Live data from Hacker News

Keep Android Open

keepandroidopen.org

851–860 of 907 posts

Re: Keep Android Open

#851

Earlier quoted context omitted.

>It's a different approach to security That's like saying using a hole in a wall is a different approach to security than putting a lockable door in a wall. Sure no security is s different approach to security, but it's not an effective one. >There are no malicious apps in GNU/Linux repositories Maybe not intentionally malicous, but there have been bugs that can cause applications to act maliciously such as deleting…

I hope you consider strict threat modeling when deciding which approach to security is preferred. How about a threat of Google removing your control of the OS [this thread] and [0]? Or Google delaying security patches [1]? [0] https://news.ycombinator.com/item?id=45017028 [1] https://news.ycombinator.com/item?id=45208925

>Google removing your control of the OS

That is a feature of Play Services and not a part of AOSP which is what we are talking about.

>Or Google delaying security patches

Like it or not coordinated vulnerability disclosure is a thing in the industry and is done by other Linux distros too.

Re: Keep Android Open

#852
post #844

Earlier quoted context omitted.

> So what? That sounds like competition, which is healthy in a free market. No, it's not. Under capitalism, if Amazon could just take your book and start selling it without paying you a cent then nobody would be incentivized to write books anymore. That's the entire point of copyright. I don't know what your business is, maybe you really carved out a niche that works for you, but it's not built on top of solid princi…

> That's the entire point of copyright. And the entire point of copy/left/ is to make the code a public good, a commodity. Everyone owns the code I write, and everyone is entitled to make a business from it. If they have better marketing than me, earning a lot more money than me with the verbatim program, that sounds like my software was priced wrong and I should set the price higher. How high -- $50,000/copy? Who kn…

I understand the motivation of FOSS just fine, majority of my published side projects are AGPL licensed. I'm also glad that you found a niche selling FOSS software and wish you best of luck, I really do, but your comment doesn't make a lot of sense in terms of economic principles.

> If someone wants to make themselves my distributor, they /should/ get paid for that.

I have to admit you're the first person I've ever talked to who would be happy to let others commercially exploit the fruits of their labor without any sort of compensation, while actively trying to make a living from that labor yourself, fascinating!

> That kind of competition -- yes, it is competition -- would inspire /cooperation/. That would give both of us, the distributor and myself, incentive to work together to maximize both of our profits.

If you really want to call that "competition" it's unfair competition, more specifically free riding. You make the software, they sell it for cheaper and keep all the money, that's the premise of my concern because your license allows it. They don't really have an incentive to work with you because their goal is rapid exploitation of their victims.

> When I receive money for my program, $12/year, they loose a customer of their service, -$36/year.

Categorical error. You didn't make that money by exploiting their labor, you made that money by making a better product with your own labor. That is real competition unlike the scenario we're discussing.

> That means: my software has /increased/ the total value of my competitor, and we are /both/ making profit. My software literally expanded their market.

Sure, the OEM makes the tablet and you make the software which is an obvious symbiotic relationship. It's also a categorical error because it's not comparable to the scenario we're talking about.

> But I don't think they will, because /they know/ that anyone else can do exactly what they're doing.

Why would they care? It's not like they're investing any real effort into it. They just need to make a few sales to offset the ~30min cost of setting up a cron job and creating a listing.

> And if they improve my program

They won't, that's not the type of actor I'm concerned about.

> And if I don't win, the user /does/. They get a better product at a better price. That's the WHOLE POINT of free software, that it's good for the user, not for the developer.

That's a really weird take on the free-riding problem. Yes the user wins for a few months before you go out of business - that is generally bad for users because it means the end of support.

> You have an obsolete understanding of the world

Yes, clearly. This is the first time I've read about a story like yours and I've read a dozen stories about high profile projects being forced to relicense from AGPL to BSL/SSPL or another non-free license, stories of people having their projects cloned and having their lunch stolen overnight.

People would rather watch ads than spend $1 to remove them, they'll visit a small business to get extensive advice and then buy from Amazon because it's 10% cheaper, they'll buy a terrible quality $2 gadget from Temu over a locally manufactured, high quality gadget for $10, but you want me to believe that given the choice, most people wouldn't take a "75% off" deal in a heartbeat...

