4 ms·

One of the things I really didn't expect to be Googling in 2021 is 'Best dumb phone 2021'. After advocating to all my friends that Apple is a beacon of how pri

One of the things I really didn't expect to be Googling in 2021 is 'Best dumb phone 2021'. After advocating to all my friends that Apple is a beacon of how privacy should be done, I just can't understand how they've made such a hash of this.

fsflover 5y ago
Why a dumb phone if you have a verifiable FLOSS GNU/Linux phone in 2021, Librem 5 or Pinephone?
- LinuxBender 5y ago
  Have any wireless providers verified that Firmware/OS/App updates can't be pushed via OTA to those devices? