9 ms·

Let’s start to discuss where we stand with open source smartphones, both in terms of software and hardware. Really worried about privacy and human rights. We ca

Let’s start to discuss where we stand with open source smartphones, both in terms of software and hardware. Really worried about privacy and human rights. We cannot trust Apple and Google on this..

tluyben2 5y ago
The current state is not great; I keep trying out the distros for my pinephone but everything is pretty much still unusable. Apps crash a lot, including the window manager and there are a very large amount of bugs. The hardware seems fine, but, as said above, it seems that critical hardware (and software for that hardware) is closed. What is great is: replaceable battery and dipswitches to physically turn on and off every module in the phone.
shoto_io 5y ago
So you don't trust large US tech companies. Fair. But why do you expect people can trust a group of anonymous developers building open source smartphones?
- FractalParadigm 5y ago
  Isn't that a large part of the open-source nature? Audit the code or hardware designs yourself, determine their trustworthiness from that. It's much harder to trust something when you can't examine the inner workings of it.
  - shoto_io 5y ago
    Ok thanks, I get that. But how many people can do that? Like 0.001% of the population?
    - stonogo 5y ago
      How many people can authenticate a dollar bill? How many people can validate a cryptographic signature? How many people can direct a blockbuster action movie? The point is, right now, nobody can audit these things. Once someone -- anyone! -- can, everyone else can benefit.
      - cassianoleal 5y ago
        There's also the matter of traceability. Even if there is no direct audit of the code, once a vulnerability is discovered it can be traced back to the person(s) who introduced it. With a closed system, only the owner of the source code history can do that. With open source, any person in the world can, and can start a discussion to understand whether it was malicious or not, if the person(s) should be banned from pushing code, new code security standards to be adopted, etc. You lean on the world's expertise at that point. Bad things happen. It's important to have the ability to understand why and mitigate for the future.
        pjmlp 5y ago
        Nope, it can be traced back to a random nickname on the Internet, using a computer somewhere in the globe.
        Traf444 5y ago
        I guess you have never had commit rights to any Linux distribution or such? You don't get commit rights as a random person, so yes, a commit can usually be traced back to a person. Sure, the committer could have received a patch from a unknown person, but then he's still responsible for the commit.
        pjmlp 5y ago
        I guess you are a security expert that knows how every single FOSS project that might be used as dependency works.
        Traf444 5y ago
        That's not what I tried to say. It's up to you as a user to make due diligence and make an informed decision if you want to use the software or not. Any serious project would have some form of web of trust and know who has commit rights. It's up to you to decide if you trust their web of trust. I guess from your comments that you are not actually interested in contributing to the discussion since you just sprout single line comments with no information at all.
    - ac29 5y ago
      I think its fair to call it 0%. Auditing a large, modern code base is going to be impossible for a single person. For example, the Linux kernel is 27.8M lines of code (as of Jan 2020, [0]). Yes, a lot of that code is for drivers you wont use, or platforms you aren't running on. But still, no one person is going to be able to get through all of it with enough attention to detail to notice things like subtle race conditions, especially if they were inserted maliciously. [0] https://www.phoronix.com/scan.php?page=news_item&px=Linux-Git-Stats-EOY2019 https://www.phoronix.com/scan.php?page=news_item&px=Linux-Gi...
- fullmoon888 5y ago
  You clearly don’t understand the transparency and power of open source code. Fair.
  - shoto_io 5y ago
    Helping me to understand would be appreciated and in the spirit of HN. Mocking me? Not so much.
    - manquer 5y ago
      Open source is like Open courts or Right to Information. Just like anything going in secrets courts is bad for judicial integrity, or RTI laws can help keep government somewhat honest, Open source can help like any other transparency framework. Just transparency is not a magic solution , open source alone is not going to solve everything. It is just one among many other controls we need.
- deleted 5y ago
  [deleted]
CodeGlitch 5y ago
The article says that Pegasus is installed via a zero-day (presumably via a phishing attack or similar). I love opensource software, but it is not a magic bullet that stops the likes of zero day attacks. In other words, using a fully opensource stack would not prevent something like Pegasus if they exploited a zero day. Purchasing phones which ensure frequent software patches for a number of years is a far better tactic IMHO. For example I recently purchased a Nokia X20 (https://www.clove.co.uk/products/nokia-x20 https://www.clove.co.uk/products/nokia-x20) which has a promised 3 years of OS upgrades...something I've not seen by other manufacturers.
- danogentili 5y ago
  Partially true, but moving away from proprietary hardware and software and especially cloud services would still greatly reduce the attack surface, and is something I committed to fully half a year ago by purging Google/Play services from my phone, having already wiped Windows off my drive five years ago, replacing it with Arch. This still wouldn't protect me from a targeted surveillance attempt like Pegasus, but it does protect me from automated mass surveillance in the cloud, and at least partially reduces the attack surface, by getting rid of unvetted, unreviewable, backdoored proprietary software. 0 regrets, only privacy vibes every since.

