7 ms·

Bullshit, respectfully. Convergence has been held back by UX and UX alone. It's the single most-requested feature at my bespoke secure technology firm.

fsflover 6y ago
> It's the single most-requested feature at my bespoke secure technology firm. I'm curious now, is your firm going to order a bunch of Librem 5 phones?
- atat7024 6y ago
  No. Their security model does not meet the baseline security needs of our clients.
  - fsflover 6y ago
    Actually you can customize the OS as you wish on this phone. Perhaps it's a big task though.
  - qchris 6y ago
    Would you mind elaborating on that? My understanding is from a verification point of view, the Librem 5 is functionally at the absolute top-tier in terms of OpSec concerns, with everything from the bootloader up being open and customized, full disk encryption available, and the only binary blobs (I think on the modem?) being completely sandboxed. Are there additional concerns, and what kind of solutions do they currently use that do meet those needs?
    - seba_dos1 6y ago
      You can even set up a secure boot chain with your own encryption keys, see: https://boundarydevices.com/high-assurance-boot-hab-i-mx8m-edition/ https://boundarydevices.com/high-assurance-boot-hab-i-mx8m-e... (it's a tutorial for a board that uses SoC from the same family as the Librem 5)
    - atat7024 6y ago
      The Librem 5 is not as open or libre as its marketing has tried to insinuate, simply having its binary blob signed and validated firmware saved in write-protected read-only memory and loaded by a secondary coprocessor to exploit a loophole in the definiton of "libre" hardware to allow it to qualify for the FSF's definiton of "Free" hardware. This renders the firmware unupdateable without shorting a connection. In the event a vulnerability is discovered in the modems or radios, the firmware cannot be updated without physically dismantling the phone. Firmware initialization is also no longer under the control of the host operating system because the initialization is carried out from outside the OS: changing or updating software on the host will not address these design defects. Although the modems and radios are not attached to the host via DMA, they rely on USB for isolation, which simply shifts the trust from the kernel driver to the kernel USB stack, and USB was never designed with distrusting the device plugged into it in mind unlike SMMU/IOMMU, which is specifically designed to mitigate unconstrained DMA. Current releases of the Librem 5 have been plagued by thermal throttling issues and poor battery life which in some cases has clocked in at less than 1 hour at idle. The Librem 5 does not even support software encryption and no progress has been made toward adding even LUKS encryption. The Librem 5 lacks a secure element for any hardware binding on the encryption and so would be entirely dependent on software-only encryption. The rebranded version of Debian that the Librem 5 uses as an operating system uses the same security model as the desktop stack, which is a perimeter or "all or nothing" security model. In the future, applications may be installed utilizing FlatPak. The threat model and measures FlatPak takes to meet it are as of yet unclear and uncertain. From https://github.com/Peter-Easton/GrapheneOS-Knowledge/blob/master/GrapheneOS-vs-Others.md https://github.com/Peter-Easton/GrapheneOS-Knowledge/blob/ma... which may be mildly out of date — but I doubt it. tl;dr Wake me up when you have an IOMMU!
      - qchris 6y ago
        Thanks for the info, I hadn't heard about the USB isolation architecture issue. I'm not sure about the status of LUKS on PureOS, but I know that Mobian supports it and there is a supported build of Mobian for the Librem 5. First-hand, I've encrypted my Pinephone image, but don't have a Librem 5 so can't independently confirm that it actually includes that during the eMMC flashing process, although I don't have a reason to believe elsewise. Not sure if it's bad practice to share, but then what options do you use? If Debian's security model isn't enough, do you roll your own Linux base from something else instead? What kind of hardware is there as an alternative?
michaelmrose 6y ago
In theory this makes tons of sense but despite microbenchmarks your expensive phone is still a kind of mediocre little computer and for optimal usage needs more ports a display, keyboard, pointing device, and battery. Basically it needs everything but the motherboard/cpu/ram meaning you need a $500 peripheral to turn your awesome $1000 dollar phone into a merely OK computer. If you really want to save money you probably have a $400 laptop and a $100 phone. If you have money to spend a $1000 phone AND a $1500 laptop will be a nicer experience. With support for arm software better than ever before and better hardware available cheaper than ever before its better than it has ever been for this idea but it would still be a compromise that you have to convince your customer they ought to both pay substantially for and accept.
- bitwize 6y ago
  Not true in the Apple ecosystem. The Apple Silicon chips in recent iPhones can trounce desktop chips from a few years ago, and the next-gen iPhone should rival a high-spec desktop from today.
  - mcny 6y ago
    Sorry if it sounds like I’m moving the goalpost but no. Apple, Android doesn’t matter. They are all trash. The fact that I can’t remove the battery, and have the phone working when connected to external power makes every single phone (even those with user serviceable battery) garbage. I don’t know of a single recent phone that works off of external power. Personally, I think this is enough to prohibit sale of a device. What I expect when a device is connected to power is for it to 1. work off of external power directly 2. charge the battery to an optimal level (possibly 60 to 80 percent?) and STOP charging I’d have thought this was the default way all electronics works. I know for a fact that my 2006 MacBook just worked if I remove the battery. Same with my random Asus N61JVx2 notebook computer as well. Why can’t new devices do this?
    - michaelmrose 6y ago
      I believe the reason is typically because they want to make the design of chargers cheaper and the circuitry inside simpler and ergo cheaper as well. What you want has a slightly higher unit cost and in 99.99% of cases doesn't impact the users usage. Laptops are designed to run off battery or power because this is how many people typically use laptops. They plug them in places where they use them for long periods of time whereas phones are virtually always charged for a short period of time often overnight and then carried around and used unplugged virtually all of the time. I have found the best solution to be to acquire hardware with more than sufficient battery power so as to only worry about charging it every 2-3 days when I'm sleeping. Phones exist with up to 5AH of battery power.

