4 ms·

So it says all over the site that it says it's open source, but I can't find a link to the source code. Why are there embedded Facebook and Google tracking scr

So it says all over the site that it says it's open source, but I can't find a link to the source code. Why are there embedded Facebook and Google tracking scripts in your site about a supposedly privacy-focused phone? The website doesn't the website have https. I see a lot of claims of privacy focused and openness on this page, but not a lot to back those claims up. EDIT: So I guess the source code isn't available, so I'll have to ask here: how are phone calls on this oh-so-privacy-focsed phone secured? It says VoIP, does that mean it's SIP? Does the SIP use TLS? Is the TLS verified? is the media encrypted? Is it end-to-end encrypted? What encryption is used?

iBelieve 8y ago
In the FAQ, under the Technical section it says: > Q: Where can I download the code? > Probably Github. After we ship the rewards. So, unfortunately, it looks like it'll only be open-sourced after it ships.
- deleted 8y ago
  [deleted]
- emdubs 8y ago
  Don't most licenses only require the source to be available when it ships to end users? I guess we could nitpick over the word "after" but if they ship the first phones 8am and release the code at 1pm I think it still complies.
saagarjha 8y ago
I don't think it'll be released until the phone is.
voltagex_ 8y ago
https://github.com/ESP32-WiPhone https://github.com/ESP32-WiPhone only has the keypad as open source.
tomglynch 8y ago
Pretty sure they're buying upvotes also 34 points by catherd 34 minutes ago 38 points by catherd 38 minutes ago 45 points by catherd 45 minutes ago
- saagarjha 8y ago
  …this is a pretty reasonable rate of upvote accumulation?
catherd 8y ago
We are in this to make money, it's not a side project. Marketing is almost impossible without tracking and I'm not going to say I like it, but I haven't found a way to do without it. I like open source/not tracking/privacy, but it's not my religion. This project would be dead already if we couldn't run Facebook ads. The phone is for people who want hardware that can be used for hacking. We don't have any code that does anything related to tracking in the phone, and once it's released anyone can verify that. That page is static, so I don't see how https is relevant. Right now there is no security whatsoever. We are still getting the system to work, and work reliably. If enough people buy one we will probably add some sort of transport layer encryption.
- kaycebasques 8y ago
  > That page is static, so I don't see how https is relevant. https://developers.google.com/web/fundamentals/security/encrypt-in-transit/why-https https://developers.google.com/web/fundamentals/security/encr... Disclosure: I wrote that doc in collaboration with the Chrome security team.
- markovbot 8y ago
  So the marketing emphasizes the privacy aspects of this device, yet in the comments (not noted on the website), you state that it has "no security whatsoever". This seems like an important disclaimer that should be given on the website.
  - catherd 8y ago
    It's not a privacy focused device. It's a device intended to give hackers the ability to do things they aren't able to do with typical commercial hardware. As a side effect of that there are some properties related to security that you get for free (no tracking cookies, no black box cellular radio), and others, like encryption, that we will try to add if we make enough to fund doing it. But we won't feature creep the project and risk never delivering just to check a box that's not part of our core goal.
  - dang 8y ago
    "Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

iBelieve 8y ago

In the FAQ, under the Technical section it says: > Q: Where can I download the code? > Probably Github. After we ship the rewards. So, unfortunately, it looks like it'll only be open-sourced after it ships.

deleted 8y ago
[deleted]
emdubs 8y ago
Don't most licenses only require the source to be available when it ships to end users? I guess we could nitpick over the word "after" but if they ship the first phones 8am and release the code at 1pm I think it still complies.

saagarjha 8y ago

I don't think it'll be released until the phone is.

voltagex_ 8y ago

https://github.com/ESP32-WiPhone https://github.com/ESP32-WiPhone only has the keypad as open source.

tomglynch 8y ago

Pretty sure they're buying upvotes also 34 points by catherd 34 minutes ago 38 points by catherd 38 minutes ago 45 points by catherd 45 minutes ago

saagarjha 8y ago
…this is a pretty reasonable rate of upvote accumulation?

catherd 8y ago

We are in this to make money, it's not a side project. Marketing is almost impossible without tracking and I'm not going to say I like it, but I haven't found a way to do without it. I like open source/not tracking/privacy, but it's not my religion. This project would be dead already if we couldn't run Facebook ads. The phone is for people who want hardware that can be used for hacking. We don't have any code that does anything related to tracking in the phone, and once it's released anyone can verify that. That page is static, so I don't see how https is relevant. Right now there is no security whatsoever. We are still getting the system to work, and work reliably. If enough people buy one we will probably add some sort of transport layer encryption.

kaycebasques 8y ago
> That page is static, so I don't see how https is relevant. https://developers.google.com/web/fundamentals/security/encrypt-in-transit/why-https https://developers.google.com/web/fundamentals/security/encr... Disclosure: I wrote that doc in collaboration with the Chrome security team.
markovbot 8y ago
So the marketing emphasizes the privacy aspects of this device, yet in the comments (not noted on the website), you state that it has "no security whatsoever". This seems like an important disclaimer that should be given on the website.
- catherd 8y ago
  It's not a privacy focused device. It's a device intended to give hackers the ability to do things they aren't able to do with typical commercial hardware. As a side effect of that there are some properties related to security that you get for free (no tracking cookies, no black box cellular radio), and others, like encryption, that we will try to add if we make enough to fund doing it. But we won't feature creep the project and risk never delivering just to check a box that's not part of our core goal.
- dang 8y ago
  "Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html