still locked out. None of the 1-star reviews have published updates saying they're back up and running.

To their credit, they did remove service charges from my bill. I still hope they'll reverse course on this mess and focus on reliability. Reputation and trust are everything in this business. :/

[wholybee]

Originally Posted by glambx

Aye. Always has been, as I'm an Android and Linux kernel developer.

Then you should know that rooting a device always risks it being bricked now or in the future, and shouldn't be done on a "production" device. We sometimes forget this because rooting is a common thing and is done all the time. But there is always a chance of getting burned by it.

Relevant to the thread, most Zoleo users will not root their device. So, this really should be a warning not to do that, not a warning to avoid Zoleo.

[glambx]

Originally Posted by wholybee

Then you should know that rooting a device always risks it being bricked now or in the future, and shouldn't be done on a "production" device. We sometimes forget this because rooting is a common thing and is done all the time. But there is always a chance of getting burned by it.

So, I'm a Linux kernel and Android developer, and in fact if you're using Android or Linux proper, there's a good chance you're running some of my code.

Further, if you're using a Windows PC or a Mac, you're also running a "rooted" device.

This entire line of thinking of "rooting is insecure" needs to stop. It's propaganda by ad-driven and data harvesting companies, because full control over devices makes it easy to secure them against the manufacturer.

In any case, the issue is that Zoleo has chosen to attempt to detect that a device has been rooted, and then stop working. That's very different than someone making a mistake on their device which causes unwanted behavior.

An analogy would be: you purchase marine radio which specifies an input voltage of 9-16V. You install it, connect it to your lithium ion battery system, and all is well. A year after sailing around the Carribbean, the company calls you and demands you install mandatory firmware upgrade. You find a hotspot, and perform the upgrade. Suddenly, the radio crashes on power-up. The company asks if you're running lithium ion, and you say "yes; I'm an electrical engineer and the installation is fine." They tell you they heard a rumor about someone having a bad experience with lithium ion, so they've implemented a routine to check the voltage discharge curve, and if they suspect lithium ion, the radio shuts down. They won't provide the old firmware; your radio is now a brick. There was nothing in the manual, or the purchasing agreement about not using lithium ion. Unfortunately quite a few customers running AGM are also affected, and after two months, they're still without communications.

Relevant to the thread, most Zoleo users will not root their device. So, this really should be a warning not to do that, not a warning to avoid Zoleo.

So, if you re-read my post, you'll see that it also affects non-rooted users. Observe that 90% of new reviews since Nov 1 are 1-star. The bug mainly affects Pixel and Samsung devices. These are real customers they have lost. But again, this isn't about supporting rooted devices. They've chosen to reduce the stability of the application, primarily on rooted devices. This suggests that they don't take reliability seriously, and that's kind of important for safety devices.

Of course, everyone must use their best judgment when purchasing such a device.

I wanted to get this information out there so people are aware.

[sv_pelagia]

Originally Posted by glambx

In any case, the issue is that Zoleo has chosen to attempt to detect that a device has been rooted, and then stop working. That's very different than someone making a mistake on their device which causes unwanted behavior.



So, if you re-read my post, you'll see that it also affects non-rooted users. Observe that 90% of new reviews since Nov 1 are 1-star. The bug mainly affects Pixel and Samsung devices. These are real customers they have lost. But again, this isn't about supporting rooted devices. They've chosen to reduce the stability of the application, primarily on rooted devices. This suggests that they don't take reliability seriously, and that's kind of important for safety devices.

Of course, everyone must use their best judgment when purchasing such a device.

I wanted to get this information out there so people are aware.

But there are also many recent (post Zoleo update) reviews on Google Play that are very positive. Facebook group posts larer in December indicate most complaining had situation resolved.

IF it is primarily an issue for rooted devices, I agree Zoleo must indicate this won't work on such devices. And causing working devices to stop working with update without advance warning and workaround is also egregious.

[glambx]

Originally Posted by sv_pelagia

But there are also many recent (post Zoleo update) reviews on Google Play that are very positive.

There are 15 one-star reviews since the update, and 6 five-star reviews (two of which seem to be in error; they comment that the update broke their app). That is - 17 claims that the app is malfunctioning, and 4 that they're happy. A few 2 and 3 star reviews that claim the app crashes for them as well.

I'm not sure why you're defending Zoleo here. The vast, vast majority of the reviews since the update are negative, which is why their average rating plummetted from 4.7 to now 4.0 in two months. The latest review, one star, came in yesterday: "The app does not open and keeps crashing (...)"

Make sure you sort by date. You can only do this from the Play store app, not the website, unfortunately.

IF it is primarily an issue for rooted devices, I agree Zoleo must indicate this won't work on such devices. And causing working devices to stop working with update without advance warning and workaround is also egregious.

That's all I ask, to be honest. I obviously wouldn't have purchased it if they warned me that they were going to try to detect root and crash.

I just want others to be aware of the situation, given that no other satellite communicator has this problem. Maybe it impacts their purchasing decision; maybe it doesn't. But at least it won't be a surprise if they're wiped out by a future update and can plan to have a backup communicator on hand.

