Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FSF announces Librephone project

fsf.org

Post reply on HN
Print view View original

101–110 of 669 posts

Re: FSF announces Librephone project

#101

Post by varispeed »

bigstrat2003 wrote: post #4

Ultimately, I don't think the most important challenge is in binary firmware blobs, but the software which people depend upon to run their lives. What does it matter if you can run a completely free software stack on your phone, if your bank software (or your required government ID, as is looking depressingly likely) requires you to run a Big Tech approved phone OS? Perhaps the FSF can't do much about that, but that…

Funny that bank software needs approved phone, but runs absolutely fine in the browser. That to me sounds like collusion - something that regulators should look at. There is absolutely no need for banking app to require "legitimate" Android or other operating system.

Re: FSF announces Librephone project

#102

Post by varispeed »

SoftTalker wrote: post #27
bigstrat2003 wrote: post #4

Ultimately, I don't think the most important challenge is in binary firmware blobs, but the software which people depend upon to run their lives. What does it matter if you can run a completely free software stack on your phone, if your bank software (or your required government ID, as is looking depressingly likely) requires you to run a Big Tech approved phone OS? Perhaps the FSF can't do much about that, but that…

Use the website. I’ve never seen a bank where a mobile app is the only option for remote access. If my bank did that, I’d switch banks.

Monzo bank in the UK doesn't have a web access (apart from very basic page where you can block your card and do nothing else, not even see your balance). They also retired support for older Android phones, so if you happen to use it on an old phone, you are out of banking. I, for security, refuse to install bank apps on my phone that I carry, but I have them on a separate phone that I have in safe place.

Re: FSF announces Librephone project

#103

Post by charcircuit »

tmtvl wrote: post #35
charcircuit wrote: post #17

>Librephone aims to close the last gaps between existing distributions of the Android operating system and software freedom I am so happy they are focusing on Android, one of the most popular operating systems widely used by every day people. This is important work for providing user friendly, free software to users. Let's just hope they don't fall into the trap of disqualifying binary blobs sent as part of drivers v…

Are you hoping the Free Software Foundation _doesn't_ prioritize Free Software ? For people who are okay with random bits of proprietary software doing who-knows-what on their devices there are various alternatives already.

To me:

Open Source Firmware signed by OS > Firmware blob signed by device manufacturer > Firmware blob hardcoded by device Manufacturer

The FSF treats hardcoded firmware blobs as "free" and updatable firmware blobs as nonfree despite there not being a big difference between them in practice. And practical differences like being able to fix security issues benefits users.

Re: FSF announces Librephone project

#104

Post by jancsika »

seba_dos1 wrote: post #85
soupy-soup wrote: post #25

Earlier quoted context omitted.

That's really as far as they need to go; if the userland is compatible with Linux, it can use all of the work that KDE and other organizations have put into building mobile interfaces. These projects have stuff that works, but the lack of firmware for chips that can connect to modern cell infrastructure means that they can't really create an appealing product. The OS layer is where all previous Linux phone efforts ha…

> The OS layer is where all previous Linux phone efforts have failed The OS layer is where the existing projects are thriving, with various distros and shells to choose from to match one's needs and tastes. It's the appropriate hardware that's in undersupply. I'm using a Librem 5, a 2019 design, and if I wanted to switch to something newer I can't because there's no viable upgrade path on the market. No other hardwar…

Does webrender work with the Librem 5? Last time I checked it didn't-- Firefox disallowed it because the etnaviv driver didn't have all the features available needed to enable it. It appears there's been a lot of work on etnaviv recently but I don't know if it affects this issue.

Re: FSF announces Librephone project

#105

Post by varispeed »

ipaddr wrote: post #50
bigstrat2003 wrote: post #4

Ultimately, I don't think the most important challenge is in binary firmware blobs, but the software which people depend upon to run their lives. What does it matter if you can run a completely free software stack on your phone, if your bank software (or your required government ID, as is looking depressingly likely) requires you to run a Big Tech approved phone OS? Perhaps the FSF can't do much about that, but that…

Get a big tech second phone. Cheapest available. Just perform the needed tasks and use your Libre phone for everything else. Does anyone remember having a copy of internet explorer that the bank required (or chrome these days) but using firefox for everything else? Apply that concept to a phone.

Some banking apps require relatively new OS, so if you have an old phone with e.g. Android 8 and you can't upgrade (Android 9 removes certain important features), you are out of luck.

