5 ms·

I think the developer community need to start refusing to use the cellphone. It cannot be trusted. It's tainted by non-free software on top of non-free OS on to

by ezoe 6y ago

I think the developer community need to start refusing to use the cellphone. It cannot be trusted. It's tainted by non-free software on top of non-free OS on top of non-free firmware with the separate processor whose behaviour we cannot observe from the main processor. It also relies on central wireless network from only a handful of providers. Easy single point of vulnerable target. I do refuse to own a cellphone. What about you. Since you're suggesting the boycott, can you?

deleted 6y ago
[deleted]
deleted 6y ago
[deleted]
msh 6y ago
Mobile phones are way safer for normal users compared general purpose computers.
bad_user 6y ago
What does Free/OSS software have to do with the article? If the phone wasn't proprietary, would it have made any difference? The answer is obvious.
- Reelin 6y ago
  > The answer is obvious. Is it? I'm not overly familiar with any security exploits, but my understanding is that (at least for Android) the phone OS is often woefully out of date simply because the vendor stopped supplying updates. The end user generally can't supply updates themselves because everything is locked down in a decidedly user hostile manner. For the vendor's part, they often stop supplying updates (as I understand it) because the proprietary hardware doesn't have it's drivers upstreamed into the kernel (they're proprietary after all) which leads to a completely unjustifiable maintenance burden. They can't simply open source things because the hardware manufacturers generally require NDAs. As far as the hardware goes, my (probably woefully incomplete) understanding is that it remains proprietary due to a combination of attempting to maintain a competitive edge through secrecy, licensing complexities due to containing third party IP, and DRM issues (which are again a licensing concern).
  - bad_user 6y ago
    No, that's not what happens on iOS. I'm writing this on a 5 year old device still getting updated. The iOS exploits that have historically allowed the device to be jailbroken have been zero-day vulnerabilities. And I'm assuming the TFA is about a zero-day too. Also Android is open source (AOSP). How does that help?
    - Reelin 6y ago
      I'm well aware that this isn't nearly as much of an issue for Apple devices - that's why I very clearly specified Android in my previous comment. Yes AOSP is open source but that doesn't help as much as one might hope for the reasons I outlined in my previous comment. Basically most end user devices aren't actually running AOSP at the end of the day, and can't without investing a nontrivial amount of effort. (And that still wouldn't prevent vulnerabilities related to out of date firmware.) The comment of yours that I originally responded to seemed to me to insinuate that having access to fully open sourced phones wouldn't be able to do anything to improve device security as a foregone conclusion. I was objecting to that, pointing out that there are a number of real world examples where access to a fully open source mobile stack would immediately and drastically improve the current situation. In a hypothetical world full of such stacks perhaps this article would never have been written.
fouc 6y ago
PinePhone seems promising
- teddyh 6y ago
  Also the Librem 5.
niyikiza 6y ago
I think the problem can be solved by separating the "phone" experience from the "mobile" experience. Phones are these devices powered by a philosophy (and to an extent, a technology) from 3-4 decades ago and day after day we see them ruining the experience of having the internet access from your hands. We need to move from a mobile-phone era to a mobile-internet era.
- simonh 6y ago
  In what way do you think the phone legacy is holding us back? What concrete steps would you suggest? It seems to me this has already happened. We only call these things phones for legacy reasons, but the iPhone broke the design link with actual phones and turned the phone aspect into just another communications app.
  - kavalg 6y ago
    I guess he meant the baseband processor
    - simonh 6y ago
      OK, but how does that hold any other aspects of these devices back? Remove the baseband processor and you've got an iPod Touch, or a small iPad. It doesn't fundamentally change the device or really open up any new avenues not possible with a baseband processor.

by ezoe 6y ago

deleted 6y ago

[deleted]

deleted 6y ago

[deleted]

msh 6y ago

Mobile phones are way safer for normal users compared general purpose computers.

bad_user 6y ago

What does Free/OSS software have to do with the article? If the phone wasn't proprietary, would it have made any difference? The answer is obvious.

Reelin 6y ago
> The answer is obvious. Is it? I'm not overly familiar with any security exploits, but my understanding is that (at least for Android) the phone OS is often woefully out of date simply because the vendor stopped supplying updates. The end user generally can't supply updates themselves because everything is locked down in a decidedly user hostile manner. For the vendor's part, they often stop supplying updates (as I understand it) because the proprietary hardware doesn't have it's drivers upstreamed into the kernel (they're proprietary after all) which leads to a completely unjustifiable maintenance burden. They can't simply open source things because the hardware manufacturers generally require NDAs. As far as the hardware goes, my (probably woefully incomplete) understanding is that it remains proprietary due to a combination of attempting to maintain a competitive edge through secrecy, licensing complexities due to containing third party IP, and DRM issues (which are again a licensing concern).
- bad_user 6y ago
  No, that's not what happens on iOS. I'm writing this on a 5 year old device still getting updated. The iOS exploits that have historically allowed the device to be jailbroken have been zero-day vulnerabilities. And I'm assuming the TFA is about a zero-day too. Also Android is open source (AOSP). How does that help?
  - Reelin 6y ago
    I'm well aware that this isn't nearly as much of an issue for Apple devices - that's why I very clearly specified Android in my previous comment. Yes AOSP is open source but that doesn't help as much as one might hope for the reasons I outlined in my previous comment. Basically most end user devices aren't actually running AOSP at the end of the day, and can't without investing a nontrivial amount of effort. (And that still wouldn't prevent vulnerabilities related to out of date firmware.) The comment of yours that I originally responded to seemed to me to insinuate that having access to fully open sourced phones wouldn't be able to do anything to improve device security as a foregone conclusion. I was objecting to that, pointing out that there are a number of real world examples where access to a fully open source mobile stack would immediately and drastically improve the current situation. In a hypothetical world full of such stacks perhaps this article would never have been written.

fouc 6y ago

PinePhone seems promising

teddyh 6y ago
Also the Librem 5.

niyikiza 6y ago

I think the problem can be solved by separating the "phone" experience from the "mobile" experience. Phones are these devices powered by a philosophy (and to an extent, a technology) from 3-4 decades ago and day after day we see them ruining the experience of having the internet access from your hands. We need to move from a mobile-phone era to a mobile-internet era.

simonh 6y ago
In what way do you think the phone legacy is holding us back? What concrete steps would you suggest? It seems to me this has already happened. We only call these things phones for legacy reasons, but the iPhone broke the design link with actual phones and turned the phone aspect into just another communications app.
- kavalg 6y ago
  I guess he meant the baseband processor
  - simonh 6y ago
    OK, but how does that hold any other aspects of these devices back? Remove the baseband processor and you've got an iPod Touch, or a small iPad. It doesn't fundamentally change the device or really open up any new avenues not possible with a baseband processor.