6 ms·

Realistically though, your real world choice is android or iOS. Either a product which is half closed (play services) from a company that makes 90% of its reven

by Joeri 9y ago

Realistically though, your real world choice is android or iOS. Either a product which is half closed (play services) from a company that makes 90% of its revenue from ads, or a product which is entirely closed from a company that makes all of its revenue from selling products directly to their customers. In theory you can get AOSP and be in control, but in practice that’s not practical for normal people. My two cents: half closed is pretty much the same thing as fully closed from a trust perspective, and apple’s incentives are much less in conflict with user privacy than google’s.

lern_too_spel 9y ago
You don't have to use Play Services, and this is very easy to do. You can also use Play Services piecemeal. The choice really is between open or closed. You can use Firefox as your default browser on Android but are limited to a bastardized version on iOS. You can run an OpenStreetMap app as your default map on Android, but you have no choice on iOS. You can build your own apps and run them indefinitely on Android, but you have to pay a $99 yearly fee (on top of the Mac tax) or rebuild every 7 days on iOS. I don't recommend iOS to anybody. People who think it is more secure don't understand defense in depth, and people who think it is more private don't understand that Pixel and Android One builds actually collect less information by default (before opting in on any of the dialogs).
- seba_dos1 9y ago
  Remember that there's microG - free Play Services reimplementation: https://microg.org/ https://microg.org/
  - mcny 9y ago
    I tried the lineage version: I can't even register for signal (a messaging app) with microg enabled. The only workaround is to disable microg, register signal, then enable microg.
    - seba_dos1 9y ago
      Check if you have enabled GCM. With microG, anything that requires calling home is opt-in. If that's not it, report it. Every app I use works with microG, and any minor issues I had earlier were being resolved pretty quickly.
      - mcny 9y ago
        I switched back to Lineage with open gapps but later I saw this https://github.com/WhisperSystems/Signal-Android/issues/6895#issuecomment-325237926 https://github.com/WhisperSystems/Signal-Android/issues/6895...
  - Fnoord 9y ago
    Yep, and LineageOS + microG [1]: "Access all the Google services without proprietary closed software" [1] https://lineage.microg.org/ https://lineage.microg.org/
- alsetmusic 9y ago
  Though an iOS user myself, I was on board with the logic of your comment until this point: > … or rebuild every 7 days on iOS. By tossing in a flippant remark, you undermine the legitimacy of the other arguments. I don’t think a reasonable person would conclude that you actually believe the above statement to be true. This type of rhetoric, in which reality is knowingly distorted to make a point, may be less effective than you consider it to be.
  - comex 9y ago
    No, you literally have to rebuild/reinstall your apps every 7 days, if you're on a free developer account, because the provisioning profile expires.
- tpush 9y ago
  I don't understand why you are downvoted. The relative openness of Android is the reason something like GNU's Replicant, LineageOS or CopperheadOS (all without Google software) is possible in the first place. To see proprietary and incredibly locked-down devices such as iPhones advocated for so strongly seems so weird. As if openness and security are at odds or something.
  - lern_too_spel 9y ago
    Apple's draconian policies for controlling coverage of its products clearly work if even otherwise tech-savvy people like the HN crowd are fooled. https://www.google.com/amp/amp.timeinc.net/fortune/2015/07/27/apples-toxic-hellstew https://www.google.com/amp/amp.timeinc.net/fortune/2015/07/2... https://www.google.com/amp/s/9to5mac.com/2014/08/29/seeing-through-the-illusion-understanding-apples-mastery-of-the-media/amp/ https://www.google.com/amp/s/9to5mac.com/2014/08/29/seeing-t...
    - smichel17 9y ago
      De-Google'd links: http://fortune.com/2015/07/27/apples-toxic-hellstew/ http://fortune.com/2015/07/27/apples-toxic-hellstew/ https://9to5mac.com/2014/08/29/seeing-through-the-illusion-understanding-apples-mastery-of-the-media/ https://9to5mac.com/2014/08/29/seeing-through-the-illusion-u...
- saagarjha 9y ago
  > People who think it is more secure don't understand defense in depth, and people who think it is more private don't understand that Pixel and Android One builds actually collect less information by default (before opting in on any of the dialogs). Source, please?
  - lern_too_spel 9y ago