[wyb2]

OP has a point here. When you pay up front for a piece of software, it's reasonable to assume it will continue to work unless you the user screws it up.

It's one thing for them to say 'we can't be held responsible for any malfunction or security issues that occur on rooted devices'. It's another thing to purposefully cause the app to crash. If they are doing that, they should issue full refunds to anyone experiencing it.

This is similar to right-to-repair issues that come up all the time, a high profile one with John Deere basically forcing farmers to become hackers in order to be able to fix their own equipment. When you pay up front for something, you should own it, not the company you bought it from.

If it was a subscription service, it would be different.

Edit: didn't realize it was a monthly subscription on top of the $250. This complicates it a little. I'd still be annoyed

[glambx]

Originally Posted by wyb2

Edit: didn't realize it was a monthly subscription on top of the $250. This complicates it a little. I'd still be annoyed

It is a subscription service, but I don't see why that would have anything to do with it, to be honest. They charge you per-message with most plans, and there's a "fair use" clause on the unlimited plan. All of the security and billing is done on their side, not in the app. Further, it's relatively trivial to get past root checks, so it provides no actual security. I'm just not willing to jump through hoops when their competitors offer a similar service without the headaches.

In any case, it's still also affecting non-root users after two months. My main warning is that they pushed out a mandatory update that wiped out some of their user-base, and after two months, they've provided no fix or workaround. They also chose to take out other paying customers that were happily using their devices .. without any warning.

I have no doubt the vast majority of their customers are still up and running, but as an affected user, I wanted to warn others. Probably won't happen to you, but it might, and if it does, evidence suggests that the company will leave you high and dry. Just a factor to consider while evaluating the options.

[wyb2]

I’m with you, they pulled a crappy move. Just saying that with anything you pay for on a regular basis as a service, the question of ownership is a little less straightforward. Not saying the user has no claim, especially when the service is directly linked to a piece of hardware you had to buy, just that it’s not as cut and dry.

[glambx]

Originally Posted by wyb2

I’m with you, they pulled a crappy move. Just saying that with anything you pay for on a regular basis as a service, the question of ownership is a little less straightforward. Not saying the user has no claim, especially when the service is directly linked to a piece of hardware you had to buy, just that it’s not as cut and dry.

Ya, fair enough. I can certainly imagine how the "security expert" explained the situation to them.

[wholybee]

Originally Posted by glambx

So, I'm a Linux kernel and Android developer, and in fact if you're using Android or Linux proper, there's a good chance you're running some of my code.

Further, if you're using a Windows PC or a Mac, you're also running a "rooted" device.

This entire line of thinking of "rooting is insecure" needs to stop. It's propaganda by ad-driven and data harvesting companies, because full control over devices makes it easy to secure them against the manufacturer.

In any case, the issue is that Zoleo has chosen to attempt to detect that a device has been rooted, and then stop working. That's very different than someone making a mistake on their device which causes unwanted behavior.

An analogy would be: you purchase marine radio which specifies an input voltage of 9-16V. You install it, connect it to your lithium ion battery system, and all is well. A year after sailing around the Carribbean, the company calls you and demands you install mandatory firmware upgrade. You find a hotspot, and perform the upgrade. Suddenly, the radio crashes on power-up. The company asks if you're running lithium ion, and you say "yes; I'm an electrical engineer and the installation is fine." They tell you they heard a rumor about someone having a bad experience with lithium ion, so they've implemented a routine to check the voltage discharge curve, and if they suspect lithium ion, the radio shuts down. They won't provide the old firmware; your radio is now a brick. There was nothing in the manual, or the purchasing agreement about not using lithium ion. Unfortunately quite a few customers running AGM are also affected, and after two months, they're still without communications.



So, if you re-read my post, you'll see that it also affects non-rooted users. Observe that 90% of new reviews since Nov 1 are 1-star. The bug mainly affects Pixel and Samsung devices. These are real customers they have lost. But again, this isn't about supporting rooted devices. They've chosen to reduce the stability of the application, primarily on rooted devices. This suggests that they don't take reliability seriously, and that's kind of important for safety devices.

Of course, everyone must use their best judgment when purchasing such a device.

I wanted to get this information out there so people are aware.

It has little to do with whether or not rooting a device is secure. And Windows/Macs are NOT rooted, rather root access is granted the owner of the device by default.

Rooting a device is a significant modification. You exploit some bug or hole in the firmware, bootloader, or similar, and use it to install a modified firmware. That firmware will be modified to run unsigned code, and to allow a user root access. It is unquestionable that allowing unsigned code to run on a device is a security issue. And allowing root access creates an easy vector for an inexperienced user to really screw things up badly.

But as I said, security isn't the main issue. A user roots a device. They goof during the process and brick the device(always possible) Should Zoleo be obligated to warrant that? NO! Next senario, a user roots a device, installs some app that makes it unstable. Now the device is a safety hazard as it doesn't work as advertised. Should Zoleo have any responsibility in that case? NO! The best answer is for Zoleo to straight up not support rooted devices in ANY way.

