Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux phones are more important now than ever

feddit.org

Post reply on HN
Print view View original

501–510 of 515 posts

Re: Linux phones are more important now than ever

#501

Post by ycombigators »

isaacremuant wrote: post #230
dvh wrote: post #220

EU should fork Android. Fund a small team of devs, nothing fancy, no major changes just keep it secure.

The EU (and adjacent countries like UK or Schengen countries) loves surveillance and control of their citizens' speech (except if they're partbof their wealthy elite, in which case, there's nothing to see here).

Claiming control of citizens speech when you have a president literally censoring your media is kind of ridiculous.

The claim free speech is under threat in Europe just demonstrates you are easily led by rabble rousers.

Re: Linux phones are more important now than ever

#502

Post by phendrenad2 »

codethief wrote: post #499
phendrenad2 wrote: post #495

Earlier quoted context omitted.

What nonexistent security model? Isn't Android just stock Linux with an interface layer on top?

Uhh no? One of the biggest differences probably is that Android applications are heavily sandboxed: > Applications are security principals. The main difference to traditional operating systems that run apps in the context of the logged-in user account is that Android apps are not considered to be fully authorized agents for user actions. In the traditional model typically implemented by server and desktop OS, there i…

I just confirmed that Android uses a largely unmodified kernel, so in theory it should be possible to just implement whatever extra components make up the Android system. To your points:

- Sandboxing: Android accomplishes this by running each app in the context of a different UID.

- No root access: Like above, user-installable apps are given separate UIDs. The GUI and other system processes probably also get random UIDs. Probably very little of the Android system runs as UID 0. (However, I don't really believe that keeping the user from doing things as root is a valuable security feature, as long as the user is competent)

- Verified boot: There's nothing specific to Linux/Android about this, right? The bootloader handles checking the signature.

- Hardware-backed key store: Isn't this, as the name implies, "hardware"? So it should be OS-agnostic, right? Maybe Linux doesn't use it, and Android does, but someone just needs to write a driver for it (and maybe some bytecode implementation or whatever, if it's some secure enclave thing, which it seems to be).

- User profiles encrypted independently: I don't think the Linux kernel supports encrypting profiles, this is a userland feature of Android, and could therefore be ported to Linux.

Re: Linux phones are more important now than ever

#503

Post by nicman23 »

63stack wrote: post #302
nicman23 wrote: post #298

Earlier quoted context omitted.

please research before spreading missinformation. the specific gsi rom passes strong out of the box

Saying that custom roms typically fail attestation is not spreading misinformation, it is very correct, and google is closing the door on it fast. It's possible that this one random rom that you mentioned passes it today, but it might not pass tomorrow.

lol that is not how that works. it is client side. they cannot do anything to block it.

Re: Linux phones are more important now than ever

#504

Post by meiuqer »

tsimionescu wrote: post #433
meiuqer wrote: post #217

Earlier quoted context omitted.

What do you mean by 'Belgium is not a nation state', if i may ask?

I mean that there is no Belgian nation - native Belgian citizens are mostly either Dutch-speaking Flemish people or French-speaking Wallons, and generally don't have any significant notion of a shared national identity. Note that this doesn't mean that a state with multiple ethnicities/languages can't be a nation state. Indians, for example, generally have a clear national identity, despite being citizens of a huge f…

I don't know if i agree that Belgians don't have a national identity. I just think that the Flemish nationalist parties push the Flemish nationality identity so hard that Flemish people more identify as Flemish then as Belgian.

However Walloon people definitely feel Belgian and have a Belgian pride.

Also, i don't know if a nation state is defined by having a national identity?

Re: Linux phones are more important now than ever

#505

Post by ulrikrasmussen »

sterlind wrote: post #466
mrweasel wrote: post #341

Earlier quoted context omitted.

The Danish MitID identity "service" is actually pretty clever, except for the app used to approve actions or requests on your behalf. It's designed in a way that ensure that it can verify your age, but reveal nothing else about you. It isn't going to be used for "Porn ID" though. Instead it will provide your age information, basically 15+ or 18+ (I think those are the options), to an identity wallet, which in term wi…

it looks like MitID is basically country-wide SSO, isn't it? then isn't MitID collecting every website you authenticate to via the redirect uri?

Yes, but MitID is also only intended to be used in places where you are not anonymous to begin with, so this is actually OK and also gives you access to a central audit log of where your MitID credentials were used.

