11 ms·
The solution is rather simple; buy devices with better documented and open internals rather than what's cheapest, shiniest, and most convenient. There are alter
by madez 7y ago
The solution is rather simple; buy devices with better documented and open internals rather than what's cheapest, shiniest, and most convenient. There are alternatives, and we all vote with our wallets.
- pixl97 7y agoAh, yes, this is sure to work. watches the plan fail yet again This is like saying "we dont need regulations in meat packing, every individual can become educated in butchery cleanliness and track the supply chains for the products they buy and everything will be better!"
- madez 7y agoWe surely need regulation that demands at least delayed publication of firmware source and hardware documentation, I agree. The analogy to regulation in the food industry is enlightening. It's easier to achieve regulation when people care and show that they care. It seems to me, voting now with your wallet is one of the most direct ways to make a case.
- Normal_gaussian 7y agoI don't think many people are talking directly to their officials about it. It certainly isn't something my local representatives talk about, and the political consultation groups some of my uni-friends now work in definitely don't have it on their radar.
- clarry 7y agoVoting against the tyranny of the ignorant masses (or just people who also value convenience; or those who can't afford expensive) is a discarded vote. Your pennies are not going to change the world.
- madez 7y agoUnlike in some political systems, in the market the winner doesn't take all, but rather all receive their votes. Even then, I don't understand the psychology underlying the concept "discarded vote". I vote for what I think is best. To me that is what votes are all about. Is the psychological desire to be part of the winning group responsible?
- clarry 7y agoIf you know you're voting for a niche candidate that cannot win, then that vote achieves nothing. It amounts to as much as not voting at all; voting, then, is an empty ritual, just a rain dance. Psychological desire has nothing to do with it, it's just hard facts.
- madez 7y agoEven in an archaic the-winner-takes-all vote, the result reveals important information besides determining the winner. That information can influence other voters, vote options, and the winners behavior.
- kortilla 7y agoWe’re talking about voting with your wallet. The vendor you pick doesn’t need to “win”, it just needs to get enough to survive. This is why voting with your wallet is much more powerful than voting for winner-take-all representatives in a political system.
- tripzilch 7y agoI think you're taking the analogy of "vote with your wallet" a bit too far. It's not actual voting, or democratic, it just means that whoever has the most money decides. It's not really comparable to a political system of voting (and if you think it does seem suspiciously similar, that probably means that political system is broken). > I vote for what I think is best. Maybe you're an exception, but if you're talking about "vote with your wallet", then the vast majority will actually vote what they think is best for their wallets. I mean, if you're going to let money decide, then expect the outcome to benefit money.
- Mirioron 7y agoHow do I vote with my wallet though? The only alternative is an iPhone which fulfills a somewhat different role functionally.
- dTal 7y ago>This is like saying "we dont need regulations in meat packing, every individual can become educated in butchery cleanliness and track the supply chains for the products they buy and everything will be better!" People say this kind of thing all the time, even on HN. It's a libertarian saw that the FDA is unneccesary and obstructionist. Personally I think it's deranged, but apparently it's an ideological battle that's still being fought.
- taspeotis 7y agoOr just buy Apple. The iPhone 5s was released in 2013 and got an update less than a fortnight ago (January 28).
- eithed 7y agoCan you make assurances that iPhone doesn't suffer from similar issues, given it's not open source solution?
- lima 7y agoThere's tons of security researchers focusing on iOS and the lack of source code access is merely an inconvenience.
- objclxt 7y agoDepends what you mean by "similar issues" If you mean "a bunch of relatively new Android phones not getting security updates because their manufacturer doesn't support them", then yes. Apple is actively providing not just security patches but entire feature software updates for the iPhone 6S, which is 4.5 years old at this point.
- eithed 7y agoYup, that's what I mean. While I do have an Android phone that is patched (Samsung), I understand that many people will be hmm... irritated that this vulnerability won't be fixed and requires them to upgrade. I'd not treat switching to Apple ecosystem as panacea to everything though and would be more for security through audit, not obscurity.
- why_only_15 7y agoApple's security is heavily audited in a lot of ways. They give special phones to researchers that make it easier to audit them, and there are significant bug bounties.
- 7y ago
- rjmunro 7y agoLooks like I need a new phone because of this. Which phone would you recommend so I don't make the same mistake again?
