Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OnePlus OxygenOS built-in analytics

chrisdcmoore.co.uk

Post reply on HN
Print view View original

171–180 of 188 posts

Re: OnePlus OxygenOS built-in analytics

#171

Post by jchw »

wastedhours wrote: post #114
jchw wrote: post #103

Earlier quoted context omitted.

You could make the "too much time" argument about reinstalling Windows or installing Linux when you get a device. Flashing may take some extra time, but it's not harder than normal expected device maintenance usually.

"expected device maintenance" by whom? Anecdata, but 90% of people I know have never installed Linux (and the few times I've had to try and find recovery discs, going to bet reinstalling Windows is at about the same percentage), and not sure I know anyone who's flashed a new ROM on Android. I'm genuinely curious as to where this expectation that everyone should be au fait with OS tinkering comes from?

I didn't say everyone, the audience on HN is far from 'everyone.'

Re: OnePlus OxygenOS built-in analytics

#172

Post by O_H_E »

amelius wrote: post #48
CharlesDodgson wrote: post #13

I have absolutely no doubt there is some data centre in Shenzhen full of my Huawei phone metrics! I think this is the biggest issue with android phones, they are full of potential data leakages like this. Privacy is definitely a concern and a pull factor to getting an iPhone again. There is a lot to be said for a company that is focused on hardware and not on serving content to that device. Then again it's also a rea…

This makes me wonder: why can we have a top of the line desktop PC which is totally libre, but not a smartphone? What has gone wrong?

puri.sm/ shop /librem-13/ for example

Re: OnePlus OxygenOS built-in analytics

#173

Post by O_H_E »

amelius wrote: post #64
rightos wrote: post #53

Earlier quoted context omitted.

If you're running Windows 10, even "top of the line desktop PCs" engage in data collection these days - I have to turn off pages of settings and set group policies to disable it all properly and even then there are still some things which can't be disabled, like the Bing hit every time you type in the search box even with internet search disabled, so I have to use hosts file blocking. https://arstechnica.com/informat…

Yeah, but I can buy a motherboard, cpu, disk and whatnot, assemble them, run Windows or Linux on it. Of course, with phones it is more difficult to assemble stuff (everything is much smaller), but the whole concept of a standardized open platform is not there. Somebody should define the "PC Phone", and declare it an open standard.

Like this for example puri.sm/shop/librem-5

Re: OnePlus OxygenOS built-in analytics

#174

Post by dom96 »

guelo wrote: post #119
dom96 wrote: post #106

Earlier quoted context omitted.

I'm an OP3T owner and I dislike my phone. This may just be the straw that breaks the camels back for me. It would be fine if they asked me explicitly whether I am happy for them to collect these statistics and to offer a way to disable this, but as it is right now this is just unacceptable. The more time I spend with this phone the more I believe that Apple aligns with my interests more (plus their hardware is simply…

Why do you think Apple does not collect device analytics?

Maybe they do. But they don't have as much incentive to do so as Google/OnePlus.

Does Apple collect the same statistics though?

Re: OnePlus OxygenOS built-in analytics

#175

Post by jiggunjer »

rightos wrote: post #69
amelius wrote: post #64

Earlier quoted context omitted.

Yeah, but I can buy a motherboard, cpu, disk and whatnot, assemble them, run Windows or Linux on it. Of course, with phones it is more difficult to assemble stuff (everything is much smaller), but the whole concept of a standardized open platform is not there. Somebody should define the "PC Phone", and declare it an open standard.

I guess it depends on what you mean by open platform. The platforms are well known, architectures are standardize, GPU drivers are often proprietary similar to the desktop world, but ultimately I can flash anything I want on my phone, I've run stock Android, several modified variants, Firefox OS, Ubuntu, Sailfish and others. From a software perspective that's all not too hard to achieve, the hardware side of things d…

I doubt all non-gpu drivers are open source. We're talking oneplus right? If they are, people still need to port them to the new non-stock-compatible OS. Then you probably need to compile everything yourself. Then repeat when OS gets updates. And you'll still be stuck with the stock bootloader and baseband firmwares. Which will hardbrick your device if you flash the wrong way.

