17 ms·

The thing which always makes me hesitant about these projects is that they don't receive frequent security audits and not having an expensive brand behind them

• dheera 5y ago
  > B. The small group of people who have formed an organization which may or may not be another Anom like FBI controlled software. Um, this project is 100% open source, unlike Google's flavor of Android. If there are backdoors to the FBI they will be exposed in due time. https://gitlab.com/CalyxOS https://gitlab.com/CalyxOS That said I'd love to understand how it compares to LineageOS.
  • tkzed49 5y ago
    I just don't buy this take. There's so much code; how can you be certain it will face sufficient scrutiny just by virtue of being available?
    • enriquto 5y ago
      you cannot be certain, but at least the code has the chance to be publicly scrutinized. This is not the case at all with google binaries, so you have a net, objective gain.
    • atatatat 5y ago
      This is a valid criticism. Upstream being AOSP helps a lot.
  • atatatat 5y ago
    Well, Calyx keeps the basic security model of Android intact (verified boot), unlike Lineage.
    • zozbot234 5y ago
      Custom verified boot needs to be supported in hardware. But with most devices, you can use "fastboot boot" from an external device to start from an image that you trust.
      • cdesai 5y ago
        Note: You can only do this when the bootloader is unlocked. When it's locked (which is the entire point of custom verified boot), this is not allowed.
    • GekkePrutser 5y ago
      Indeed, but in return it only supports pixel phones, sadly (considering they're not great value for money for custom rom purposes, and most of their added value is lost when running a custom rom)
      • mdp2021 5y ago
        > most of their added value is lost when running a custom rom Could you please explain?
        • GekkePrutser 5y ago
          Well, Google packages the pixel phones with their latest OS updates and pixel specific features like Gcam. By running a custom ROM you lose those. Its cameras mainly perform so well because of the big AI farms at Google.
          • cdesai 5y ago
            Google Camera works just fine, entirely offline as well. You do miss out on some other pixel-specific features (Hold for Me for example), but camera quality should be unaffected.
• corebuffer 5y ago
  IMO the free software group at least is auditable. I wish Replicant was able to catch up. Having blobs at the baseband is awful, but having the baseband accessing all RAM is just game over for privacy. There isn't what to trust in that setting.
• zozbot234 5y ago
  This is why I see projects like postmarketOS, Mobian and Debian Mobile as having a lot more potential. Let's be clear about this, these projects are not practically usable right now in a "daily driver" sense, even compared to a simple AOSP-based custom ROM. But they have the right goal in place - sharing a single, unified code base across our mainstream and mobile OS's.
  • deleted 5y ago
    [deleted]
• atatatat 5y ago
  Disagree. The reputation of Nick Calyx (worth a look his Wikipedia page), or GrapheneOS team, etc, is so much easier lost than that of, say, Google's Android team.....or iOS security team. Having said that: Calyx shouldn't be considered much more secure than Android Open Source Project (AOSP). That's where GrapheneOS shines. Calyx should, however, be considered more private than AOSP, less dodgy & exploitable than Samsung etc Android "enhancements", aka UI/UX bloatware.
  • nextos 5y ago
    How does CalyxOS compare to GrapheneOS?
    • GekkePrutser 5y ago
      Calyx has more focus on functionality and privacy rather than security. On Graphene, security is always priority #1. For example: Calyx provides MicroG. This means you can talk to Google Play services, though in a better, more privacy-conscious way. MicroG is an open implentation of Google Play Services. However, MicroG requires signature spoofing: You need to install a fake Google certificate so that it can trick official apps into thinking they're talking to Google Play Services directly. This could technically be abused, though Calyx takes lots of precautions to prevent that. GrapheneOS with their security-first approach don't deem this worth the risk. So with apps requiring play services you don't get push messages and network-based location checks, among others. So, do you want an allround phone to use everyday (and use things like Uber, Facebook, etc) but more private and secure than AOSP, take Calyx. Do you want security over everything and are willing to compromise a bit on functionality and app compatibility (some apps will refuse to run without google play), pick Graphene. Either way you'll need a Google Pixel by the way.
      • cdesai 5y ago
        The microG creator goes into more detail about signature spoofing at https://github.com/microg/GmsCore/issues/1467#issuecomment-840711695 https://github.com/microg/GmsCore/issues/1467#issuecomment-8... The concerns usually raised against that are due to the "default" patch included in their repository, which has a specific purpose. We don't use that, https://calyxos.org/about/tech/microg/ https://calyxos.org/about/tech/microg/ are the precautions we take to try and prevent abuse. I made it a privileged permission because that's a standard Android thing to gate things (such as reading of IMEI) - My thought process being that if you somehow managed to get around privileged permissions, we have much bigger problems than signature spoofing.