I understand your frustration. You are a developer of opensource systems, where core to the foundation of the project is that users have access to see and change and do with what they want of their device. That is not the way most commercial products work, and you cannot expect the same freedoms. Apple does everything they can to prevent jailbreaking (which is just apples term for root). Each new Samsung model released needs to be hacked to find new ways to root because Samsung closes those holes when they can. Kindle devices. Raymarine's Axiom. Freaking everything. Darn near every device manufacture puts some effort into preventing their devices from being rooted. Every rootkit available (or at least that i have used) has huge disclaimers that you risk bricking they device. It usually doesn't happen, but you really don't have a legit reason to cry foul when you have always known that risk.

You took a risk and got burned. Suck it up. Develop an opensource alternative and put it on Github.

Edit:
To clarify, I am not opposed to anyone rooting a device, and I would often encourage it. I just think it is wrong the approach you took to blame the Zoleo. More appropriate would be "I rooted my Zoleo device and it got bricked. So, if you might root your device, look elsewhere."

[glambx]

Originally Posted by wholybee

You exploit some bug or hole in the firmware, bootloader, or similar, and use it to install a modified firmware.

This statement is false. There is no bug or hole to exploit. Pixel devices (and many others) can be officially unlocked using fastboot, provided by Google. Can I ask what you do for a living?

They goof during the process and brick the device(always possible) Should Zoleo be obligated to warrant that?

Why would Zoleo warranty a phone? They have nothing to do with it.

Should Zoleo have any responsibility in that case? NO! The best answer is for Zoleo to straight up not support rooted devices in ANY way.

I agree, 100%. I do not expect Zoleo to "support" my device. I do, however, expect them not to intentionally introduce malicious code that causes the app to crash in that situation. At the very minimum, I expect them to be upfront about it prior to purchase.

I can't stress this enough: this problem is unique to Zoleo. No other satellite communicator includes an app with this problem.

You took a risk and got burned. Suck it up. Develop an opensource alternative and put it on Github.

Can you explain to me why the Zoleo app reviews are filled with problem reports since Nov 1? Do you think Zoleo owes those users a fix, or are they just supposed to "suck it up" having been caught in the crossfire?

At the end of the day, this is an issue of trust. Trust is important when it comes to communication safety devices, and it's hard to trust a company that willingly took out a number of their own users on a fool's errand.

I'm not telling anyone to avoid Zoleo. I'm simply providing an account of my recent experience.

[jordanbigel]

Originally Posted by wholybee

It has little to do with whether or not rooting a device is secure. And Windows/Macs are NOT rooted, rather root access is granted the owner of the device by default.

Rooting a device is a significant modification. You exploit some bug or hole in the firmware, bootloader, or similar, and use it to install a modified firmware. That firmware will be modified to run unsigned code, and to allow a user root access. It is unquestionable that allowing unsigned code to run on a device is a security issue. And allowing root access creates an easy vector for an inexperienced user to really screw things up badly.

But as I said, security isn't the main issue. A user roots a device. They goof during the process and brick the device(always possible) Should Zoleo be obligated to warrant that? NO! Next senario, a user roots a device, installs some app that makes it unstable. Now the device is a safety hazard as it doesn't work as advertised. Should Zoleo have any responsibility in that case? NO! The best answer is for Zoleo to straight up not support rooted devices in ANY way.

I understand your frustration. You are a developer of opensource systems, where core to the foundation of the project is that users have access to see and change and do with what they want of their device. That is not the way most commercial products work, and you cannot expect the same freedoms. Apple does everything they can to prevent jailbreaking (which is just apples term for root). Each new Samsung model released needs to be hacked to find new ways to root because Samsung closes those holes when they can. Kindle devices. Raymarine's Axiom. Freaking everything. Darn near every device manufacture puts some effort into preventing their devices from being rooted. Every rootkit available (or at least that i have used) has huge disclaimers that you risk bricking they device. It usually doesn't happen, but you really don't have a legit reason to cry foul when you have always known that risk.

You took a risk and got burned. Suck it up. Develop an opensource alternative and put it on Github.

Edit:
To clarify, I am not opposed to anyone rooting a device, and I would often encourage it. I just think it is wrong the approach you took to blame the Zoleo. More appropriate would be "I rooted my Zoleo device and it got bricked. So, if you might root your device, look elsewhere."

I think it comes down to a simple question, should any company have the right to purposely disable software based on some action the user has taken, without warning all potential customers upfront that this is their intent. If they did not do that at the time the user purchased the product, and then later introduced that "feature" (ahem, I use the word generously) then it was their responsibility to advise all users in advance that this was going to happen and the date on which this was going to happen with enough advance notice for users who are depending on the device for critical communications can find a replacement before the new policy goes into effect. Because it sounds to me like they introduced a new policy (via software update) without warning users about it. It doesn't even matter if they refunded your purchase price, they rendered an emergency communication device useless potentially during a life threatening disaster, which is exactly why the user bought the device in the first place.

Like other stories about Garmin forcing software updates on InReach which do not allow the user to complete a passage (ie. give the user a warning period of time to do the update before the device becomes unusable) these types of actions should disqualify the product from being considered as an emergency communication option. You wouldn't buy an EPIRB if you knew that at any time it could become useless and you might not even know about it until you needed it. Crazy.