- krn 7y agoI would only buy a device running Android One, because they receive monthly security patches and new Android versions for up to 3 years. The current options include all Nokia smartphones, Motorola One line, and Xiaomi Mi A line. For the best hardware and 5G support, I would look at Nokia 9.2 (Snapdragon 8--) and Nokia 8.2 (Snapdragon 7--) releases this year. The best deal is to buy 6 months after the release, when most Android devices become heavily (30-40%) discounted, but are still quite new. I prefer Android over iOS because of the freedom to install open-source OS-level ad-blockers, such as Blokada[1], which greatly improve privacy and battery life. [1] https://blokada.org/ https://blokada.org/
- zozbot234 7y agoNote that "Xiaomi Mi A" devices are the only ones that are similar to Android One. Most Xiaomi devices have a custom UX and additional weirdness. (Among which is the need to "sign up" online for bootloader unlock and wait for a timeout period. They do this because resellers used to ship bootloader-unlocked versions with "unofficial" mods of sorts, often with customers being none-the-wiser. Not an issue on the 'Mi A' line, for whatever reason.)
- krn 7y ago> Most Xiaomi devices have a custom UX and additional weirdness. That's true. Just like Samsung, Huawei, OnePlus, and any other Android manufacturer except Nokia, Xiaomi maintains its own Android ROM, called MIUI[1]. It's not as vanilla as Android One, but at least it also receives monthly security patches. > Among which is the need to "sign up" online for bootloader unlock and wait for a timeout period. They do this because resellers used to ship bootloader-unlocked versions with "unofficial" mods of sorts, often with customers being none-the-wiser. Not an issue on the 'Mi A' line, for whatever reason. It's not an issue with Xiaomi Mi A line, because Xiaomi's reputation is not affected as much if there is something wrong with a smartphone that is not running its custom ROM. Nokia has only recently started allowing to unlock the bootloader of some of the models, and has a similar process[2]. [1] https://en.wikipedia.org/wiki/MIUI https://en.wikipedia.org/wiki/MIUI [2] https://www.nokia.com/phones/en_int/bootloader https://www.nokia.com/phones/en_int/bootloader
- zozbot234 7y agoThey're all using the same junk SoC's with zero documentation and the crappiest possible level of "board" support anyway. You're actually better off buying a device where that support has been properly reverse-engineered/forward ported and is included in the mainline kernel. (Lots of Allwinner boards are "supported" in that way.) But it's ridiculous that we have to do this. Also FWIW, the problem has zilch to do with "Android" per se - pre-Android mobile Linux was even worse. It's embedded platforms in general.
- kees99 7y agoMy understanding is that each android phone model is unique and requires unique OS update (unlike, say, BIOS- or UEFI-based x86 PCs, where exact same Windows/Linux/BSD/... image can be installed on any of them). Having a "standard" OS interface for the phone, where there is just one OS image for a given OS version, and that image could be installed on any phone - now that would be the true alternative, which I would be delighted to vote for with my wallet.
- zozbot234 7y ago> Having a "standard" OS interface for the phone, where there is just one OS image for a given OS version, and that image could be installed on any phone Project Treble is working towards this, in a way. But it's a huge hack that's still dependent on lots of weird AOSP-specific stuff, and doesn't even give you a "single" OS image for every device - the "proper" image for your device varies by baseline AOSP support (7, 8, 9, 10), "A" vs. "A+B" boot and of course 32-bit vs. 64-bit architecture. Nowhere near "UEFI-based PC" territory.
- yjftsjthsd-h 7y agoEh... remember 32-bit UEFI? It might be smaller, but there is still room for weirdness.
- jacquesm 7y ago> My understanding is that each android phone model is unique Sure, but each PC is also 'unique' in that sense, in fact I'd happily bet that there are more different kinds of hardware combinations for PCs than there are android phone models. And yet, that never was a problem.
- zozbot234 7y agoPlug-and-Play and then ACPI have been used to get around this. Hardware discovery just doesn't seem to be a thing on these embedded SoC platforms, and even the hardware support itself (drivers, etc.) is extremely sub-par if you expect to run the ordinary, mainline kernel.
- nicolaslem 7y agoThis is why my next phone will be a Librem 5. I know that it will probably suck but at least it's moving things in the right direction.
- madez 7y agoI'm in the same boat. If it moves things in the right direction, then it doesn't suck.
- prox 7y agoIndeed! I usually get “but it’s still a closed source modem” as a counterpoint ... sigh
- squarefoot 7y agoThe closed source modem, or network firmware for that matter, isn't much of a problem if it can't see clear data and/or access to system memory or execute instructions. I'd see it more of a black box not unlike old RS232 connected modems: they could see all data going back and forth, but encrypting that data would be enough since they could never access the system memory to see the data before encryption or after decryption. Librem 5 and Pinephone should work along these lines. Having everything 100% open would be better, but in this case being closed doesn't create security concerns since all personal data is unavailable to these subsystems; only the main system, which is entirely open and where the user is king, can access them.