• codegladiator 5y ago
  > The thing which always makes me hesitant about these projects is that they don't receive frequent security audits and not having an expensive brand behind them makes them more at risk Why are you looking for alternatives ? or are you even
• securitypunk 5y ago
  Anyone who has managed a product security program will tell you that's it's impossible for small groups to keep up with the complexity and attack surface of products like android. From a consumer perspective, going with A and trusting the company is by far the safest option.
  • runawaybottle 5y ago
    I can appreciate that but option A actors are now in full dictator mode with respect to how they are willing to breach privacy and monetize their users. How did Linux keep up with security updates?
    • vngzs 5y ago
      You have an army of volunteers backporting patches, in the case of Debian. It's been done, but it takes a certain amount of support.
  • trulyme 5y ago
    Meh. Given the option of a secure but adversarial OS and less secure but open one, I will always pick the latter. Then at least there is a fighting chance my data stays mine.
  • scns 5y ago
    Sorry to be a pedantic but: Two People created CopperheadOS, one of them now works on GrapheneOS. The security mitigations developed for those were incorporated upstream into Android, decreasing the attack surface.
    • hfkfktnekfm 5y ago
      If I find an exploit in Chrome and I send a patch to Google, it doesn't imply that single handed I can manage the security of a Chrome fork.
    • strcat 5y ago
      > Two People created CopperheadOS, one of them now works on GrapheneOS. No, that's not true. GrapheneOS is the continuation of the project by the original development team. There aren't any developers who stuck with Copperhead. The project was created 1 year before Copperhead existed as a company. https://grapheneos.org/history https://grapheneos.org/history > The security mitigations developed for those were incorporated upstream into Android, decreasing the attack surface. https://grapheneos.org/features https://grapheneos.org/features is a list of the current features differentiating it from AOSP. It doesn't list the many things we've gotten into upstream projects, since they aren't differences anymore.
• ezconnect 5y ago
  This is definitely better than google spyware as a phone. No built in exploit.
• deleted 5y ago
  [deleted]
• cdesai 5y ago
  A. While it is hard to say something about A having thousands of developers (just having more eyes on everything they're doing), it's not infallible, nor does it strictly mean they want to 'avoid their brand being dirtied' B. CalyxOS is a project of the non-profit Calyx Institute, founded by https://en.wikipedia.org/wiki/Nicholas_Merrill https://en.wikipedia.org/wiki/Nicholas_Merrill
• peakaboo 5y ago
  That attitude will lead to you being a slave for Apple or Microsoft or Google for your entire life. They won't change their ways. You won't have privacy there.
• vngzs 5y ago
  I know people who made it to the final rounds of interviews at Calyx. They are the real deal. I don't think much of anything could get them to compromise their values about privacy [0]. Might they miss something because they're a smaller team? Yeah, maybe. Will they sell out? I don't think so. [0]: https://en.wikipedia.org/wiki/American_Civil_Liberties_Union_v._Ashcroft https://en.wikipedia.org/wiki/American_Civil_Liberties_Union...
  • botwriter 5y ago
    People always say this until CP is put on their computer by an intelligence agency and they don't want to go to prison as a child abuser... Who's going to believe a pedo anyway...
• minsc__and__boo 5y ago
  There was a time I would have gone with B), but I've been burned by too many "companies" with almost nothing to lose suddenly becoming malware or some other exploitive. This new wave of privacy branding, without 3P verification, open sourcing, or even means of recourse seems to be the new frontier for these used car salesman "trust me, it's private" pitches.
• bubblethink 5y ago
  Man, stuff like this is so depressing to read. Like this is supposed to be a forum for showcasing new tech, projects, etc. What's the point of having this if people in the industry are going to say, "I don't like it because it's not backed by a trillion dollar company". What will change ?
  • oh_sigh 5y ago
    Many people run their entire lives off of their phones. Being concerned about security is prudent, not depressing.
    • posguy 5y ago
      How far off of AOSP is CalyxOS though? Given that most Android users are running unaudited carrier & OEM modified ROMs that rarely see updates, a ROM that is very close to upstream AOSP is apt to be much more secure. Nevermind that many of the apps that Google ships as part of Google Play are not receiving security audits outside of Google, Google is not committing to regularly audit their apps or publish the results, and these apps function as black boxes on your phone, with privileges that most other apps do not have.
    • chrisco255 5y ago
      Open source software has a better security track record than closed source software run by billion dollar corps.