Re: Keep Android Open

#853

Earlier quoted context omitted.

Android dev at a large company - I've been talking with the folks at Graphene about options for attestation without using Google's API and it looks like there's actually a lot I can do for attestation without them, as long as I add their cert chain to a backend service. It's a bit of a pain because Google just does that for me normally, but we _can_ support it. It's probably only a sprint of effort give or take. But…

Why do you need attesation? Why do you think Google should own that device and not the user?

You're conflating 2 different concepts. Attestation comes in many shapes and the AOSP version of attestation is based on x.509 cert chains and manufacturer roots. The only part of that owned by Google is the revocation list.

Play Store Attestation makes it all a lot simpler to use as a developer as it handles all the fiddly bits of cert attestation and also does PlayStore based app integrity checks.

Not using attestation isn't an option: we've seen in-the-wild attacks on our service using rooted devices and modified APKs.

We've implemented the lowest LOE attestation, but the more I'm learning about the AOSP standard the more I'm interested in pivoting, at least for Graphene support.

Re: Keep Android Open

#854

Earlier quoted context omitted.

Android dev at a large company - I've been talking with the folks at Graphene about options for attestation without using Google's API and it looks like there's actually a lot I can do for attestation without them, as long as I add their cert chain to a backend service. It's a bit of a pain because Google just does that for me normally, but we _can_ support it. It's probably only a sprint of effort give or take. But…

Why do you need attestation? It seems to always either serve no real purpose (e.g. Bank apps) or be anti-user (DRM) (except for perhaps enterprise managed devices for companies with serious infosec requirements)

Replied below but TLDR (and not fixing myself) is that security requirements of the app are such that a compromised APK or rooted device running modified android could gain privileged access to sensitive information by bypassing/deep faking some auth mechanism. This isn't hypothetical: it's attacks observed in the wild that we've been forced to respond to.

Re: Keep Android Open

#855

Earlier quoted context omitted.

I wish you were wrong, but I don't disagree with assessment. I am on grapheneos ( edit: on pixel ) now, but even that should only be a pitstop now since google has decided to show its hand in such a nasty ( if not that unexpected ) manner.

Everyone is quick to ascribe malice without understanding why changes are made. It's never done for the reasons you think. Without a formal relationship between Graphene and Pixel, things were operating out of luck. This is why the next target hardware is starting with a business relationship. Even desktop Linux is most successful when business relationship between a vendor and the distro maker. Everything else is ri…

It is not quick. Whatever goodwill google had, it is gone based on their actions alone. And this is beside the point, because, I am not judging on what they intended to do, but what their actions, including after intense community backlash, were. In other words, their intent is irrelevant given the circumstances. Their actions, however, even without intended malice, will cause tremendous damage all around.

Re: Keep Android Open

#856
post #844

Earlier quoted context omitted.

> That's the entire point of copyright. And the entire point of copy/left/ is to make the code a public good, a commodity. Everyone owns the code I write, and everyone is entitled to make a business from it. If they have better marketing than me, earning a lot more money than me with the verbatim program, that sounds like my software was priced wrong and I should set the price higher. How high -- $50,000/copy? Who kn…

I understand the motivation of FOSS just fine, majority of my published side projects are AGPL licensed. I'm also glad that you found a niche selling FOSS software and wish you best of luck, I really do, but your comment doesn't make a lot of sense in terms of economic principles. > If someone wants to make themselves my distributor, they /should/ get paid for that. I have to admit you're the first person I've ever t…

> I have to admit you're the first person I've ever talked to who would be happy to let others commercially exploit the fruits of their labor without any sort of compensation, while actively trying to make a living from that labor yourself, fascinating!

What's fascinating is that you just described every employee, ever. At this point, I'm giving up on you. Consumers are price sensitive? Please, they buy Funko Pops and Frappachinos by the millions. It's not about cost, it's about convenience and authenticity. People will pay for convenience, for software that does what they want, from its official source.

It's cheap to sling bullshit like yours and costly to refute it. It's costlier to build a cash-positive business selling copies of free software, in the face of that code, and binary builds, being available -- by others, for no cost -- in various package mangers and popular source repositories.

