5 ms·

Man, stuff like this is so depressing to read. Like this is supposed to be a forum for showcasing new tech, projects, etc. What's the point of having this if pe

Man, stuff like this is so depressing to read. Like this is supposed to be a forum for showcasing new tech, projects, etc. What's the point of having this if people in the industry are going to say, "I don't like it because it's not backed by a trillion dollar company". What will change ?

oh_sigh 5y ago
Many people run their entire lives off of their phones. Being concerned about security is prudent, not depressing.
- posguy 5y ago
  How far off of AOSP is CalyxOS though? Given that most Android users are running unaudited carrier & OEM modified ROMs that rarely see updates, a ROM that is very close to upstream AOSP is apt to be much more secure. Nevermind that many of the apps that Google ships as part of Google Play are not receiving security audits outside of Google, Google is not committing to regularly audit their apps or publish the results, and these apps function as black boxes on your phone, with privileges that most other apps do not have.
- chrisco255 5y ago
  Open source software has a better security track record than closed source software run by billion dollar corps.
  - joemazerino 5y ago
    Does it though? Have you looked at the vast number of vulnerabilities introduced into the Linux kernel in the last 3 years?
- VoodooJuJu 5y ago
  >Many people run their entire lives off of their phones This is the real problem, not the lack of security audits.
- lobocinza 5y ago
  Being concerned is being rational just the reality of it that's depressing.
Kaytaro 5y ago
OP didn't say he doesn't like it, just pointing out the reality. But yes, the reality is depressing.
- fragmede 5y ago
  In offering only two choices, when the reality is far more complex than that, GP sets the tone for the rest of the discussion. There are more options, and a far deeper lake of information to use for drawing conclusions, so the simplification is also insulting, on top of being depressing.
  - nerbert 5y ago
    OP is just saying that audits would be nice, which is true.
  - VortexDream 5y ago
    If you have other options or other things that should be considered, then add them. As it is, you seem to be dismissing his absolutely valid concerns without any reason as to why you think they're invalid. I have the same concerns as he does and it's the same reason I don't use custom ROMs. I have no way to know how security conscious the developers actually are.
    - bubblethink 5y ago
      That's a valid concern and only you can judge for yourself whether something works for you or not. It's open source. Read the code and do your research. Going to some project's thread and saying, "But, what if this is shoddy code or run by the FBI ?" is beyond pointless. Praise can be generous. Criticism needs to be conservative and precise.
      - VortexDream 5y ago
        That's utterly ridiculous and you're clearly arguing in bad faith. Let's say I do have the infinite amount of time necessary and the technical expertise to conduct an audit of a custom ROM. Is every single person who's interested in privacy and security required to do their own audit? If I publish my findings, why should anybody ever believe me? Who am I to tell anybody how safe it is? If you think it's so safe, why don't you do an audit and prove it to those of us with doubts instead of expecting us to do it? Oh, right. You're operating on faith on these groups of people that you don't know who don't have any processes in place to ensure that what they're doing is safe for their users.
OJFord 5y ago
That's not really the point though is it? It's more like 'I do like it.. is it sensible to use it?' At least, that's how I read it, and how I feel about such things. I'd very much like my next phone to run Linux (i.e. be a Pinephone) though.
- shadowgovt 5y ago
  I got a Pinephone. I like the idea, but it's a deeply frustrating experience right now. Basic table-stakes features I have come to assume from both Android and iOS platforms just aren't there yet. It's a frustrating chicken egg problem... I want the thing to succeed, but my smartphone is so critical to my day-to-day that I can either wait for it to get better or invest the time into having it suck on toast while I improve it.
  - zozbot234 5y ago
    Yup, the PinePhone is still being worked on and quite far from being usable as a daily driver. To be fair, the Pine64 folks are also very clear about this.
  - OJFord 5y ago
    Oh I get that, hence 'would very much like my next to be' vs. rushing 'out' to buy one. I'd also have to figure out some more specifically personal stuff like alternatives or Matrix bridges for apps I 'need to' use to communicate with certain people.
  - 8bitsrule 5y ago
    I was hoping to use Pinephone this year, but nope. I have a 7yo phone with better specs, including a 2.5x faster clock. Yes it's an Android, but ... Maybe next year.
- thinkloop 5y ago
  > I'd very much like my next phone to run Linux Why again? Android is already free and open source and Linux doesn't have good answers for the proprietary goodies
ajklsdhfniuwehf 5y ago
all those phones need closed source binary blob drives to even power on. that's why each project is focused on a single device at a time. THis is all toxic to open source! The only wining move is NOT to play. If you go out of your way to buy the phone that some unkwown party managed to hack the binary blob(s) out of the official image into the custom one, you are losing because the quality will be worse than the closed source offering, always. From actual security to usability. And it will be driving engagement away from actual solutions to the problem (such as pine phone etc, which are also lagging, but are not as this egregiously bad)
sockpuppet_12 5y ago
I think theres good reason to be concerned about investing in an OS which doesn't have the kind of well funded security team capable of actively hunting for APTs with rigor and reacting promptly to zero days once they're found. It is depressing, but phones are unique in that they need to work flawlessly in an emergency which I think is a factor in preventing people from straying from the path "well-travelled". This is much to my lament as well, because I would love to feel more free to experiment with phone operating systems and hardware addons.