- ekianjo 7y ago> my next phone will be a Librem 5. Better go with a Pinephone if everything that's been written about Librem as a company is even half-true.
- papermachete 7y agoWhat are some 2018+ sub-$200 smartphones that run first-party LineageOS to no disadvantage over the stock ROM?
- pmlnr 7y agoThere aren't any, unless you go second hand. LOS and nearly all custom ROMs are aiming at widespread, mostly high end devices, which is one of the big problems.
- myself248 7y agoI've learned this lesson. If I have $200 to spend on a phone, I will not buy a low-end 2019 $200 phone. I will buy a used (or new-old-stock) flagship that was $700 when it came out a few years ago, and is now $200 on the used market. The older flagship will have similar specs to today's low-end junk, but also all the enthusiast support, better accessory availability, and probably better build quality overall, because it was originally intended to be the highest of the high-end.
- steerablesafe 7y agoFlagships have the most idiotic designs though, as far as I looked around. Low-end current year $200 phones often have removable batteries, headphone jack and dual sim support. Flagships typically have none of that.
- papermachete 7y agoI mean if you can go so far as to install or build third party ROMs, it'd be an interesting weekend hobby to repair electronics yourself. I've saved hundreds of dollars of technology on trivial home repairs instead of buying replacements.
- mavhc 7y agoYou'll also have to replace the battery though
- kop316 7y agoI hope you realize that with the exception of freescale, there are no phone and tablet devices where the vendor actually cooperate and does that. Many of the devices that are documented are because of the open source community that actually bother to dig in and do this (without any vendor support). That means there is no Android or Apple device on the market today that accomplishes what you say. The only phones that are out there that can do that are the Pinephone and Librem 5. I have beta devices of both, and while I am extremely excited to see them mature and turn into daily drivers, the fact is neither can actually be a daily driver today.
- tremon 7y ago> There are alternatives Can you name one smartphone device with open internals? I'd love to buy one, but I don't think they exist. From Replicant's recommendations [1]: If compromising on privacy/security is not an option, or anything serious is at stake (e.g. political activism or journalism in a sensitive area), it is advised to avoid using a telephony-enabled device at all. My impression from the smartphone market is that phone platforms have become less open, not more, over the last ten years. The PinePhone isn't generally available yet, and the Librem 5 current iterations don't have working audio calls. [1] https://www.replicant.us/freedom-privacy-security-issues.php#recommendations https://www.replicant.us/freedom-privacy-security-issues.php...
- madez 7y agoOpenness isn't binary. One significant step is support for the mainline Linux kernel. Another significant step is free information about the hardware on a high-level, such as PCB schematics and documentation about the used chips. Here are some projects that I'm aware of: Mainline Linux: https://pocket.popcorncomputer.com/ https://pocket.popcorncomputer.com/ https://necunos.com/shop/ https://necunos.com/shop/ Mainline Linux + high-level hardware documentation: https://puri.sm/products/librem-5/ https://puri.sm/products/librem-5/ https://www.pine64.org/pinephone/ https://www.pine64.org/pinephone/
- munificent 7y agoThat would work better mobile phones were anywhere in the vicinity of an efficient market. It's not. * The barrier of entry is very high: You need a top-tier manufacturing system and supply chain. An operating system. An entire suite and market of applications. All of the apps users expect and rely on (mail, navigation, Facebook, chat, Instagram, etc.) must be supported. The hardware is only profitable if you manufacture at very high scale. * Information asymmetry is very high. Users have almost no insight into how secure one platform is versus another. In fact, they have access to paradoxical information. The most secure platforms are the ones with the most transparent security flaw handling, but those are also the ones that appear the least secure because the vulnerabilities are more widely reported. * Products are nowhere near commoditized. A phone is a very large constellation of hardware, operating system, and software features. There is no apples to apples comparison between phones. Maybe you like the camera on one but not the screen on the other. One has better apps but the other a more stable OS. This is not a market where consumer choice will effectively drive solutions to diffuse problems.
- toast0 7y agoDo you want two OpenMoko phones sitting in my drawer? They're about as useful now as they were then.
- tripzilch 7y agoThat solution is also rather terrible. We need a better solution than "vote with our wallets", I'm not prepared to give disproportionate voting power to those with disproportionally more money. Because money does not make one more right, more qualified and most definitely not more likely to make a decision that is fair to everybody. "Voting with your wallet" only leads to good outcomes if the incentives are right. I mean it's money, the VAST majority of it is spent not for the greater good but for small, inefficient egotistical purposes.