But yeah, totally accessible.

Re: OnePlus OxygenOS built-in analytics

#176

Post by zeveb »

pas wrote: post #163
zeveb wrote: post #152

Earlier quoted context omitted.

> Only problem is that you have to explicitly enable the use of custom CA certs in your app, so it won't work with Google apps as you say. Or any other app doing nefarious things. Enabling apps to ignore user-installed certs is flat-out evil an inexcusable.

Evil, herp derp. It was done by malware, to steal user data, hence the change. If you want to log Google data traffic, you have to put a CA cert into the system cert store (needs root access).

If a user installs malware from the Play Store, that's his fault, and it's Google's fault for allowing that malware on the store. If he sideloads malware, that's his fault entirely.

Preventing me from controlling my phone is evil. Preventing me from seeing what the apps on my phone are doing is evil. If I wanted a padded room or a walled garden, I'd be using iOS.

Re: OnePlus OxygenOS built-in analytics

#177

Post by kllrnohj »

subway wrote: post #159
kllrnohj wrote: post #158

Earlier quoted context omitted.

Intel & AMD CPUs also have firmware that can be updated as well. Not to mention the BIOS itself which is often blindly trusted.

Sure -- fortunately on most Intel and AMD CPUs you have some level of control in isolating the host from mobile carriers and those acting as mobile carriers.

Mobile carriers do not write or sign the baseband. You're at the whim of the hardware manufacturer in both cases (Intel CPUs & Qualcomm basebands).

Re: OnePlus OxygenOS built-in analytics

#178

Post by [deleted] »

O_H_E wrote: post #173
amelius wrote: post #64

Earlier quoted context omitted.

Yeah, but I can buy a motherboard, cpu, disk and whatnot, assemble them, run Windows or Linux on it. Of course, with phones it is more difficult to assemble stuff (everything is much smaller), but the whole concept of a standardized open platform is not there. Somebody should define the "PC Phone", and declare it an open standard.

Like this for example puri.sm/shop/librem-5

[deleted]

Re: OnePlus OxygenOS built-in analytics

#179

Post by subway »

kllrnohj wrote: post #177
subway wrote: post #159

Earlier quoted context omitted.

Sure -- fortunately on most Intel and AMD CPUs you have some level of control in isolating the host from mobile carriers and those acting as mobile carriers.

Mobile carriers do not write or sign the baseband. You're at the whim of the hardware manufacturer in both cases (Intel CPUs & Qualcomm basebands).

I'm pretty sure in the case of at least Qualcomm, the carrier can do a heckuva lot more. Most snapdragon SoCs support a pretty hefty subset of OMA-DM at the baseband level, allowing for execution of arbitrary 'apps' on the baseband, by the carrier. Throw in any vulnerability in that baseband stack, and now attackers have a very direct path to system memory.

Re: OnePlus OxygenOS built-in analytics

#180

Post by kartickv »

kbart wrote: post #161
_qjt0 wrote: post #156

Earlier quoted context omitted.

I wonder if there's an opportunity to reduce the privacy problem by having the phones log data to an intermediate server. The intermediate server will be open-source and run by a trusted entity (EFF, Apache Foundation, whoever). OnePlus will be able to submit whatever code they want to this server after a public privacy-focused code review by the trusted entity. The proxy server will aggregate and anonymise the data…

Who will pay for that and how are you going to force manufacturers to participate in such scheme? Most people "have nothing to hide" and don't care about privacy, so they won't be happy as manufacturers pass cost of this to them. More realistic way (though not easy too) is to install a firewall on a proxy all traffic is run through and filter suspicious/unknown connections.

Manufacturers or software developers who're especially privacy-conscious, or collecting data that wouldn't be able to get with otherwise, might use this scheme. Maybe the folks who run the upstream server will also pay for the intermediate server. It shouldn't cost much for an entity that's already operating at scale, whether in users or revenue.
Post reply on HN