4 ms·

iOS apps have similar issues, actually. On the Android side, you can at least use free and auditable apps from the F-Droid repository, and buy your device from

iOS apps have similar issues, actually. On the Android side, you can at least use free and auditable apps from the F-Droid repository, and buy your device from an OEM vendor which will let you unlock it and install google-free LineageOS. (More speculatively, the community is now working on replacing AOSP altogether with the usual Linux desktop stack, via PostmarketOS. Not usable right now, but it's progressing rather quickly, and may well be practically useful later in 2019.)

paulcole 8y ago
> iOS apps have similar issues, actually. Which issues specifically?
- zozbot123 8y ago
  Being non-free and non-auditable, including proprietary SDKs that can gather tracking info/IDs, connecting to Facebook (even when the app is something other than a FB client)... Stuff that's quite comparable to what the video is talking about.
  - gvurrdon 8y ago
    Indeed. I don't have a Facebook account and yet various apps on my iOS devices still attempt to connect to graph.facebook.com (amongst other servers I'd rather they didn't, e.g. flurry).
  - Angostura 8y ago
    I think you need to be a bit more specific
reificator 8y ago
> More speculatively, the community is now working on replacing AOSP altogether with the usual Linux desktop stack, via PostmarketOS So you're telling me that 2019 is the year of the Linux desktop... on mobile?
ummonk 8y ago
>On the Android side, you can at least use free and auditable apps from the F-Droid repository, and buy your device from an OEM vendor which will let you unlock it and install google-free LineageOS. Do you go audit every line of source code in the apps and OS you install? Do you then verify that the binary blobs you're installing were built from the same source? Do you somehow audit the source for the firmware on your device and verify that that is the firmware installed on your device? What about the hardware, do you audit it?
- zozbot123 8y ago
  I trust the community (including the security community) to do a better job at this than a handful of proprietary hardware and software vendors. Yes, it would be nice to have more openness on the hardware side too (and the Librem 5 phone is a worthwhile answer to that) but let's focus on the lowest-hanging fruit first.
  - scarface74 8y ago
    How did that work out for HeartBleed bug that was in open source code for over two years? Even worse, this 11 year old bug in the Linux kernel? https://www.theregister.co.uk/2017/02/23/linux_kernel_gets_patch_against_12yearold_bug/ https://www.theregister.co.uk/2017/02/23/linux_kernel_gets_p...
    - bch 8y ago
      Heartbleed was found and fixed, and diagnostic tools quickly followed. OSS isn’t a panacea, but it’s something, no?
      - scarface74 8y ago
        After two years? How is that better than closed source?
        lern_too_spel 8y ago

paulcole 8y ago

> iOS apps have similar issues, actually. Which issues specifically?

zozbot123 8y ago
Being non-free and non-auditable, including proprietary SDKs that can gather tracking info/IDs, connecting to Facebook (even when the app is something other than a FB client)... Stuff that's quite comparable to what the video is talking about.
- gvurrdon 8y ago
  Indeed. I don't have a Facebook account and yet various apps on my iOS devices still attempt to connect to graph.facebook.com (amongst other servers I'd rather they didn't, e.g. flurry).
- Angostura 8y ago
  I think you need to be a bit more specific

reificator 8y ago

> More speculatively, the community is now working on replacing AOSP altogether with the usual Linux desktop stack, via PostmarketOS So you're telling me that 2019 is the year of the Linux desktop... on mobile?

ummonk 8y ago

>On the Android side, you can at least use free and auditable apps from the F-Droid repository, and buy your device from an OEM vendor which will let you unlock it and install google-free LineageOS. Do you go audit every line of source code in the apps and OS you install? Do you then verify that the binary blobs you're installing were built from the same source? Do you somehow audit the source for the firmware on your device and verify that that is the firmware installed on your device? What about the hardware, do you audit it?

zozbot123 8y ago
I trust the community (including the security community) to do a better job at this than a handful of proprietary hardware and software vendors. Yes, it would be nice to have more openness on the hardware side too (and the Librem 5 phone is a worthwhile answer to that) but let's focus on the lowest-hanging fruit first.
- scarface74 8y ago
  How did that work out for HeartBleed bug that was in open source code for over two years? Even worse, this 11 year old bug in the Linux kernel? https://www.theregister.co.uk/2017/02/23/linux_kernel_gets_patch_against_12yearold_bug/ https://www.theregister.co.uk/2017/02/23/linux_kernel_gets_p...
  - bch 8y ago
    Heartbleed was found and fixed, and diagnostic tools quickly followed. OSS isn’t a panacea, but it’s something, no?
    - scarface74 8y ago
      After two years? How is that better than closed source?
      - lern_too_spel 8y ago