Let’s start to discuss where we stand with open source smartphones, both in terms of software and hardware. Really worried about privacy and human rights. We cannot trust Apple and Google on this..

tluyben2 5y ago

The current state is not great; I keep trying out the distros for my pinephone but everything is pretty much still unusable. Apps crash a lot, including the window manager and there are a very large amount of bugs. The hardware seems fine, but, as said above, it seems that critical hardware (and software for that hardware) is closed. What is great is: replaceable battery and dipswitches to physically turn on and off every module in the phone.

shoto_io 5y ago

So you don't trust large US tech companies. Fair. But why do you expect people can trust a group of anonymous developers building open source smartphones?

FractalParadigm 5y ago
Isn't that a large part of the open-source nature? Audit the code or hardware designs yourself, determine their trustworthiness from that. It's much harder to trust something when you can't examine the inner workings of it.
- shoto_io 5y ago
  Ok thanks, I get that. But how many people can do that? Like 0.001% of the population?
  - stonogo 5y ago
    How many people can authenticate a dollar bill? How many people can validate a cryptographic signature? How many people can direct a blockbuster action movie? The point is, right now, nobody can audit these things. Once someone -- anyone! -- can, everyone else can benefit.
    - cassianoleal 5y ago
      There's also the matter of traceability. Even if there is no direct audit of the code, once a vulnerability is discovered it can be traced back to the person(s) who introduced it. With a closed system, only the owner of the source code history can do that. With open source, any person in the world can, and can start a discussion to understand whether it was malicious or not, if the person(s) should be banned from pushing code, new code security standards to be adopted, etc. You lean on the world's expertise at that point. Bad things happen. It's important to have the ability to understand why and mitigate for the future.
      - pjmlp 5y ago
        Nope, it can be traced back to a random nickname on the Internet, using a computer somewhere in the globe.
        Traf444 5y ago
        I guess you have never had commit rights to any Linux distribution or such? You don't get commit rights as a random person, so yes, a commit can usually be traced back to a person. Sure, the committer could have received a patch from a unknown person, but then he's still responsible for the commit.
        pjmlp 5y ago
        I guess you are a security expert that knows how every single FOSS project that might be used as dependency works.
        Traf444 5y ago
        That's not what I tried to say. It's up to you as a user to make due diligence and make an informed decision if you want to use the software or not. Any serious project would have some form of web of trust and know who has commit rights. It's up to you to decide if you trust their web of trust. I guess from your comments that you are not actually interested in contributing to the discussion since you just sprout single line comments with no information at all.
  - ac29 5y ago
    I think its fair to call it 0%. Auditing a large, modern code base is going to be impossible for a single person. For example, the Linux kernel is 27.8M lines of code (as of Jan 2020, [0]). Yes, a lot of that code is for drivers you wont use, or platforms you aren't running on. But still, no one person is going to be able to get through all of it with enough attention to detail to notice things like subtle race conditions, especially if they were inserted maliciously. [0] https://www.phoronix.com/scan.php?page=news_item&px=Linux-Git-Stats-EOY2019 https://www.phoronix.com/scan.php?page=news_item&px=Linux-Gi...
fullmoon888 5y ago
You clearly don’t understand the transparency and power of open source code. Fair.
- shoto_io 5y ago
  Helping me to understand would be appreciated and in the spirit of HN. Mocking me? Not so much.
  - manquer 5y ago
    Open source is like Open courts or Right to Information. Just like anything going in secrets courts is bad for judicial integrity, or RTI laws can help keep government somewhat honest, Open source can help like any other transparency framework. Just transparency is not a magic solution , open source alone is not going to solve everything. It is just one among many other controls we need.
deleted 5y ago
[deleted]

CodeGlitch 5y ago

The article says that Pegasus is installed via a zero-day (presumably via a phishing attack or similar). I love opensource software, but it is not a magic bullet that stops the likes of zero day attacks. In other words, using a fully opensource stack would not prevent something like Pegasus if they exploited a zero day. Purchasing phones which ensure frequent software patches for a number of years is a far better tactic IMHO. For example I recently purchased a Nokia X20 (https://www.clove.co.uk/products/nokia-x20 https://www.clove.co.uk/products/nokia-x20) which has a promised 3 years of OS upgrades...something I've not seen by other manufacturers.

danogentili 5y ago
Partially true, but moving away from proprietary hardware and software and especially cloud services would still greatly reduce the attack surface, and is something I committed to fully half a year ago by purging Google/Play services from my phone, having already wiped Windows off my drive five years ago, replacing it with Arch. This still wouldn't protect me from a targeted surveillance attempt like Pegasus, but it does protect me from automated mass surveillance in the cloud, and at least partially reduces the attack surface, by getting rid of unvetted, unreviewable, backdoored proprietary software. 0 regrets, only privacy vibes every since.