Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We see Project Pegasus, we must have Open Source Smartphones: let’s discuss

theguardian.com

Post reply on HN
Print view View original

31–40 of 49 posts

Re: We see Project Pegasus, we must have Open Source Smartphones: let’s discuss

#31

Post by pjmlp »

cassianoleal wrote: post #30
pjmlp wrote: post #19

Earlier quoted context omitted.

Nope, it can be traced back to a random nickname on the Internet, using a computer somewhere in the globe.

That may be so, but it's usually been through code reviews, pull requests and whatnot - which means a maintainer somewhere has approved that code. In any case, "a random nickname on the Internet, using a computer somewhere in the globe" is a lot more information than none. Finding out that that's the case for a given project is part of traceability.

How do ensure it wasn't a malicious maintainer?

That information is meaningless if traces back to an empty room.

Re: We see Project Pegasus, we must have Open Source Smartphones: let’s discuss

#32

Post by manquer »

rambojazz wrote: post #8

When we tech people warned about this, the answer was always "I got nothing to hide". Now that it affects journalists, they are all shocked and write articles. We need till it hits politicians, then we can have new laws.

In India it is hitting politicians including the leader of the opposition. Sadly nothing much is going to be done though, it is too late there for any real change in India through legislatures

Re: We see Project Pegasus, we must have Open Source Smartphones: let’s discuss

#33

Post by manquer »

zimpenfish wrote: post #26
stonogo wrote: post #14

Earlier quoted context omitted.

How many people can authenticate a dollar bill? How many people can validate a cryptographic signature? How many people can direct a blockbuster action movie? The point is, right now, nobody can audit these things. Once someone -- anyone! -- can, everyone else can benefit.

>How many people can authenticate a dollar bill? [...] nobody can audit these things. USGOV has a pretty comprehensive guide on how to validate them: https://www.uscurrency.gov/sites/default/files/downloadable-...

There is also plenty of documentation and books to learn coding and start auditing if you want to.

Fake validation is less like coding as to catch a really well made fake you would need years of experience seeing all sorts of fakes , while coding needs only experience to see what is good code to able to catch most issues

Re: We see Project Pegasus, we must have Open Source Smartphones: let’s discuss

#34

Post by manquer »

shoto_io wrote: post #28
fullmoon888 wrote: post #21

Earlier quoted context omitted.

You clearly don’t understand the transparency and power of open source code. Fair.

Helping me to understand would be appreciated and in the spirit of HN. Mocking me? Not so much.

Open source is like Open courts or Right to Information.

Just like anything going in secrets courts is bad for judicial integrity, or RTI laws can help keep government somewhat honest, Open source can help like any other transparency framework.

Just transparency is not a magic solution , open source alone is not going to solve everything. It is just one among many other controls we need.

Re: We see Project Pegasus, we must have Open Source Smartphones: let’s discuss

#35

Post by manquer »

rich_sasha wrote: post #20

I want privacy. I also sort-of buy the "nothing to hide" argument - as another comment below says, for most people risk-adjusted cost of privacy loss is greater than the cost of maintaining it. But this article writes about the very people who have plenty to hide (for good reason!). I think it's a bit misleading to say investigative journalists have "nothing to hide" - confidential sources, on-going stories, contacts…

More than nothing to hide, you and I have nothing worth exploiting our devices over yet.

However as the cost of exploits and ease of mass surveillance becoming cheaper . That statement has made less true for more and more people.

In the NSO target list for India I am seeing all sorts of people like virologists and journalists I wouldn't have thought were doing important enough to be tapped. More than the tapping that surprised me.

Sooner or later either we will be worth slightly more than cost or costs will become cheap enough.

However at that point it will be too late. Like the infamous quote goes " first they came for communists/Jews"

Re: We see Project Pegasus, we must have Open Source Smartphones: let’s discuss

#37

Post by danogentili »

CodeGlitch wrote: post #29
fullmoon888 wrote: post #2

Let’s start to discuss where we stand with open source smartphones, both in terms of software and hardware. Really worried about privacy and human rights. We cannot trust Apple and Google on this..

The article says that Pegasus is installed via a zero-day (presumably via a phishing attack or similar). I love opensource software, but it is not a magic bullet that stops the likes of zero day attacks. In other words, using a fully opensource stack would not prevent something like Pegasus if they exploited a zero day. Purchasing phones which ensure frequent software patches for a number of years is a far better tac…

Partially true, but moving away from proprietary hardware and software and especially cloud services would still greatly reduce the attack surface, and is something I committed to fully half a year ago by purging Google/Play services from my phone, having already wiped Windows off my drive five years ago, replacing it with Arch.

This still wouldn't protect me from a targeted surveillance attempt like Pegasus, but it does protect me from automated mass surveillance in the cloud, and at least partially reduces the attack surface, by getting rid of unvetted, unreviewable, backdoored proprietary software.

0 regrets, only privacy vibes every since.

Re: We see Project Pegasus, we must have Open Source Smartphones: let’s discuss

#38

Post by rchaud »

rambojazz wrote: post #8

When we tech people warned about this, the answer was always "I got nothing to hide". Now that it affects journalists, they are all shocked and write articles. We need till it hits politicians, then we can have new laws.

Please link to an article where the journalist's point of view on surveillance tech was what you claim.

Re: We see Project Pegasus, we must have Open Source Smartphones: let’s discuss

#39

Post by ac29 »

shoto_io wrote: post #12
FractalParadigm wrote: post #9

Earlier quoted context omitted.

Isn't that a large part of the open-source nature? Audit the code or hardware designs yourself, determine their trustworthiness from that. It's much harder to trust something when you can't examine the inner workings of it.

Ok thanks, I get that. But how many people can do that? Like 0.001% of the population?

I think its fair to call it 0%. Auditing a large, modern code base is going to be impossible for a single person. For example, the Linux kernel is 27.8M lines of code (as of Jan 2020, [0]). Yes, a lot of that code is for drivers you wont use, or platforms you aren't running on. But still, no one person is going to be able to get through all of it with enough attention to detail to notice things like subtle race conditions, especially if they were inserted maliciously.

[0] https://www.phoronix.com/scan.php?page=news_item&px=Linux-Gi...

Re: We see Project Pegasus, we must have Open Source Smartphones: let’s discuss

#40

Post by stonogo »

zimpenfish wrote: post #26
stonogo wrote: post #14

Earlier quoted context omitted.

How many people can authenticate a dollar bill? How many people can validate a cryptographic signature? How many people can direct a blockbuster action movie? The point is, right now, nobody can audit these things. Once someone -- anyone! -- can, everyone else can benefit.

>How many people can authenticate a dollar bill? [...] nobody can audit these things. USGOV has a pretty comprehensive guide on how to validate them: https://www.uscurrency.gov/sites/default/files/downloadable-...

Please note the entire absence of the dollar bill from that document.
Post reply on HN