      • joemazerino 5y ago
        Does it though? Have you looked at the vast number of vulnerabilities introduced into the Linux kernel in the last 3 years?
    • VoodooJuJu 5y ago
      >Many people run their entire lives off of their phones This is the real problem, not the lack of security audits.
    • 5y ago
• sildur 5y ago
  B, of course. The FBI may or may not control that specific group of people. But you can bet it controls that company with thousands of developers.
• scrps 5y ago
  I trust people with money as their motive about as much as I'd trust a serious alcoholic to hold on to a bottle of booze for me without taking a sip. Might not be a popular opinion but it is my 2 cents to spend. Could a someone at an open source project slip in an obfuscated backdoor in some esoteric area of the OS? Of course. But the risks of being found out are so much higher, after the fact that all changes at an open source project are logged, diffed, and public (normally), even if only 10% of the userbase looks at the code, runs packet capture or an SSL bump on the network traffic, etc, that is 10% more than for products by Microsoft, Apple, Google, and unlike an insider with access who discovers something highly questionable at a massively powerful corporation, an open source project has almost no leverage to compel them to keep their mouth shut, meanwhile the risk for developers of an open source project that does something like that (even if they aren't in the know) is total loss of trust, forever. Couple all of that with targeting a highly technical audience (drug kingpins looking for secure comms are more c-suite than engineers, they are still caught up on a good sales pitch more than hard technical details e.g. Anom ) and you'd be fairly stupid to try to pull the wool over their eyes and expect it to not eventually get discovered.
  • shadowgovt 5y ago
    The alcoholic will definitely take a sip. ... But they are also heavily incentivized to know where your booze is, care for your booze, and make sure it doesn't get stolen or poisoned. Because if something happens to you, where are they going to get the sip?
    • heavyset_go 5y ago
      > ... But they are also heavily incentivized to know where your booze is, care for your booze, and make sure it doesn't get stolen or poisoned. Because if something happens to you, where are they going to get the sip? Where else are customers going to go? All phones in stores right now run OSes from either Apple or Google. Both companies can forsake their customers' trust and people will still buy phones that run their software. That incentive doesn't really exist in a market that's ruled by a two company mobile operating system cartel.
• bbarnett 5y ago
  To be fair, Samsung is a bloated hell of their own spyware, with endless phone homes for the keyboard, and all their apps. Google endlessly spies on everyone. I really don't think anyone could be worse, than a big corp.
• mycall 5y ago
  Google has thousands of Android developers? Interesting.
• heavyset_go 5y ago
  > Should I trust: A. The company which has thousands of developers working on it and wants to avoid their brand being dirtied by failures in security and privacy. If you're hoping market forces would keep companies competitive and secure, well, people don't have much of a choice when it comes to mobile operating systems. Free market dynamics that should correct this problem don't really come into play when a two company cartel has 99.7% of the mobile operating system market nearly split in half between them.
• yosito 5y ago
  I don't use Calyx to protect myself from state surveillance. I assume state actors can easily access anything and everything I do on internet connected devices. I use Calyx to protect myself from Google collecting data on me, profiling me, and turning me into a sheep on their attention economy farm.
• scns 5y ago
  May i suggest to you to check out what the (strange name i know) /e/ foundation is doing? Not a trillion dollar company by any means but still worth taking a look at IMHO. Builds on LineageOs MicroG, Google free. You can even buy phones from them with the OS preinstalled, Fairphones, refurbished older Samsung Galaxy S and a GigaSet are offered. A good site (once Show HN) to find phones supported by this and other ROMs is https://sustaphones.com https://sustaphones.com
• pl0x 5y ago
  There should be a third party independent group to conduct audits. That might solve this.
• 627467 5y ago
  To say that trillion dollar companies are less likely to fail at security/privacy because all their decisions take into consideration the hypothesis of reputation damage seems simplistic. They also have the money to pay for damage control.
• panta 5y ago
  > A. The company which has thousands of developers working on it and wants to avoid their brand being dirtied by failures in security and privacy. They don’t seem to be too much concerned about failures in security and privacy… Their entire business is based on dismantling of privacy, why should they be trusted more than companies that have alternative business models?
• nuker 5y ago
  Option A is actually split: A.1 … Google, an Ad company A.2 … Apple, hardware company
• TroisM 5y ago
  > The thing which always makes me hesitant about these projects is that they don't receive frequent security audits and not having an expensive brand behind them makes them more at risk to being willing to trash their name at the cost of my privacy and security. I consider these to be a fairly critical part of any project which claims superior privacy and security. Lets keep using known flawed alternatives instead?