[Verizon HTC One (M8)] libredroid:
Joint Java Card?

Same boat (Verizon, htc one m8) . . . For some reason I was thinking Lollipop was the update which was still able to be handled by Weaksauce 2. So I accepted the OTA, without thinking. -hadn't gotten around to s-off, etc., before this time around.

So, in some 2013 posts, I saw that some people had tried to pool resources and share a Java Card, etc. But sending phones to a "card keeper", is expensive, and unsafe (besides having to live without your phone for a few days.). jcase, on their company's IRC support channel, indicates that the card is more than just a simple microSD card, which one might be able to dd a filesystem image from (i.e. copy it for distribution). That's entirely possible, since all SD cards have micro-controllers for dealing with failed sectors, etc (check out "Bunnie's Blog"). Basically, the controller could make it tough/impossible to access part of the card, and can take care of decrimenting credits, encryption, signing, etc. Even if it were a basic SD card, the use of signed binaries, and external license/resource server, etc. could still make it tough . . . -although the card I found states it needs no internet connection. It would be much cheaper to send the card, rather than phones. But how to coordinate and pool the cost seems like it could be a pain?

So here's what I'm thinking about:

Someone (me?) could purchase a legit, new htc Java Card. After I use my 2 or 3 credits to s-off/unlock my phone, I could put the card on, say, ebay for maybe $5 less than what I bought it for. Then, another person could use some credits, then sell it again, for a little cheaper, etc. If we want to keep it "in-house", we could just send to each other and pay with PayPal or Google Wallet. But, with e-bay, one could just copy/build on the ad the first person started. Take a picture of your phone's screen, when the remaining credits are shown, and put it on the ad. With 2000 credits, my conservative estimate is that it could cost less than 72 cents, for each unlock. The $5 incremental discount might be close enough to cover re-shipping costs.

The Sunshine guys have, for free, helped many of us over the years. So I was planning to purchase their solution, if it worked for this situation. But their download page states that "Verizon 5.0.x users will have to wait until we update.". They indicate they could get us supported soon, but they also indicate that Lollipop is much more secure, with SELinux updated and better enforced., etc. So I am a little concerned about when that will actually happen. I see they've been posting updates for Motorola, and making sure people are able to pay them via PayPal, etc. But nothing yet for Verizon 5.0.x.

Does anyone know/recall how long after the last android update, someone came up with a root exploit? I'm just trying to get a rough guesstimate about the minimum time people will have to wait this time. -then add time because Lollipop is apparently significantly more secure. I guess I don't completely mind that my phone might be secure enough to not make it tougher for someone to get into the deepest parts of it, without specialized hardware (Java Card), if I were to lose it. ;)

But, really, what Verizon and htc and others have done to these devices . . . They are, essentially, specialized computers. It would be like if Dell or another computer manufacturer sold you a computer, without allowing you access to your administrator account (and no clear/easy way to boot from another drive, to recover/fix things, etc.). That's crap.

I dunno. What do people think? I suppose I could just try it, and see.