    For one, orders of magnitude more iOS users have been infected by malware than users of Google or Amazon flavors of Android even though there are orders of magnitude more users of the latter. See Xcodeghost, which Apple had to rely on Twitter users to find instances of in their own App Store. Compare to Google and Amazon, which run static and dynamic analysis of apps uploaded to their stores and allow third party security research on their stores, enabling both earlier detection of malware and faster takedown of all apps that share the same malware.
    - scarface74 9y ago
      Source?
    - saagarjha 9y ago
      Again, source? Xcodeghost was one instance of limited impact. > Compare to Google and Amazon, which run static and dynamic analysis of apps uploaded to their stores and allow third party security research on their stores, enabling both earlier detection of malware and faster takedown of all apps that share the same malware. You're assuming that Apple doesn't do this?
      - lern_too_spel 9y ago
        > Again, source? Xcodeghost was one instance of limited impact. https://www.google.com/amp/s/www.macrumors.com/2015/09/20/xcodeghost-chinese-malware-faq/amp/ https://www.google.com/amp/s/www.macrumors.com/2015/09/20/xc... shows 500 million infected from 50 apps. > You're assuming that Apple doesn't do this? No need to assume. https://researchcenter.paloaltonetworks.com/2015/09/more-details-on-the-xcodeghost-malware-and-affected-ios-apps/ https://researchcenter.paloaltonetworks.com/2015/09/more-det... not only shows that there were thousands more apps affected by Xcodeghost than originally reported (and thus, more infected users than the approximately 500 million estimate from the earlier link based on the original 50 apps), but also that Apple was still taking down affected apps days later, waiting for third parties to report them. This despite that Xcodeghost represents a single malware that can be detected with a binary grep. That Apple didn't have the infrastructure to deal with even that demonstrates how woefully inadequate their app management infrastructure is for dealing with malware.
- millstone 9y ago
  Is it actually easy to avoid using Play Services on Android? The ways I've seen this done before requires rooting your Android phone, which is sketchy at best, and often cannot be done at all.
  - lern_too_spel 9y ago
    Don't log into a Google account on the phone. Done.
innagadadavida 9y ago
I wouldn’t touch Android with a 10ft pole - none of that open source stuff means anything when no human in earth has the time/money/competency to audit it. I highly recommend an ad blocking VPN so rest of the apps hitting G ad network are blocked as well.
- walterbell 9y ago
  What's a good ad-blocking VPN?
  - yumraj 9y ago
    pi-hole, with openvpn. self-hosted. DigitalOcean has great guides, which work with any linux vps.
    - haydenmk2 9y ago
      this kills the battery though
      - walterbell 9y ago
        I wonder why. Storage disk encryption does not, neither does SSL. Why are VPNs using much more power on mobile?
        joecool1029 9y ago
        >Why are VPNs using much more power on mobile? It can leave connection open which prevents many cellular radio technologies from falling into lower power state. Really depends on how optimized the cell modem is and how often keepalive packets are being sent by the VPN. Honestly, I haven't seen too much of a battery hit on ipsec VPN on the iphone SE. However, my older android phones used to get shredded on OpenVPN. EDIT: If anyone's asking, I use the algo.sh script to deploy ipsec vpn on digitalocean (has option to enable adblocking too) https://github.com/trailofbits/algo https://github.com/trailofbits/algo.
scarface74 9y ago
or a product which is entirely closed from a company that makes all of its revenue from selling products directly to their customers. How is Apple entirely closed? https://opensource.apple.com https://opensource.apple.com
- SXX 9y ago
  You can't seriously tell iOS is not entirely closed just because they release source for two components under GPL. If they were able to stop using this GPL-ed close they certainly would. Apple even stripped most of iOS related code for their MacOS open source drops. E.g they only recently started to release XNU source with code for iOS.
  - scarface74 9y ago
    Two components? Darwin is a relatively big component. But as far as Android.... https://arstechnica.com/gadgets/2013/10/googles-iron-grip-on-android-controlling-open-source-by-any-means-necessary/ https://arstechnica.com/gadgets/2013/10/googles-iron-grip-on...
- Joeri 9y ago
  If you can’t install your own OS on a device, that’s a closed device.
  - scarface74 9y ago
    So that includes Android? How useful is Android to the average user without the closed source bits Googke provides and the closed source drivers?