oh_sigh 5y ago

Many people run their entire lives off of their phones. Being concerned about security is prudent, not depressing.

posguy 5y ago
How far off of AOSP is CalyxOS though? Given that most Android users are running unaudited carrier & OEM modified ROMs that rarely see updates, a ROM that is very close to upstream AOSP is apt to be much more secure. Nevermind that many of the apps that Google ships as part of Google Play are not receiving security audits outside of Google, Google is not committing to regularly audit their apps or publish the results, and these apps function as black boxes on your phone, with privileges that most other apps do not have.
chrisco255 5y ago
Open source software has a better security track record than closed source software run by billion dollar corps.
- joemazerino 5y ago
  Does it though? Have you looked at the vast number of vulnerabilities introduced into the Linux kernel in the last 3 years?
VoodooJuJu 5y ago
>Many people run their entire lives off of their phones This is the real problem, not the lack of security audits.
lobocinza 5y ago
Being concerned is being rational just the reality of it that's depressing.

Kaytaro 5y ago

OP didn't say he doesn't like it, just pointing out the reality. But yes, the reality is depressing.

fragmede 5y ago
In offering only two choices, when the reality is far more complex than that, GP sets the tone for the rest of the discussion. There are more options, and a far deeper lake of information to use for drawing conclusions, so the simplification is also insulting, on top of being depressing.
- nerbert 5y ago
  OP is just saying that audits would be nice, which is true.
- VortexDream 5y ago
  If you have other options or other things that should be considered, then add them. As it is, you seem to be dismissing his absolutely valid concerns without any reason as to why you think they're invalid. I have the same concerns as he does and it's the same reason I don't use custom ROMs. I have no way to know how security conscious the developers actually are.
  - bubblethink 5y ago
    That's a valid concern and only you can judge for yourself whether something works for you or not. It's open source. Read the code and do your research. Going to some project's thread and saying, "But, what if this is shoddy code or run by the FBI ?" is beyond pointless. Praise can be generous. Criticism needs to be conservative and precise.
    - VortexDream 5y ago
      That's utterly ridiculous and you're clearly arguing in bad faith. Let's say I do have the infinite amount of time necessary and the technical expertise to conduct an audit of a custom ROM. Is every single person who's interested in privacy and security required to do their own audit? If I publish my findings, why should anybody ever believe me? Who am I to tell anybody how safe it is? If you think it's so safe, why don't you do an audit and prove it to those of us with doubts instead of expecting us to do it? Oh, right. You're operating on faith on these groups of people that you don't know who don't have any processes in place to ensure that what they're doing is safe for their users.

OJFord 5y ago

That's not really the point though is it? It's more like 'I do like it.. is it sensible to use it?' At least, that's how I read it, and how I feel about such things. I'd very much like my next phone to run Linux (i.e. be a Pinephone) though.

shadowgovt 5y ago
I got a Pinephone. I like the idea, but it's a deeply frustrating experience right now. Basic table-stakes features I have come to assume from both Android and iOS platforms just aren't there yet. It's a frustrating chicken egg problem... I want the thing to succeed, but my smartphone is so critical to my day-to-day that I can either wait for it to get better or invest the time into having it suck on toast while I improve it.
- zozbot234 5y ago
  Yup, the PinePhone is still being worked on and quite far from being usable as a daily driver. To be fair, the Pine64 folks are also very clear about this.
- OJFord 5y ago
  Oh I get that, hence 'would very much like my next to be' vs. rushing 'out' to buy one. I'd also have to figure out some more specifically personal stuff like alternatives or Matrix bridges for apps I 'need to' use to communicate with certain people.
- 8bitsrule 5y ago
  I was hoping to use Pinephone this year, but nope. I have a 7yo phone with better specs, including a 2.5x faster clock. Yes it's an Android, but ... Maybe next year.
thinkloop 5y ago
> I'd very much like my next phone to run Linux Why again? Android is already free and open source and Linux doesn't have good answers for the proprietary goodies

ajklsdhfniuwehf 5y ago

all those phones need closed source binary blob drives to even power on. that's why each project is focused on a single device at a time. THis is all toxic to open source! The only wining move is NOT to play. If you go out of your way to buy the phone that some unkwown party managed to hack the binary blob(s) out of the official image into the custom one, you are losing because the quality will be worse than the closed source offering, always. From actual security to usability. And it will be driving engagement away from actual solutions to the problem (such as pine phone etc, which are also lagging, but are not as this egregiously bad)

sockpuppet_12 5y ago

I think theres good reason to be concerned about investing in an OS which doesn't have the kind of well funded security team capable of actively hunting for APTs with rigor and reacting promptly to zero days once they're found. It is depressing, but phones are unique in that they need to work flawlessly in an emergency which I think is a factor in preventing people from straying from the path "well-travelled". This is much to my lament as well, because I would love to feel more free to experiment with phone operating systems and hardware addons.