Re: FSF announces Librephone project

#106

Post by hedora »

bigstrat2003 wrote: post #4

Ultimately, I don't think the most important challenge is in binary firmware blobs, but the software which people depend upon to run their lives. What does it matter if you can run a completely free software stack on your phone, if your bank software (or your required government ID, as is looking depressingly likely) requires you to run a Big Tech approved phone OS? Perhaps the FSF can't do much about that, but that…

There is one solution to this problem that many people reading this message can contribute to:

Make sure your app has a progressive web app version that has feature parity with the store apps. That way, the app will work on phones like the librephone, and, if Apple or Google decide to kick you off the store, you and your users have some recourse. As a bonus, it’s compatible with open source — users can modify the app and install it without jailbreaks, root or (for now) sideloading.

React Native supports this (and can mostly be bundled with electron for mac/win/linux support).

Are there other stacks people can recommend?

Re: FSF announces Librephone project

#107

Post by SchemaLoad »

thwarted wrote: post #81
SchemaLoad wrote: post #46

Earlier quoted context omitted.

It is given the environment. But it does highlight the poor security of desktop browsers where they are only trusted to do anything when a phone app approves it. While the phone app is considered secure enough to just stay logged in perpetually without any external confirmation. To hack the banks app you have to find an exploit in iOS or Android which would allow you to read the other apps private storage, which is b…

> But it does highlight the poor security of desktop browsers where they are only trusted to do anything when a phone app approves it. Does it? The browser doesn't do anything, the person sitting at the computer where the browser is running is what performs the actions. The reauthentication and 2fa is meant to authenticate and authorize the user, not the browser. The attack vector of someone else using your phone usi…

That is true. I guess one of the main differences is the bank app can run a faceid check when you open the app and before you make a transaction while websites don't have access to these apis. So they are forced to make you approve the action via your phone.

Re: FSF announces Librephone project

#108

Post by array_key_first »

SchemaLoad wrote: post #16
jojobas wrote: post #8

Earlier quoted context omitted.

Some banks require app confirmation for PC-initiated transactions, using play integrity requiring apps. Cause security, you know.

It's because it's way easier to install malware on PC than mobile. None of us are immune either. In recent times there has been malware distributed by common NPM packages as well as game mods. Every NPM package you install has the ability to steal your browser session tokens and the only thing stopping the attacker from actually logging in and spending your money is the fact it has to be confirmed on your phone.

That doesn't require a bank approved app - we already have authentication mechanisms that are standardized.

People do proprietary bullshit because they want to do proprietary bullshit. Anything else is made up.

Re: FSF announces Librephone project

#109

Post by munchlax »

hnuser123456 wrote: post #54
kovac wrote: post #49

Earlier quoted context omitted.

I think this is the right place to start. A free OS will empower developers to implement technical workarounds that could trick these apps into working there. If the OS is tightly controlled, we have no recourse. Even in the worst case scenario, we could use a cheap big-tech-approved phone for these applications (a glorified digital token) and use the free phone for everything else. When there's enough adoption and t…

And I feel like it undermines any effort to make free, featureful applications if the hardware itself can't be trusted.

You can trust hardware and software that's easy to inspect.

If you can't be sure what's going on and unable to inspect or debug the hardware and software, how can you trust it's doing what you want?

Proprietary hardware and software is already known to work against the interests of the user. Not knowing exactly what's going on is being taken advantage of at large scale.

Let's put it this way: if you can choose between making your own lasagna with a good recipe vs ready-made microwave lasagna. What would you choose? How about your suit? And would you trust an open known to work well pacemaker vs the latest Motorola or Samsung pacemaker? Would you rather verify the device independently or pay up for an SLA?

Re: FSF announces Librephone project

#110

Post by kube-system »

ACCount37 wrote: post #15

Unfortunately, even if you could completely de-blob the kernel itself (and for many chipsets, that would require a considerable amount of reverse engineering work!), smartphones bear the Curse of the Modem. In a modern smartphone, modem is often a part of the SoC itself - and it runs some of the biggest and fattest blobs you've ever seen.

This is the big barrier here, and unfortunately, it is legally impossible to open source.

In most countries, the spectrum that cell phone carriers use is licensed to the carrier, under the condition they only connect devices that are guaranteed to comply with the requirements of using that spectrum. The end user (i.e. the person with the phone) has no license to use the spectrum. So in order to get regulatory certification, basically every modem has to be locked down so that the end user cannot operate it in a way that would violate any rules or regulations for using that spectrum.

So basically, it's illegal to have open source modem firmware. At least, as long as cell phones are operating on spectrum that isn't open for public use.

Ultimately, if you want to open source a modem, you first need to build your own cell phone network.

Post reply on HN