by Joeri 9y ago

lern_too_spel 9y ago

You don't have to use Play Services, and this is very easy to do. You can also use Play Services piecemeal. The choice really is between open or closed. You can use Firefox as your default browser on Android but are limited to a bastardized version on iOS. You can run an OpenStreetMap app as your default map on Android, but you have no choice on iOS. You can build your own apps and run them indefinitely on Android, but you have to pay a $99 yearly fee (on top of the Mac tax) or rebuild every 7 days on iOS. I don't recommend iOS to anybody. People who think it is more secure don't understand defense in depth, and people who think it is more private don't understand that Pixel and Android One builds actually collect less information by default (before opting in on any of the dialogs).

seba_dos1 9y ago
Remember that there's microG - free Play Services reimplementation: https://microg.org/ https://microg.org/
- mcny 9y ago
  I tried the lineage version: I can't even register for signal (a messaging app) with microg enabled. The only workaround is to disable microg, register signal, then enable microg.
  - seba_dos1 9y ago
    Check if you have enabled GCM. With microG, anything that requires calling home is opt-in. If that's not it, report it. Every app I use works with microG, and any minor issues I had earlier were being resolved pretty quickly.
    - mcny 9y ago
      I switched back to Lineage with open gapps but later I saw this https://github.com/WhisperSystems/Signal-Android/issues/6895#issuecomment-325237926 https://github.com/WhisperSystems/Signal-Android/issues/6895...
- Fnoord 9y ago
  Yep, and LineageOS + microG [1]: "Access all the Google services without proprietary closed software" [1] https://lineage.microg.org/ https://lineage.microg.org/
alsetmusic 9y ago
Though an iOS user myself, I was on board with the logic of your comment until this point: > … or rebuild every 7 days on iOS. By tossing in a flippant remark, you undermine the legitimacy of the other arguments. I don’t think a reasonable person would conclude that you actually believe the above statement to be true. This type of rhetoric, in which reality is knowingly distorted to make a point, may be less effective than you consider it to be.
- comex 9y ago
  No, you literally have to rebuild/reinstall your apps every 7 days, if you're on a free developer account, because the provisioning profile expires.
tpush 9y ago
I don't understand why you are downvoted. The relative openness of Android is the reason something like GNU's Replicant, LineageOS or CopperheadOS (all without Google software) is possible in the first place. To see proprietary and incredibly locked-down devices such as iPhones advocated for so strongly seems so weird. As if openness and security are at odds or something.
- lern_too_spel 9y ago
  Apple's draconian policies for controlling coverage of its products clearly work if even otherwise tech-savvy people like the HN crowd are fooled. https://www.google.com/amp/amp.timeinc.net/fortune/2015/07/27/apples-toxic-hellstew https://www.google.com/amp/amp.timeinc.net/fortune/2015/07/2... https://www.google.com/amp/s/9to5mac.com/2014/08/29/seeing-through-the-illusion-understanding-apples-mastery-of-the-media/amp/ https://www.google.com/amp/s/9to5mac.com/2014/08/29/seeing-t...
  - smichel17 9y ago
    De-Google'd links: http://fortune.com/2015/07/27/apples-toxic-hellstew/ http://fortune.com/2015/07/27/apples-toxic-hellstew/ https://9to5mac.com/2014/08/29/seeing-through-the-illusion-understanding-apples-mastery-of-the-media/ https://9to5mac.com/2014/08/29/seeing-through-the-illusion-u...
saagarjha 9y ago
> People who think it is more secure don't understand defense in depth, and people who think it is more private don't understand that Pixel and Android One builds actually collect less information by default (before opting in on any of the dialogs). Source, please?
- lern_too_spel 9y ago
  For one, orders of magnitude more iOS users have been infected by malware than users of Google or Amazon flavors of Android even though there are orders of magnitude more users of the latter. See Xcodeghost, which Apple had to rely on Twitter users to find instances of in their own App Store. Compare to Google and Amazon, which run static and dynamic analysis of apps uploaded to their stores and allow third party security research on their stores, enabling both earlier detection of malware and faster takedown of all apps that share the same malware.
  - scarface74 9y ago
    Source?
  - saagarjha 9y ago
    Again, source? Xcodeghost was one instance of limited impact. > Compare to Google and Amazon, which run static and dynamic analysis of apps uploaded to their stores and allow third party security research on their stores, enabling both earlier detection of malware and faster takedown of all apps that share the same malware. You're assuming that Apple doesn't do this?
    - lern_too_spel 9y ago
      > Again, source? Xcodeghost was one instance of limited impact. https://www.google.com/amp/s/www.macrumors.com/2015/09/20/xcodeghost-chinese-malware-faq/amp/ https://www.google.com/amp/s/www.macrumors.com/2015/09/20/xc... shows 500 million infected from 50 apps. > You're assuming that Apple doesn't do this? No need to assume. https://researchcenter.paloaltonetworks.com/2015/09/more-details-on-the-xcodeghost-malware-and-affected-ios-apps/ https://researchcenter.paloaltonetworks.com/2015/09/more-det... not only shows that there were thousands more apps affected by Xcodeghost than originally reported (and thus, more infected users than the approximately 500 million estimate from the earlier link based on the original 50 apps), but also that Apple was still taking down affected apps days later, waiting for third parties to report them. This despite that Xcodeghost represents a single malware that can be detected with a binary grep. That Apple didn't have the infrastructure to deal with even that demonstrates how woefully inadequate their app management infrastructure is for dealing with malware.
millstone 9y ago
Is it actually easy to avoid using Play Services on Android? The ways I've seen this done before requires rooting your Android phone, which is sketchy at best, and often cannot be done at all.
- lern_too_spel 9y ago
  Don't log into a Google account on the phone. Done.