You're just wrong, dude. You don't know what you're talking about. I'm tired, and done, arguing with you.

Re: Keep Android Open

#857

Earlier quoted context omitted.

Counterpoint: vast majority is not making those choices, and if you insist on defying the mainstream, you gradually become separated from human society. This isn't solvable through individual choice. It's a coordination problem - and coordination problems are what underlies every actually hard problem that humanity is struggling with. War, poverty, authoritarian regimes, corporate overreach, environmental destruction…

The direction of society is the aggregate of our individual choices. I'm no expert on coordination, but I think we ought to start with ourselves and not spread misery like "your voice doesn't matter" or "humans can't coordinate at scale".

Interesting exchange! IMO you're both right.

Re: Keep Android Open

#858

Earlier quoted context omitted.

I don't argue that the problem isn't serious. I just want to tell that giving up is not the solution. I use a GNU/Linux phone and refuse any banks or services that don't work there. Yes, it's challenging and I have to make compromises because of it. Such is life.

Having a rooted android 11 phone for years was never a problem. My bank apps worked just fine. Even for work stuff (usually). It's on the personal side where I actually started to value having a virtual credit card on my phone with Google pay or apple pay. The stack to enable that securely is only on android and iOS and there's nothing else out there that has that. Open source community needs a full stack for attesti…

Seconded. The NFC payment feature is useful on mobile in a way that generic "online banking" just isn't IMO. In the same category are transit apps, ride-hailing apps, social messaging, and a (very) few other others. The problem is that payment really does require a secure stack, as you describe.

Re: Keep Android Open

#859
post #849

Earlier quoted context omitted.

This is like calling a Tesla car a spacecraft because one got launched by a rocket. It's like saying you're a free man in prison because you don't want to go anywhere. All the apps you've made either can't connect with other people or require them to be local and visit once a week or be able to jump through the same hoops as you and own a machine to install the app. "I can install an app but my definition of an app i…

These are the most hyperbolic metaphors I have seen on HN within at least the last few months.

Thanks and of course, it's used to highlight how ridiculous you are being in considering an app, that doesn't function as an app, an app.

The tesla car is a vehicle traveling through space, technically a spacecraft it's just literally not what anyone thinks of when they mean spacecraft.

The prisoner reference is an allusion to the usual philosophical debate on how small man made borders need to be to be considered a prison, here's a nice blog post on some parallel thought's about it[1]. The main point being most people don't believe the borders of a country a prison or if they were stuck in a state, or smaller country, a district, a building, a room. If it's only a building then what of prison camps? refugee camps? A city with its' one road washed out? Australia's a fine island to be stuck on but marooned on a desert island and suddenly people are saying they're trapped.

You are literally saying a 7 day limit on a piece of software working still makes it count as what people consider an app and have been arguing that people are wrong for calling apple out on not letting you install your own apps for free. You're as technically correct as saying you can use a tesla car as a spacecraft.

[1] https://philosophersmag.com/philosophical-conversations-in-p...

edit: just remembered the immortal thing, fair enough, but then again highlanders are considered immortal even though chopping off their heads kills them.

Re: Keep Android Open

#860

Earlier quoted context omitted.

Looks like GrapheneOS will be available on another "major Android OEM” soon [1]. Regulation should prevent Google from subsidising manufacturers to use Android. Arguably the recent antitrust legislation [2] applies in this case because they're effectively paying manufacturers to place that horrendous and impossible to remove search bar on the home screen. [1] https://www.androidauthority.com/graphene-os-major-android…

GrapheneOS is in some ways not an open OS. The official builds don't provide root access. So for example apps are able to hold your data hostage from you. I get that this is in the name of security hardening. And you can make a build that has limited root access and is officially supported. But GrapheneOS isn't the end-all solution to computing freedom. Although hopefully on those devices you will be able to install…

Root access doesn't magically make an OS "open". You can disable System Integrity Protection on macOS and get full root access. That doesn't make it an open OS in any way. Root access fundamentally breaks the security model of Android. It's totally unsuitable for production environments. See https://madaidans-insecurities.github.io/android.html#rootin...
Post reply on HN