¡Buenas noticias, México! It is now possible for you to download paid apps from the App Catalog, they’ll even take your pesos at a very generous exchange rate. Bad news: you have to hack webOS 1.4.5 onto your phone to get it to work, because for reasons that we cannot fathom Telcel’s Palm Pre phones have yet to receive the update to enable the ecommerce App Catalog. They’re still stuck on webOS 1.4.0. Mind boggling, we know.

PreCentral reader Juan let us know that he had managed to get his Telcel Pre running 1.4.5, and up until last week he’d been able to view all sorts of apps in the App Catalog, but had never been able to complete a purchase. But now if he tries to download one of the paid apps that shows up in the Mexican version of the App Catalog, he’s prompted for credit card account information and then permitted to buy.

So far each app he’s tried to buy (iGPS, Internet Radio Pro) has gone through successfully. Additionally, the exchange rate for Mexican pesos to US dollars has been fairly generous, running at 1.00 USD = 10.00 MXN, whereas the current value is more like 1.00 USD = 12.40 MXN.

Is the Palm expanding the App Catalog to support more countries, even where App Catalog support is lacking (or where Palm technically doesn’t even have service), or just a glitch? We don’t know, but we’re glad to see more people getting access to the full App Catalog, even if they have to hack their phones to get there.

Thanks Juan!

Two researchers with SecTheory have announced that they have uncovered flaws in older versions of webOS that would allow for remote command and control of the devices. These exploits were discovered in webOS 1.4.X (1.4.0 through 1.4.5), but some have since been patched in webOS 2.0.

Due to webOS’ web-tech base, it will always be possible to hack the operating system using techniques similar to those used to exploit websites, though taking into consideration the fact that our phones generally contain far more personal information than any single website, it can be slightly worrying. Of course, the other side of the coin tells us that webOS wouldn’t be webOS without these web technologies. With every mobile platform there are trade-offs. Easy of programming and accessibility leads to a more easily exploited operating system.

According to the researchers, the Company field in the 1.4.X Contacts app is “unsantized,” allowing them to inject code that allowed them to pull other information from the Contacts database. Additionally, they were able to insert a JavaScript hook that enabled the use of tools such as keyloggers, possibly leading to botnets and the like.

There are at least two unmentioned caveats to this exploit: first the code isn’t executed until the user views it (it sits there until the contact containing the malicious code is opened and viewed), and the code still has to get on the device somehow. We can think of a few ways to get the code into a contacts field of your device. Insert it through a web-based contacts application (e.g. Google Contacts or their Exchange database, but then you still have to crack the user’s password) is the only remote manner we can fathom. Everything else requires either interaction with the user (accepting a transmitted vCard contact through email or other means) or physical access to the device. And if somebody else has access to your phone, you’re pretty much screwed anyway.

Overall, like every other security exploit revealed to date about webOS, we’re not too concerned. There are all sorts of ways to exploit webOS, some of which are essential to fun stuff like homebrew. That said, we’re not super huge fans of malicious exploits, and we’re glad to see that Palm has fixed this particular problem with the release of webOS 2.0. Now if only those of us that don’t have Pre 2 phones could download the new OS...

Source: Darkreading; Via: Engadget; Thanks to everybody that sent this in.

It seems to be as simple as that, which makes us wonder why Palm decided to drop the Palm OS ROM from webOS 2.0 and shaft MotionApps in the process. The only thing the Palm OS ROM does is take up space (not a lot, it is Palm OS after all) and wait for Classic to launch it, so why cut it out. Unless Palm is pulling an Apple (dropping the floppy drive) and forcing developers and users to move on from old tech. Full instructions after the break.

Source: PreCentral Forums; Thanks Arthur!

read more

webOS 2.0 will be coming to Pre, Pixi, and Plus variant devices in “the coming months,” but if you’re like us, you want webOS 2.0 right now because you have the attention span of a... hey, who finished the ice cream? Thankfully, the masters of satisfying our impatience - the code genies at WebOS Internals - have decided that they don’t want to wait either.

With the release of the 2.0-restoring webOS Doctor for SFR’s Pre 2, Rod Whitby and the gang have taken to hacking and splicing the 2.0 Doctor with the already released webOS 1.4.5 Doctor. Yes, that's a gross oversimplification, but all the code gibberish is far over this author's head (as evidenced by my calling it gibberish). In essence, they’re setting out to make a webOS FrankenDoctor, with the aim of installing webOS 2.0 before Palm and carrier partners finally get around to releasing the update. Really, who wants to be at the mercy of Sprint and Verizon?

Right now it’s very raw. As in it’ll render your device unusable and possibly physically damaged. There’s a reason the forum post on the subject starts off in 24-point bold red type. But, if you’re of the super-geeky Linux inclination, capable of in-depth debugging, and feel like chancing a permanent bricking of your spare Pre (do not, I repeat, do not try this on your primary device), then feel free to join in. After all, it takes a village to make a Frankendoctor - or maybe the village chases and kills the Frankendoctor - never could get that straight. In any case, there are roadblocks to be overcome.

Just don't blame us if things go south in a hurry - if patching and kernels are homebrew, then this is, well, we don't know what to call this except for friggin' awesome.

Source: PreCentral Forums; Thanks to sketch42 for the heads up!

It's been a long road to getting webOS 1.4.5 on all the webOS devices available in the US, but the AT&T Pixi Plus is receiving the update now, as AllTec tips and jonsmith89 reports in our forums. webOS 1.4.5, if you didn't know, brings the ability to download a much larger number of 3D games along with several other minor fixes. Palm's release notes for webOS 1.4.5 show there's not much beyond the PDK app compatibility:

System
This release includes minor fixes and enhancements to support the public release of the webOS PDK.