innagadadavida 9y ago

I wouldn’t touch Android with a 10ft pole - none of that open source stuff means anything when no human in earth has the time/money/competency to audit it. I highly recommend an ad blocking VPN so rest of the apps hitting G ad network are blocked as well.

walterbell 9y ago
What's a good ad-blocking VPN?
- yumraj 9y ago
  pi-hole, with openvpn. self-hosted. DigitalOcean has great guides, which work with any linux vps.
  - haydenmk2 9y ago
    this kills the battery though
    - walterbell 9y ago
      I wonder why. Storage disk encryption does not, neither does SSL. Why are VPNs using much more power on mobile?
      - joecool1029 9y ago
        >Why are VPNs using much more power on mobile? It can leave connection open which prevents many cellular radio technologies from falling into lower power state. Really depends on how optimized the cell modem is and how often keepalive packets are being sent by the VPN. Honestly, I haven't seen too much of a battery hit on ipsec VPN on the iphone SE. However, my older android phones used to get shredded on OpenVPN. EDIT: If anyone's asking, I use the algo.sh script to deploy ipsec vpn on digitalocean (has option to enable adblocking too) https://github.com/trailofbits/algo https://github.com/trailofbits/algo.

scarface74 9y ago

or a product which is entirely closed from a company that makes all of its revenue from selling products directly to their customers. How is Apple entirely closed? https://opensource.apple.com https://opensource.apple.com

SXX 9y ago
You can't seriously tell iOS is not entirely closed just because they release source for two components under GPL. If they were able to stop using this GPL-ed close they certainly would. Apple even stripped most of iOS related code for their MacOS open source drops. E.g they only recently started to release XNU source with code for iOS.
- scarface74 9y ago
  Two components? Darwin is a relatively big component. But as far as Android.... https://arstechnica.com/gadgets/2013/10/googles-iron-grip-on-android-controlling-open-source-by-any-means-necessary/ https://arstechnica.com/gadgets/2013/10/googles-iron-grip-on...
Joeri 9y ago
If you can’t install your own OS on a device, that’s a closed device.
- scarface74 9y ago
  So that includes Android? How useful is Android to the average user without the closed source bits Googke provides and the closed source drivers?