MitID is different from the proposed app-based solution for age verification which is designed to not leave a trail. The age verification app will initially be enrolled using MitID (or perhaps by a physical visit to a citizen service point where you can show physical credentials and answer security questions), but subsequent presentations of age verification proofs to service providers will be done without involving a central party.

All in all it is a good design from a privacy perspective. The major issue with it is that ONLY a smartphone based solution is planned, and that there is a high likelihood that it will depend on Play Integrity attestation. This will force everyone to be customers of Google or Apple if they want access to the full internet. I think it is technically possible to also offer alternative solutions based on secure hardware tokens which would still enable people without smartphones to verify their age in a privacy preserving way, but this is not planned.

Re: Linux phones are more important now than ever

#506

Post by aerique »

jeffparsons wrote: post #17

My Android phone prevents me from taking screenshots if an app author doesn't want me to. My Android phone prevents me from recording phone calls at the request of my carrier, even though it's totally legal for me to do so in my jurisdiction. I'm not loving where this is all going.

That's what I love running Android apps in Sailfish OS. I can just take these screenshots.

Then again, this is also what makes me almost throw my Android phone against the wall when I try to do the same on that phone.

Re: Linux phones are more important now than ever

#507

Post by OrangeMusic »

j45 wrote: post #152
lutusp wrote: post #88

Total agreement with the article's conclusions. I'm an Android developer who once had about six apps listed in the Play Store. But as time passed, maintenance became more and more baroque, and a simple Android version change required me to rewrite all my apps or lose my listings. Like many developers, I gave up. Then Google announced a decision to disallow sideloading (not clear when this will take effect) and many t…

Makes me think about mobile first web apps that just run out of the browser. Maybe Palm Pre's had it right all along with the html/js based OS in WebOS at that time. Just a little ahead of their time for OS, and missed challenging the iPhone by a bit.

I'm an Android developer and I really like Android development (Kotlin is a great language, Compose is also enjoyable). But, just like OP, I had a bunch of apps in the Play Store that I just stopped maintaining, and I'm totally disgusted with the app distribution story.

Mobile web apps are a very good solution (plus you can use Kotlin/Compose Web!). It's not adapted to all kinds of apps of course...

Re: Linux phones are more important now than ever

#508

Post by looofooo0 »

NicuCalcea wrote: post #196
looofooo0 wrote: post #172

Earlier quoted context omitted.

There is a special place in hell for people providing non copyable text information in the form of screenshots.

The other day I wanted to send someone proof that a transaction has gone through. A screenshot would have been the obvious choice, but of course, my banking app wouldn't let me do it.

At least in SEPA you have instant payment, which is even better than any proof of the start of the transaction.

Re: Linux phones are more important now than ever

#509

Post by high_na_euv »

AnthonyMouse wrote: post #484
high_na_euv wrote: post #366

Earlier quoted context omitted.

>because screenshots are harder for computers to parse, and that's a marginal security advantage. If the user is going to send e.g. their account number to someone else (for a legitimate reason), it's better that they do it as a screenshot than that you force them to type it as text, because text is machine searchable. Which is worse when that messaging system gets compromised and then the attacker can do a text sear…

Isn't it though? You compromise some email provider so that you have read access to the emails of a million people going back 20 years. Literally many billions of emails with petabytes of attachments. Can you do text search on all of that text? Absolutely, an ordinary PC could do that in a realistic amount of time. Can you search the text within all of those images using some kind of computer vision system? Not witho…

>Absolutely, an ordinary PC could do that in a realistic amount of time

Bilions of emails? No, it cannot, not even store it, let alone process it fast enough to make usable

Re: Linux phones are more important now than ever

#510

Post by BrandoElFollito »

godelski wrote: post #463
BrandoElFollito wrote: post #456

Earlier quoted context omitted.

Unfortunately the idiots are often the nation's security agency, or a large consulting company. You will not have them change their policies if they do not have a good person inside, who will slowly move the boat. I fought for audit findings because they were pissing me off at a personal level and it wirked. But the auditor did not change their procedure, just reverted the finding. Until the next year.

I think you're making the naïve assumption that large organizations are heterogeneous. The people at the top are idiots because the idiots were able to secure advisory positions. They were able to secure positions because those promoting them were either tricked or idiots themselves. This pattern repeated all the way down. So I really do mean grease the wheels. And I really mean we won't kill the beast overnight. But…

> I think you're making the naïve assumption that large organizations are heterogeneous.

Maybe, but this is what I managed to gather through a 30-year career in tech, in three huge companies, from IT management to SVP.

Post reply on HN