Web
If a user enters text in a field on certain websites, the screen focus now remains on the text being entered.
This release fixes a rare problem so that podcasts now download correctly.

Security
This release addresses several security issues with the Palm webOS software.

By our reckoning this only leaves Telcel in Mexico lacking the latest version of webOS. With luck, it will come soon.

Meanwhile, AT&T Pixi users - what's the first game you'll download on your newly updated Pixi?

Thanks AllTec and jonsmith89!

As expected, webOS 1.4.5 is now available for the Pre Plus on Verizon. While we know that it's going to let you download more games to help pump up the numbers for the developers looking to get their share of the one million dollars Palm is giving away in the PDK Hot Apps program, we're curious to hear if there are any other improvements.

At the top of our list: tell us if 1.4.5 on your Pre actually fixes the currently-busted GPS functionality so we don't have to resort to Homebrew fixes. We're not especially hopeful it will, but hey, at least you can look forward to better Mobile Hotspot with Windows Visa 64-bit, slightly improved battery life, and all the Jewels you can handle.

Homebrewers - as usual most patches are ok, but these should be removed before updating. We like to suggest removing themes before updates, too.

Update: The AT&T Palm Pre Plus also looks to be getting the update as we speak! No word yet on whether there are additional features hidden in the AT&T update and also no word whether or not the AT&T Pixi is getting 1.4.5 just yet. - Thanks Sett!

Update 2: Oddly, Palm's release notes for Verizon Palm Pre webOS 1.4.5 don't mention the battery or Mobile Hotspot improvements from Verizon's site. AT&T's release notes don't reveal any surprises.

Thanks LLC23!

We don't think we can give Mr. Ski Mask full credit for this one, but Verizon has just made it official that they'll be rolling out webOS 1.4.5 for the Palm Pre Plus later today, confirming earlier speculation that it was imminent. In addition to bringing support for 'indie' PDK games, 1.4.5 on Verizon is also expected to improve Mobile Hotspot for Windows Vista 64-bit users and perhaps improve battery life just a bit.

After today, 1.4.5 will be rolled out to pretty much everybody except AT&T, whose users can only be described as twisting in the Angry Birds-less wind. So while pestering @VZWSupport today at 3pm EST with the hashtag #releasemy145 isn't necessary anymore, @ATTCustomerCare could still stand to hear the message.

Source: @VZWSupport; Thanks Soorma!

A note for developers: if you submit an app to the App Catalog that you built with the webOS 2.0 SDK, it’ll be denied. Problem is, Palm’s not quite accepting those apps just yet - they'll only take apps for currently-released version of webOS. Developer Geoff Gauchet noticed this when he submitted an update to Neato. Gauchet hadn’t baked any webOS 2.0 features into Neato, he’d merely packaged it up with the 2.0 SDK. With the app rejected, Gauchett thought it best to (1) fix it and (2) let the rest of the developer community know how it’s done. And so, we’ll point you over to Zhephree.com for the directions so you don’t have to go an install the webOS 1.4.5 SDK too.

Source: Zhephree.com

Our masked defender, the ReleaseMyPre guy, has heard your cries! For far too long, the countless Verizon and AT&T Palm Pre Plus users have been without webOS 1.4.5.  It's the webOS update that feels just out of grasp for people on those carriers.

As the above video shows, the ReleaseMyPre guy has taken up the cause. The earlier 79-hour notice to Palm has been given a pass until Monday. What's more, he's planning a twitter protest to get the point across that every device deserves webOS 1.4.5.

So here are the specifics. On this upcoming Monday September 13th, at 3pm EST, simply tweet to both @VZWSupport and @ATTCustomerCare. Oh, and be sure to include the #releasemy145 hashtag.

Source: Twitter

Palm's webOS 1.4.5 update hasn't exactly had the smoothest of rollouts - arriving in Europe and Canada on July 14th, Sprint on August 11th, and the Verizon Pixi Plus on August 31st - not to mention that pesky bug that breaks some games. Meanwhile, Verizon Pre Plus and AT&T users are standing by, unable to get their Angry Birds on.

Well, Shad emailed us (and others) to let us know that somebody from Verizon corporate is telling him the update should hit in about two weeks. We've heard plenty of empty promises from mid and high-level carrier employees before, though. However rwinger in our forums points out that Verizon's very own OTA Update Information page for the Palm Pre Plus sports screenshots showing 1.4.5.

We can't have much longer to wait now, can we? This rollout stands in stark contrast to previous webOS updates that managed to hit multiple carriers in multiple countries in fairly short order. The delayed rollout on Verizon and AT&T also seems to be putting a damper on the PDK Hot Apps $1 million giveaway - if folks can't install the apps, it makes it quite a bit harder to generate buzz for the latest and greatest - only 20 days left in that contest.

Update: Shad points us to this PDF on Verizon's support site that indicates updates for 1.4.5:

webOS 1.4.5 Build 171 update includes numerous enhancements. [...]

+ Better Mobile Hotspot connectivity
- Your Palm Pre Plus can easily connect through the Mobile Hotspot application even when using Windows Vista® 64-bit with Windows LiveTM OneCare.

+ Better Web functionality
- Preview all ringtones on the Verizon Mobile Web 3.0 site.

+ Overall improved battery performance

Thanks, Shad and cantaffordit!