3 ms·

When people buy a cheap Android phone, I always recommend that you take a look at the xda-developers form [1] to see if there is a custom rom available. For so

When people buy a cheap Android phone, I always recommend that you take a look at the xda-developers form [1] to see if there is a custom rom available. For some cheap phones even without the backdoor the some system components are unstable leading to a subpar experience. [1] https://forum.xda-developers.com https://forum.xda-developers.com

0b0001 7y ago
Did anybody have a look at those custom ROMs, with sources from random repositories, modified by anonymous people, build on public build servers, distributed on random file hosting services? Are they trustworthy?
- userbinator 7y ago
  The community is not stupid, it only takes one person to find out and tell everyone, and then the one doing it gets quickly ostracised. The centralised (corporatocracy) version of "trust" that is prevalent today one of the biggest obstructions to freedom IMHO.
  - SmellyGeekBoy 7y ago
    This is what I like about LineageOS. I may not have the time or inclination to build it myself, but it's "open enough" to meet my standards, especially compared to the closed ROM supplied by my phone's manufacturer (OnePlus, FWIW).
  - 0b0001 7y ago
    I'm not implying they are, my question was honest. I once tried to see where the binary ROM actually came from, and met an astonishing lack of information. Granted, it's a model that isn't really supported. But it felt that the community is far away from having plausible sources and builds. I can understand that ultimately this begins with kernel sources that are already just a ZIP archive on some website.
- JohnFen 7y ago
  > Are they trustworthy? Most are, yes, and the community is pretty good at pointing out the ones that aren't. But the real question is are they any less trustworthy than Google itself and the phone manufacturers? From what I've observed, they are more trustworthy that that crowd.
vorpalhex 7y ago
Note that a custom rom will only get you "don't tell my roommate" levels of safe and secure, not "please don't inform foreign governments" safe. Backdoors can (and probably do) exist in bootloaders, recovery firmware, drivers and so on.
- rjzzleep 7y ago
  A lot of roms require you to use TWRP as a recovery. So that's where you get your recovery. Most ROMs are based off of either AOSP or lineage. The list of unofficially supported devices is huge. Since, most devices share the same SOC's they're usually just forked off of each other with gradual tweaks. The Sony open device project is semi supported by sony but doesn't share any code with the stock images. So, that really just leaves the bootloader. How much attack surface does the boot rom actually provide? I feel like most vendors would probably just assume a backdoored system or boot partition. Your boot rom would have to accommodate for all kinds of potential Android versions. It sounds like a lot of effort for a corner case so not really worth the effort.
  - gbrown 7y ago
    Don't forget all the binary blobs you need to get full functionality, the monstrous size of the codebase (and corresponding attack surface), the baseband processor, etc. Also, don't get me started on the terrible security hygeine of the actual ROM distribution practices.
  - h4waii 7y ago
    Just to clarify, not many ROMs require a specific recovery, they simply expect certain functionality for updates. You can use many other forks of TWRP, which include backwards compatibility, without issue. RedWolf [0] and OrangeFox [1] are both forked from TWRP and provide more features than upstream. Cyanogen and Lineage recovery are based on AOSP, again, with more features than upstream. [0] https://redwolfrecovery.github.io/ https://redwolfrecovery.github.io/ [1] https://orangefox.tech/ https://orangefox.tech/
    - RealStickman 7y ago

0b0001 7y ago

Did anybody have a look at those custom ROMs, with sources from random repositories, modified by anonymous people, build on public build servers, distributed on random file hosting services? Are they trustworthy?

userbinator 7y ago
The community is not stupid, it only takes one person to find out and tell everyone, and then the one doing it gets quickly ostracised. The centralised (corporatocracy) version of "trust" that is prevalent today one of the biggest obstructions to freedom IMHO.
- SmellyGeekBoy 7y ago
  This is what I like about LineageOS. I may not have the time or inclination to build it myself, but it's "open enough" to meet my standards, especially compared to the closed ROM supplied by my phone's manufacturer (OnePlus, FWIW).
- 0b0001 7y ago
  I'm not implying they are, my question was honest. I once tried to see where the binary ROM actually came from, and met an astonishing lack of information. Granted, it's a model that isn't really supported. But it felt that the community is far away from having plausible sources and builds. I can understand that ultimately this begins with kernel sources that are already just a ZIP archive on some website.
JohnFen 7y ago
> Are they trustworthy? Most are, yes, and the community is pretty good at pointing out the ones that aren't. But the real question is are they any less trustworthy than Google itself and the phone manufacturers? From what I've observed, they are more trustworthy that that crowd.

vorpalhex 7y ago

Note that a custom rom will only get you "don't tell my roommate" levels of safe and secure, not "please don't inform foreign governments" safe. Backdoors can (and probably do) exist in bootloaders, recovery firmware, drivers and so on.

rjzzleep 7y ago
A lot of roms require you to use TWRP as a recovery. So that's where you get your recovery. Most ROMs are based off of either AOSP or lineage. The list of unofficially supported devices is huge. Since, most devices share the same SOC's they're usually just forked off of each other with gradual tweaks. The Sony open device project is semi supported by sony but doesn't share any code with the stock images. So, that really just leaves the bootloader. How much attack surface does the boot rom actually provide? I feel like most vendors would probably just assume a backdoored system or boot partition. Your boot rom would have to accommodate for all kinds of potential Android versions. It sounds like a lot of effort for a corner case so not really worth the effort.
- gbrown 7y ago
  Don't forget all the binary blobs you need to get full functionality, the monstrous size of the codebase (and corresponding attack surface), the baseband processor, etc. Also, don't get me started on the terrible security hygeine of the actual ROM distribution practices.
- h4waii 7y ago
  Just to clarify, not many ROMs require a specific recovery, they simply expect certain functionality for updates. You can use many other forks of TWRP, which include backwards compatibility, without issue. RedWolf [0] and OrangeFox [1] are both forked from TWRP and provide more features than upstream. Cyanogen and Lineage recovery are based on AOSP, again, with more features than upstream. [0] https://redwolfrecovery.github.io/ https://redwolfrecovery.github.io/ [1] https://orangefox.tech/ https://orangefox.tech/
  - RealStickman 7y ago