fsflover 6y ago

> It's the single most-requested feature at my bespoke secure technology firm. I'm curious now, is your firm going to order a bunch of Librem 5 phones?

atat7024 6y ago
No. Their security model does not meet the baseline security needs of our clients.
- fsflover 6y ago
  Actually you can customize the OS as you wish on this phone. Perhaps it's a big task though.
- qchris 6y ago
  Would you mind elaborating on that? My understanding is from a verification point of view, the Librem 5 is functionally at the absolute top-tier in terms of OpSec concerns, with everything from the bootloader up being open and customized, full disk encryption available, and the only binary blobs (I think on the modem?) being completely sandboxed. Are there additional concerns, and what kind of solutions do they currently use that do meet those needs?
  - seba_dos1 6y ago
    You can even set up a secure boot chain with your own encryption keys, see: https://boundarydevices.com/high-assurance-boot-hab-i-mx8m-edition/ https://boundarydevices.com/high-assurance-boot-hab-i-mx8m-e... (it's a tutorial for a board that uses SoC from the same family as the Librem 5)
  - atat7024 6y ago
    The Librem 5 is not as open or libre as its marketing has tried to insinuate, simply having its binary blob signed and validated firmware saved in write-protected read-only memory and loaded by a secondary coprocessor to exploit a loophole in the definiton of "libre" hardware to allow it to qualify for the FSF's definiton of "Free" hardware. This renders the firmware unupdateable without shorting a connection. In the event a vulnerability is discovered in the modems or radios, the firmware cannot be updated without physically dismantling the phone. Firmware initialization is also no longer under the control of the host operating system because the initialization is carried out from outside the OS: changing or updating software on the host will not address these design defects. Although the modems and radios are not attached to the host via DMA, they rely on USB for isolation, which simply shifts the trust from the kernel driver to the kernel USB stack, and USB was never designed with distrusting the device plugged into it in mind unlike SMMU/IOMMU, which is specifically designed to mitigate unconstrained DMA. Current releases of the Librem 5 have been plagued by thermal throttling issues and poor battery life which in some cases has clocked in at less than 1 hour at idle. The Librem 5 does not even support software encryption and no progress has been made toward adding even LUKS encryption. The Librem 5 lacks a secure element for any hardware binding on the encryption and so would be entirely dependent on software-only encryption. The rebranded version of Debian that the Librem 5 uses as an operating system uses the same security model as the desktop stack, which is a perimeter or "all or nothing" security model. In the future, applications may be installed utilizing FlatPak. The threat model and measures FlatPak takes to meet it are as of yet unclear and uncertain. From https://github.com/Peter-Easton/GrapheneOS-Knowledge/blob/master/GrapheneOS-vs-Others.md https://github.com/Peter-Easton/GrapheneOS-Knowledge/blob/ma... which may be mildly out of date — but I doubt it. tl;dr Wake me up when you have an IOMMU!
    - qchris 6y ago
      Thanks for the info, I hadn't heard about the USB isolation architecture issue. I'm not sure about the status of LUKS on PureOS, but I know that Mobian supports it and there is a supported build of Mobian for the Librem 5. First-hand, I've encrypted my Pinephone image, but don't have a Librem 5 so can't independently confirm that it actually includes that during the eMMC flashing process, although I don't have a reason to believe elsewise. Not sure if it's bad practice to share, but then what options do you use? If Debian's security model isn't enough, do you roll your own Linux base from something else instead? What kind of hardware is there as an alternative?

michaelmrose 6y ago

In theory this makes tons of sense but despite microbenchmarks your expensive phone is still a kind of mediocre little computer and for optimal usage needs more ports a display, keyboard, pointing device, and battery. Basically it needs everything but the motherboard/cpu/ram meaning you need a $500 peripheral to turn your awesome $1000 dollar phone into a merely OK computer. If you really want to save money you probably have a $400 laptop and a $100 phone. If you have money to spend a $1000 phone AND a $1500 laptop will be a nicer experience. With support for arm software better than ever before and better hardware available cheaper than ever before its better than it has ever been for this idea but it would still be a compromise that you have to convince your customer they ought to both pay substantially for and accept.

bitwize 6y ago
Not true in the Apple ecosystem. The Apple Silicon chips in recent iPhones can trounce desktop chips from a few years ago, and the next-gen iPhone should rival a high-spec desktop from today.
- mcny 6y ago
  Sorry if it sounds like I’m moving the goalpost but no. Apple, Android doesn’t matter. They are all trash. The fact that I can’t remove the battery, and have the phone working when connected to external power makes every single phone (even those with user serviceable battery) garbage. I don’t know of a single recent phone that works off of external power. Personally, I think this is enough to prohibit sale of a device. What I expect when a device is connected to power is for it to 1. work off of external power directly 2. charge the battery to an optimal level (possibly 60 to 80 percent?) and STOP charging I’d have thought this was the default way all electronics works. I know for a fact that my 2006 MacBook just worked if I remove the battery. Same with my random Asus N61JVx2 notebook computer as well. Why can’t new devices do this?
  - michaelmrose 6y ago
    I believe the reason is typically because they want to make the design of chargers cheaper and the circuitry inside simpler and ergo cheaper as well. What you want has a slightly higher unit cost and in 99.99% of cases doesn't impact the users usage. Laptops are designed to run off battery or power because this is how many people typically use laptops. They plug them in places where they use them for long periods of time whereas phones are virtually always charged for a short period of time often overnight and then carried around and used unplugged virtually all of the time. I have found the best solution to be to acquire hardware with more than sufficient battery power so as to only worry about charging it every 2-3 days when I'm sleeping. Phones exist with up to 5AH of battery power.