SuperSU

» see supersu.com as it lived, on the wayback machine

~ the obit ~

On a Linux machine, root is unremarkable. You type a command with a password behind it and the system does what you told it. On an Android phone the same power had to be taken by force, through an exploit in a bootloader or a vendor's own sloppy image, and once you had it there was nothing built in to manage it. That is the hole SuperSU filled. It sat between every app on the device and the su binary, popped a dialog asking whether this particular app should be granted root, and remembered the answer.

Chainfire released it in March 2012, on XDA-Developers the way everything in that world was released, and Android Police wrote it up on the 9th as a souped-up replacement for the existing Superuser app. The features that mattered were unglamorous. Per-app logging, a PIN on the prompt, temporary grants that expired, and a version that survived over-the-air updates instead of being wiped by them. It became the default well before anybody decided it should be, and the Play Store listing eventually carried more than a hundred million installs.

Chainfire is Jorrit Jongma, a Dutch developer whose name barely appeared in the coverage for years; the handle was the brand. He also wrote CF-Auto-Root and FlashFire, and for most of a decade a large share of the world's rooted Android devices ran through code with one person's copyright line on it. That concentration is the setup for what happened next.

~ the rap sheet ~

~ sold to a name nobody knew ~

On 29 September 2015 he announced that ownership of SuperSU had transferred to Coding Code Mobile Technology, a company nobody outside the deal could describe, with a Delaware registered-agent address in Wilmington and a Chinese link. He would stay on as an advisor for two years. The price was never disclosed and he declined at the time to say much about who CCMT even were.

Think about what was being sold. Not a game or a launcher, but the component that decides which processes on your phone get unrestricted access to everything on it, already installed on a hundred million devices, updating silently through the Play Store. The community reaction was not really about nationality, whatever the louder posts said. It was that a permission gate is the one piece of software where the identity of the owner is part of the product, and that identity had just been replaced with a question mark.

The advisory contract ran to 24 February 2018. His last version, 2.82-SR5, went out on 1 October 2017, and CCMT shipped a 2.82.1 in January 2018. On 5 May 2018 he posted that he was done with root app development altogether and marked SuperSU and his remaining root tools end-of-life. The Play Store listing came down on 2 October 2018.

~ what magisk did differently ~

Magisk arrived in 2016 from a developer called topjohnwu, and the difference was architectural rather than cosmetic. SuperSU modified the system partition. Magisk patched the boot image and left /system untouched, which meant Google's SafetyNet attestation could not see the modification. In plain terms: with Magisk your banking app still opened and Google Pay still worked. With an unmaintained SuperSU on a modern Android version, increasingly they did not.

Once that gap existed, the trust argument and the technical argument pointed the same way, and there was no reason left to stay. By the time the listing disappeared, the migration had mostly already happened.

~ what is still up ~

The domain supersu.com does not resolve. There is no parking page, no lander, no buyer; the address of a piece of software with nine figures of installs simply returns nothing.

Jongma's own sites are another matter. The blog at chainfire.eu still answers, its newest entries dating from around Android 11 and concerning an app that animates the camera cutout on a Samsung S10. The subdomain su.chainfire.eu still serves "How-To SU", the document he wrote for other developers about implementing root correctly, last revised in December 2016 and still the clearest writing on the subject. And download.chainfire.eu still hands out an old SuperSU flashable zip, with a counter beside it that has passed 124 million and is still climbing. The product was sold off and then delisted, and the author's own file server never stopped serving it.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »