4 ms·

One of the stated reason is "issues with various countries". They really need to be more clear here. What issues, which countries? Are governmental pressures ag

One of the stated reason is "issues with various countries". They really need to be more clear here. What issues, which countries? Are governmental pressures against encryption the real reason for the move? How much weigh these particular issues have over the support cost? That would be quite lame from Cyanogen to be weak that way and may make me reconsider installing this on my phone if they are susceptible to outside pressure. If they are willing to remove encryption features to please totalitarian states, what backdoors are they also willing to include?

sliken 11y ago
Who cares? Seems like it's a pain in the ass to support a custom fork of signal, for little or no value. Why not just use signal and skip the special cyanogen version?
junto 11y ago
More importantly, they are pushing people towards Signal. Are those same "various countries" also pushing them to push us to use Signal, and if so why?
steve-howard 11y ago
It's possible this is less of a "kowtowing to dictatorial states" move and more "we can't afford to comply with somebody's law" [1]: As of 2009, non-military cryptography exports from the U.S. are controlled by the Department of Commerce's Bureau of Industry and Security. Some restrictions still exist, even for mass market products, particularly with regard to export to "rogue states" and terrorist organizations. [...] custom cryptographic software, and even cryptographic consulting services still require an export license. You might argue that trying to regulate software to keep it from falling into the hands of terrorists is a fool's errand, and you'd be right, but until 1996 [2] it was illegal to export cryptographic software in the first place. [1] https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States#Current_status https://en.wikipedia.org/wiki/Export_of_cryptography_from_th... [2] https://www.eff.org/press/archives/2008/04/21-37 https://www.eff.org/press/archives/2008/04/21-37
mtgx 11y ago
I expected them to become weaker on privacy the moment they partnered with Microsoft anyway. If you're still expecting Cyanogen to care about your privacy, you can forget about it. Time to move on to something like Copperhead OS, once it gets supported on more devices. https://copperhead.co/android/ https://copperhead.co/android/ Oh, and fun fact. Copperhead OS was initially built on CyanogenMod for device compatibility purposes, but they eventually dumped it for AOSP because CM's code became too complex/insecure.
sprokolopolis 11y ago
The WhisperPush feature had some major issues. It really does seem like it could have been a support nightmare, especially considering how easy it is to just download TextSecure/Signal. Registering my device with WhisperPush in the past created a conflict with installing TextSecure, even after opting out of WhisperPush. The only way to switch to TextSecure was to manually unregister my phone number through the terminal with a curl command I found on a github issue page. That isn't something that is ready to be preinstalled on the general public's devices.
SEMW 11y ago
> If they are willing to remove encryption features to please totalitarian states, what backdoors are they also willing to include? That's a rather uncharitable interpretation. If a state was ordering them to include a backdoor in the next release, their options boil down to either 'include a backdoor' or 'shut down the service'[0]. Implying that a service that chooses the latter is more likely to also include a backdoor doesn't seem justified. [0] (or 'have the resources for a massive secret legal battle', which may not even be possible depending on the nation state and nature of the order).
- sheepdestroyer 11y ago
  They may very well be prevented to explicitly name the what and who, but then it essentially becomes a trust issue. If there is now one less security feature to please anonymous (for now) states, how to trust them not including other "features" on their requests? Uncharitable, and a tad paranoiac, as it may be...
  - SEMW 11y ago
    Your trust model doesn't make sense to me. A trust heuristic that penalises even the least worst public action they could take on being served with a backdooring+gag order -- i.e. shutting down the service to avoid complying -- is effectively rewarding services that take no public action at all, ie silently comply. Such a heuristic isn't paranoid -- if anything, it's rather credulous (by applying comparatively less scrutiny to services which operate out of the same jurisdiction (one known to serve orders of this type) yet which somehow happily continue operating).
    - sheepdestroyer 11y ago
      It only makes sense on this specific case as something slipped through. So now, without more (possibly unobtainable) details we are left wondering. In general, we are in desperate need of an effective Warrant Canary system. Being able to trust is important and difficult.

sliken 11y ago

Who cares? Seems like it's a pain in the ass to support a custom fork of signal, for little or no value. Why not just use signal and skip the special cyanogen version?

junto 11y ago

More importantly, they are pushing people towards Signal. Are those same "various countries" also pushing them to push us to use Signal, and if so why?

steve-howard 11y ago

It's possible this is less of a "kowtowing to dictatorial states" move and more "we can't afford to comply with somebody's law" [1]: As of 2009, non-military cryptography exports from the U.S. are controlled by the Department of Commerce's Bureau of Industry and Security. Some restrictions still exist, even for mass market products, particularly with regard to export to "rogue states" and terrorist organizations. [...] custom cryptographic software, and even cryptographic consulting services still require an export license. You might argue that trying to regulate software to keep it from falling into the hands of terrorists is a fool's errand, and you'd be right, but until 1996 [2] it was illegal to export cryptographic software in the first place. [1] https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States#Current_status https://en.wikipedia.org/wiki/Export_of_cryptography_from_th... [2] https://www.eff.org/press/archives/2008/04/21-37 https://www.eff.org/press/archives/2008/04/21-37

mtgx 11y ago

I expected them to become weaker on privacy the moment they partnered with Microsoft anyway. If you're still expecting Cyanogen to care about your privacy, you can forget about it. Time to move on to something like Copperhead OS, once it gets supported on more devices. https://copperhead.co/android/ https://copperhead.co/android/ Oh, and fun fact. Copperhead OS was initially built on CyanogenMod for device compatibility purposes, but they eventually dumped it for AOSP because CM's code became too complex/insecure.

sprokolopolis 11y ago

The WhisperPush feature had some major issues. It really does seem like it could have been a support nightmare, especially considering how easy it is to just download TextSecure/Signal. Registering my device with WhisperPush in the past created a conflict with installing TextSecure, even after opting out of WhisperPush. The only way to switch to TextSecure was to manually unregister my phone number through the terminal with a curl command I found on a github issue page. That isn't something that is ready to be preinstalled on the general public's devices.

SEMW 11y ago

> If they are willing to remove encryption features to please totalitarian states, what backdoors are they also willing to include? That's a rather uncharitable interpretation. If a state was ordering them to include a backdoor in the next release, their options boil down to either 'include a backdoor' or 'shut down the service'[0]. Implying that a service that chooses the latter is more likely to also include a backdoor doesn't seem justified. [0] (or 'have the resources for a massive secret legal battle', which may not even be possible depending on the nation state and nature of the order).

sheepdestroyer 11y ago
They may very well be prevented to explicitly name the what and who, but then it essentially becomes a trust issue. If there is now one less security feature to please anonymous (for now) states, how to trust them not including other "features" on their requests? Uncharitable, and a tad paranoiac, as it may be...
- SEMW 11y ago
  Your trust model doesn't make sense to me. A trust heuristic that penalises even the least worst public action they could take on being served with a backdooring+gag order -- i.e. shutting down the service to avoid complying -- is effectively rewarding services that take no public action at all, ie silently comply. Such a heuristic isn't paranoid -- if anything, it's rather credulous (by applying comparatively less scrutiny to services which operate out of the same jurisdiction (one known to serve orders of this type) yet which somehow happily continue operating).
  - sheepdestroyer 11y ago
    It only makes sense on this specific case as something slipped through. So now, without more (possibly unobtainable) details we are left wondering. In general, we are in desperate need of an effective Warrant Canary system. Being able to trust is important and difficult.