61–70 of 186 posts
Android can give you privacy and enough security for most people. This can't add much more as long as its running on the same devices.
This is a great effort and I support it, but let's not imagine this will make our phones that much more secure.
Security focused and Android in the same sentence? All I can say is good luck with various firmware, custom services and drivers.
Seriously though, I hear Apple is super great on privacy now as long as you take their word for it and not their track record of being a member of PRISM https://en.wikipedia.org/wiki/PRISM_%28surveillance_program%... , etc
Earlier quoted context omitted.
While with each Android interaction, Google locks down the amount of C and C++ code that gets exposed to outside world. https://android-developers.googleblog.com/2019/05/queue-hard... As such I have a very hard time believing that Librem with be as secure as modern Android.
There is security, and then there is freedom. You can have the most secure system in the world -- but if there are state sponsored, or company back back doors it means nothing. In FOSS initiatives spent ages building fee and and open software, combating proprietary systems and software that they had no control over. All that would be loss just to give it up now that we have moved from PCs to phones.... I for one want…
Librem seems to have the correct way forward, reject the big mess of Android and catch up to it with completely Open pieces. https://puri.sm/products/librem-5/ They're making good progress and I can't wait to be able to update my handheld device with mainline pieces for as long as anyone who still uses one cares to update it. Currently my Samsung Android device is at Dec 2018 patchlevel and nothing I can do about it.
I could carry a second device for personal use, but am unlikely to.
What does it matter if you are still running proprietary software with direct memory and CPU access on your network, camera, ... Android can give you privacy and enough security for most people. This can't add much more as long as its running on the same devices. This is a great effort and I support it, but let's not imagine this will make our phones that much more secure.
It supports the Google Pixel range of phones only so far. So in order to get that is more secure and more independent from Google I have to buy a Google phone?
There are not that many phone manufacturers that even allow you to change the trust anchor (which makes any of this even remotely possible). For example, Samsung uses e-fuses to burn in their signing key, rewriting recovery will permanently trip their attestation (Knox); other manufacturers use similar practices. Pixels are one of the only currently available phones with user-controlled trusted boot in mind.
Earlier quoted context omitted.
There is security, and then there is freedom. You can have the most secure system in the world -- but if there are state sponsored, or company back back doors it means nothing. In FOSS initiatives spent ages building fee and and open software, combating proprietary systems and software that they had no control over. All that would be loss just to give it up now that we have moved from PCs to phones.... I for one want…
What freedom does PureOS offer that AOSP without Google services lacks?
In some facets, AOSP is not a complete and working OS as is. In particular, I have personally had many issues with GPS location for the past fews years. Out-of-the-box, GPS simply does not work without additional non-free software to help it out. Additionally, many (that is, 95%) of all Android apps that you would find on the Google Play store do not function properly without Google services (which AOSP does not have). Applications that are built to run on stock AOSP are not the 'Snapchats' or 'Instagrams' of the world. They are typically FOSS projects that are built out of passion, but recieve little funding or corporate support.
These shortcomings often carry over to third-party ROMs, such as Lineage.
So in my experience, as someone who used to flash a new Android ROM every week, it is not about freedom - its about basic functionality. One could also argue that, since the world operates on all kinds of propietary platforms that aren't available on stock AOSP, so do we also lack the freedom to use AOSP as our daily driver - simply because it often does not interface properly with these propietary platforms.
Edits: grammer and clarifications
It supports the Google Pixel range of phones only so far. So in order to get that is more secure and more independent from Google I have to buy a Google phone?
Exactly my question. I have seen a bunch of these OSs, all useless because there is no build for my phone and no described path for making one. I would love to get the T-Mobile spyware off my phone. What do i do?
Earlier quoted context omitted.
While with each Android interaction, Google locks down the amount of C and C++ code that gets exposed to outside world. https://android-developers.googleblog.com/2019/05/queue-hard... As such I have a very hard time believing that Librem with be as secure as modern Android.
There is security, and then there is freedom. You can have the most secure system in the world -- but if there are state sponsored, or company back back doors it means nothing. In FOSS initiatives spent ages building fee and and open software, combating proprietary systems and software that they had no control over. All that would be loss just to give it up now that we have moved from PCs to phones.... I for one want…
Okay, so you're saying: "If a backdoor is present than your security prioritization doesn't matter, the result is bad." I understand, but:
1. If there is a back door in open source code that goes unnoticed (and it certainly does) because of persistent but bad practices in the open source community (e.g., a stubborn refusal to stop using C-like memory management semantics and primitives when dealing with untrusted inputs), then why don't said accidentaly backdoors invalidate the open source work?
2. Does "control" actually matter in the context of AOSP? Strictly speaking, you have essentially everything you need up utill you hit the hardware drivers. You can easily rewrite that to your hearts content.
3. Given Librem's recently move into commodity-based social products (and the poop-from-great-height attitude they initially adopted), are you genuinely sure that they're actually trustworthy actors? If they're coerced, how will yu attest that they never injected a deeply subtle backdoor on millions of lines of code which you'd like to be unique and less scrutinized?
I can't really work out why you feel the way you do, so I ask these questions.
Earlier quoted context omitted.
What freedom does PureOS offer that AOSP without Google services lacks?
I believe there is a general lack of awareness of what AOSP is without Google services and add-ons on top of it. In some facets, AOSP is not a complete and working OS as is. In particular, I have personally had many issues with GPS location for the past fews years. Out-of-the-box, GPS simply does not work without additional non-free software to help it out. Additionally, many (that is, 95%) of all Android apps that y…
The big contribution of Purism phones is that more open hardware. After that, the real question we should ask is, "What software platform can offer us the greatest values in the multi-dimensional optimization problem we face?"
It's true though that you wouldn't just flash AOSP. But it's also true that dismissing Graphene BECAUSE it is based on AOSP is unfair.