My only gripe with bringing desktop Linux to phones is that desktop Linux is a security nightmare. Someone with more experience please chime in, but the whole thing is C, no usable sandbox (a bug in firejail will make the untrusted code run root..) and the old xkcd comic is still true: the only thing a malicious actor can’t do is install a video driver. That is, your user account with all the important data is basica…
Manufacturing the Librem 5 USA Phone in the US
141–148 of 148 posts
Re: Manufacturing the Librem 5 USA Phone in the US
#142My only gripe with bringing desktop Linux to phones is that desktop Linux is a security nightmare. Someone with more experience please chime in, but the whole thing is C, no usable sandbox (a bug in firejail will make the untrusted code run root..) and the old xkcd comic is still true: the only thing a malicious actor can’t do is install a video driver. That is, your user account with all the important data is basica…
https://source.puri.sm/Librem5/community-wiki/-/wikis/Freque...
Thanks for the link!
Some nitpicks (not directed at you at all):
> When we develop security solutions, we develop them without looking down on the user or thinking of them as som[e]body that we have to protect almost like a parent-child relationship. We try to build a solution that gives them control over their own security.
That's many words for saying we don't have any sort of security measures.
> Because all the code in the root file system of the Librem 5 is free/open source, all of it can be reviewed to verify that it doesn't contain backdoors and doesn't do anything that the user doesn't want it to do
At most it answers privacy but not security. Also, non-existent security can so easily add a "backdoor", especially on top of an all-memory-unsafe environment where memory bugs are everywhere.
But I will give them that they do list basically all my gripes with it:
> It lacks a secure boot process to verify that none of the boot files have been changed. > It lacks a hardware-backed key store. > The apps are not run in a secure sandbox. > PureOS doesn't have shim kernel drivers that do most of their execution in userspace libraries like Android and iOS. > PureOS doesn't have low-level protections such as Control Flow Integrity and ShadowCallStack in Android and Pointer Authentication Codes in iOS. > Most of the operating system and applications are written in memory unsafe languages like C and C++. > The Librem 5 lacks a permission system where each app is required to ask the user for permission to access parts of the phone like Android has.
And unfortunately the answer to these is that there are some distant plans for some of these. Hopefully both desktop and mobile Linux will improve heavily in this area in the coming years.
Re: Manufacturing the Librem 5 USA Phone in the US
#143I applaud this accomplishment. I think there will be a push to manufacture more semiconductor-intensive products in the US over the next several years as tensions with China continue to heat up and Taiwan is left as a single point of failure. I know progress is already being made with TSMC building new fabs in the US. I will note that Purism do not say what their production capacity is, and that it would probably be…
> I know progress is already being made with TSMC building new fabs in the US.
Worth noting that TSMC started building the 5nm fab this week in Arizona and said last month they would build a 3nm or 2nm fab at the site as well, and were in the research phase for a potential third fab that would focus on older/cheaper nodes.
Intel is also building a fab in Arizona and in March announced a further $20 billion investment in 2 more fabs at its Arizona site.
I'm not sure if they've started building or even committed yet, but it seems likely that Samsung will build a 5nm fab in Texas as well, in addition to its existing fab there.
So there's quite a bit of progress happening on US-based fabs already.
Re: Manufacturing the Librem 5 USA Phone in the US
#144Earlier quoted context omitted.
The error here is the assumption that only foreign entities are hostile. A "foreign hostile entity" may have lots of information and malicious intent, but they lack legal jurisdiction and the ability to take open, direct action where I live. The most worrisome threat is that they manage to uncover a common interest with some domestic entity and share what they learned—and from that perspective domestic snooping just…
Is it your hobby/part time job to defend China and dump on the USA? Just curious, looking back through your comment history and all.
If you had actually looked back through my comment history you would have seen that I never defended China or claimed that the USA was worse. I am not a fan of governments in general but I will freely acknowledge that the US government is far from the worst example. My comment was purely about domestic snooping vs. foreign from the perspective of the one being spied upon—if one lives in China the roles will obviously be reversed, and in that case one should prefer a foreign entity like the USA gathering intel over the domestic Chinese equivalents. Either could wish you ill but the domestic power will almost always be the more immediate threat. (Not being spied upon at all would be ideal, of course.)
