Earlier quoted context omitted.
wprq: So which phone does a concerned person buy?
As far as I know Replicant[1] is the only completely open option (besides the baseband OS). I would love to run it myself if it supported more phones, although I have not personally tried it. I keep an eye on the project though. Other projects like Copperhead OS[2] have all mysteriously imploded. [1]: https://replicant.us/ [2]: https://news.ycombinator.com/item?id=17289536
Replicant drawbacks include:
* Starved for developer time (e.g., low device support, slow/no updates for known exploits, question of how many eyeballs seeing changes, no current semi-secure way to browse Web).
* Only kinda barely minimally almost works.
* The supported hardware devices are not only few and old, but have fundamental security weaknesses in hardware.
* Android is a huge code base, and, going forward, to some degree you're at the mercy of whatever the developer decides to do with it.
* You're trying to adopt a platform that was, to some extent, designed around surveillance of the user. You can disable a lot of snooping, but you would design it very differently if privacy&security were goals.
Librem5 is sorta an option, if you can afford it, though they still use closed hardware black boxes. (Also, even when two black boxes are "isolated", and you think you control the communication channel, you don't necessarily.)
It's too bad that FirefoxOS didn't work out. The Gecko layer and up could've been moved to a purer Linux stack (ditching the Android build tree monstrosity), and to more trustworthy hardware.
Personally, I'm hoping we go back to the original Linux emphasis on mainline kernel, maintainable open drivers, blob-free. The closest effort I've seen is PostmarketOS [1], but it's still in an early state, and it could also be a little more strict about compromise slippery slopes (e.g., the wiki can be misleading about what works on a device, since it might be talking about a non-mainline kernel, and perhaps they should ban kludges to run closed Android drivers). I wish I had more time to work on pmOS at the moment (but am job-hunting, and my new open source work has to be much more near-term employable than this).