Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keep Android Open

f-droid.org

Post reply on HN
Print view View original

521–530 of 764 posts

Re: Keep Android Open

#521

Post by krzyk »

tux1968 wrote: post #74
Xelbair wrote: post #54

Earlier quoted context omitted.

No, because it isn't something that should be up to google's control.

Why not? It's their operating system, and they're trying to balance quite a few competing priorities. Scammers are not a threat to dismiss out of hand (i've had family who were victims). For it to be truly considered open source, you should be able to fork it and create your own edits to change the defaults however you wish. Whether that is still a possibility or not, is a completely separate issue from how they proc…

It's their only if they use it.

Re: Keep Android Open

#522

Post by [deleted] »

aiauthoritydev wrote: post #511
sulam wrote: post #510

Earlier quoted context omitted.

I'm far from a Google apologist, but at the end of the day don't they have the right to write software however they want it? You have the right to build things the way you want to, fork Android, etc etc. If you're trying to say you have the right to tell Google what the code their employees write can do, well, I don't really agree with that. Sounds coercive, honestly. I wouldn't want them to do that to you and I don'…

It is little surprising a lot of smart people somehow miss this simple logic. Android is massive and extremely popular and I know several people who have been scammed already. It is important that Google makes this harder for scammers. Google is not doing this to harm developers but to protect their users.

[deleted]

Re: Keep Android Open

#523

Post by devsda »

sulam wrote: post #510
greatgib wrote: post #180

Earlier quoted context omitted.

Even restricting the mitigation to "students and hobbyists" is bad. I should have the right to have parents, friends or anyone use a "free" store that is not under control of Google if the user and app developer wish so. But also, somehow there should be something done to avoid the monopoly forcing to use the Google services. Like major institutions like bank, gov and co being forced to provide alternatives like a we…

I'm far from a Google apologist, but at the end of the day don't they have the right to write software however they want it? You have the right to build things the way you want to, fork Android, etc etc. If you're trying to say you have the right to tell Google what the code their employees write can do, well, I don't really agree with that. Sounds coercive, honestly. I wouldn't want them to do that to you and I don'…

Does a business have right to produce whatever it wishes even if it affects the environment ?

Does a business have right to pay literal pennies per hour if it manages to find people willing to work at that pay ?

Does a business have right to lace food products with addictive substances for repeat customers and profit ?

All these cases are already happening today at some level depending on who you ask. But they don’t tilt to extremes because we have laws in place to maintain balance between business needs and collective good.

This move by Google will tilt that balance forever towards absolute duopoly in mobile computing space. It is time for legislation to avoid that.

Re: Keep Android Open

#524

Post by microtonal »

aiauthoritydev wrote: post #511
sulam wrote: post #510

Earlier quoted context omitted.

I'm far from a Google apologist, but at the end of the day don't they have the right to write software however they want it? You have the right to build things the way you want to, fork Android, etc etc. If you're trying to say you have the right to tell Google what the code their employees write can do, well, I don't really agree with that. Sounds coercive, honestly. I wouldn't want them to do that to you and I don'…

It is little surprising a lot of smart people somehow miss this simple logic. Android is massive and extremely popular and I know several people who have been scammed already. It is important that Google makes this harder for scammers. Google is not doing this to harm developers but to protect their users.

You already get a pretty scary warning when you try to install an app that was downloaded outside the Play Store. If people still install malware, that's the responsibility that comes with freedom. Your line of reasoning can be applied everywhere in life - people should not be able to do their own bank transfers or use a credit card, I know several people that who have been scammed already.

Moreover, there are better ways to protect against malware: 1. educate people; 2. rather than using whitelisting, use blacklisting (similar to XProtect on macOS).

Finally, the argument is not very strong on Google's side, since the Play Store itself has had its history of scams. Which, again is easier to protect against by educating people. No, don't put your banking information in a random app you downloaded from the Play Store (use the app that your bank tells you to). Do not install random keyboards from the Play Store. Etc.

Re: Keep Android Open

#526

Post by microtonal »

fragmede wrote: post #500
greatgib wrote: post #180

Earlier quoted context omitted.

Even restricting the mitigation to "students and hobbyists" is bad. I should have the right to have parents, friends or anyone use a "free" store that is not under control of Google if the user and app developer wish so. But also, somehow there should be something done to avoid the monopoly forcing to use the Google services. Like major institutions like bank, gov and co being forced to provide alternatives like a we…

But unfortunately, it turns out that some people you interact with aren't actually your friend. That guy that seems totally legit and just wants your sister to install his fun little game/app that he wrote is actually trying to get her to install an app that's going to track your location and read all your messages and copy all your photos. To keep her safe from the "actually" bad people, of course.