Re: Manufacturing the Librem 5 USA Phone in the US
#145Earlier quoted context omitted.
Maybe you don't know, but Purism tends to publish misleading information. Most of the stuff in that product listing is trivial stuff to produce. The PCB/PCBA entries can basically all be ignored, and all the ICs on those PCBs can basically be assumed to be made in China, except for the NXP i.MX8M which is made in Korea
Do you have a source for where the i.MX8s are made? I tried to figure that out a while back and didn't find a clear answer, although Korea seems likely. (Samsung process which is done at fabs in the US and Korea, but origin documents I found list China for packaging/testing, which is more likely for a Korean fab - but not 100% certain, since chips get flown stupid distances sometimes for packaging, and not 100% if th…
The NXP i.MX 8M Quad processor in the Librem 5 has "Made in Korea" stamped on them and there have been news articles published about how NXP was switching its foundry work from TSMC to Samsung. By the way, the i.MX 8M is designed in Austin, Texas (by the old Motorola division, which turned into Freescale and then was bought by NXP).
For more info, see: https://source.puri.sm/Librem5/community-wiki/-/wikis/Freque...
Re: Manufacturing the Librem 5 USA Phone in the US
#146Earlier quoted context omitted.
Come on, the Purism people have put up a huge effort. You can't just casually the product "massively underwhelming" without stating your reasons for doing so.
Well.. The CPU is multiple generations behind anything else on the market. Power management is basically non existent. They've only recently managed to get cameras working sorta, but not really. It was sold as a customer device, not a damn development platform. They started crowd funding in 2017, and so far have only delivered less than two months worth of devices to customers. Purism is violating the law on a daily…
Yes, the CPU is weak, suspend-to-RAM hasn't yet been added to the mainline Linux driver for the i.MX 8M, camera auto-focus doesn't yet work, and lot of work is needed for full functionality of the Megapixels camera app and use of an OpenPGP smartcard, but you are ignoring all the progress that has been made. Purism started with a new chip that didn't yet have good mainline Linux support and had to make several hundred commits to mainline Linux to support half a dozen new chips. Purism created a new mobile environment for Linux, which 65% of PinePhone users say in a poll is their favorite interface. Purism created the first free/open hardware phone since the Golden Delicious GTA04 in 2014 and manufactured the first phone in the US since the Motorola Moto X in 2013. The Librem 5 contains 6 innovations in the mobile phone industry, which is more innovations than any phone since the Samsung Galaxy S5 released in 2014. This is the first phone ever produced where the manufacturer promises lifetime software updates and the processor will be produced by the manufacturer (NXP) until at least Jan. 2033.
All of this info is on the FAQ: https://source.puri.sm/Librem5/community-wiki/-/wikis/Freque...
Re: Manufacturing the Librem 5 USA Phone in the US
#147How many ICs are actually made in the US? They're pretty mum about it. My guess is that none of them are made in the US. So the phone was assembled in the US from all kinds of parts.
It would be almost impossible to make a phone with parts that are entire manufactured in the US. Most silicon foundry work is done in Taiwan (TSMC, UMC, Vanguard) and S. Korea (Samsung, DB HiTek). See: https://www.cnbc.com/2021/03/16/2-charts-show-how-much-the-w...
However, if you are interested where the Librem 5 parts are made, see: https://source.puri.sm/Librem5/community-wiki/-/wikis/Freque...
Re: Manufacturing the Librem 5 USA Phone in the US
#148This is really cool, but it's $2,000. The problem is the specs don't quite justify a $2,000 price tag. The iPhone 12 Pro Max is $1,099 for 256Gb model. The Librem 5 has 32Gb built in. Granted you can expand storage on the Librem 5, but that's added cost on top of the $2,000. There are other specs to compare, but storage is an easy target. I think the project is awesome, and I'd be very inclined to purchase one, but I…
For perspective a name-brand 256gb microsd card currently retails for roughly $30. The value here isn't in raw specs, it's in privacy and respect for the user, which is a total blow out in favor of the librem.
Yeah I definitely see the value in privacy and respect for the user, and Librem is king there, but that still doesn't justify a $2,000 price tag to me. I wouldn't pay $15,000 for a Ford Pinto because it has bulletproof windows.