By default their app cannot though because Android uses proper sandboxing and gated API access. So you actually have to give the app location access, access to your messages and access to your photos.

Well, unless you use one of the many crappy Android devices that never get security updates, are running old kernels, old vendor security patch levels, miss all Android security patches, except applying the backported security bulletins every three months (1-2 months late). Yet, Google is happy to certify them as Android devices.

It was never about security, it is about control. If it was about security, they would have revoked the GMS licenses of pretty much every vendor outside Google themselves and maaaaybe Samsung, until vendors actually started caring about security. If it was about security, there would not be as many scam apps in the Play Store itself.

Back to your sister, the proper solution is to educate her (and everyone else) not to give apps unfettered access when they ask you to, plus let Google implement more security measures that systems like GrapheneOS already have (contact scopes, sensor permissions, network access permissions, etc.).

Re: Keep Android Open

#527

Post by cube00 »

largbae wrote: post #462

Does the AI boom help with this? Can we donate enough token-budget for GrapheneOS to maintain a fully functional fork?

Good luck, no bank will touch a non-Google blessed platform with a 10 ft pole.

Re: Keep Android Open

#528

Post by microtonal »

crvdgc wrote: post #517
cwillu wrote: post #299

Earlier quoted context omitted.

It won't though, because there's a ecosystem of banking/insurance/whatever apps that have bought into the android/iphone lockdown mindsete that people will simply be locked out of. Open alternatives can grow when there is a viable means of slow growth, and cutting off the oxygen to such things is the implicit intent.

In theory, it's possible to have a third party (other than Google or Apple) to provide attestation on third party hardware. You can have a separate core and kernel to run such code. They don't have to be powerful, but they'll need to be small enough to be verified by the said provider. For most of the code that doesn't need attestation, they can be executed on normal hardware. The provider also has to convince the re…

GrapheneOS supports remote attestation, but banks have to add the fingerprint of the official GrapheneOS verified boot keys:

https://grapheneos.org/articles/attestation-compatibility-gu...

Some banks even do.

Re: Keep Android Open

#529

Post by microtonal »

matheusmoreira wrote: post #424
arcanemachiner wrote: post #148

Earlier quoted context omitted.

If this finally pushes adoption of truly open Linux phones, then this will end up being a good thing, and the greatest favor that Google could do for the open source community. Tragically, Linux phones have languished and are in an absolute state these days, but a lot of the building blocks are in place if user adoption occurs en masse. (Shout out to the lunatics who have kept this dream alive during these dark years…

There's no point. Remote attestation means your device needs to be corporate owned to be trusted. Even if you had your own linux phone, it wouldn't be able to interface with institutions such as banks and governments. They trust Google's keys, not yours. This doesn't quite end free computing, it just kills it for normal people and ostracizes us hackers who insist on owning our systems.

GrapheneOS supports remote attestation:

https://grapheneos.org/articles/attestation-compatibility-gu...

Some banks have added their verified boot keys. I think it helps that GrapheneOS is well-known by now for great security practices (most likely more secure than all vendor phones out there).

Re: Keep Android Open

#530

Post by microtonal »

fenykep wrote: post #369
spacebuffer wrote: post #161

Earlier quoted context omitted.

For me as a desktop linux poweruser, I find this potential transition pretty intimidating, I've never flashed a phone with a custom rom let alone switch to a completely different OS, and I am not sure if the phone can even be reset to its original OS, if things go south.

/e/OS at least has a browser based installer[0] for quite some supported phones. I definitely recommend trying it out, installing a custom os on my phone gave me the same feeling when I first ran debian on a laptop struggling under windows (even though the performance gains aren't that apparent in my opinion). [0] https://e.foundation/installer/

The /e/OS installer is terrible though and often fails, even on their officially supported phones (like Fairphone). The standard recommendation in their forums is nah, just install /e/OS through the command-line.

Also, /e/OS has pretty bad security practices (shipping very old kernels, very old vendor firmware, and missing most AOSP security patches).

Also, be careful to follow the instructions really carefully. For some devices it's really easy to get the phone in a boot loop, where the only resort is to get your vendor to repair it. E.g. Fairphone 6 has downgrade protection and will become a brick if you relocked the phone when the old system's Android SPL is newer than the new system's.

Post reply on HN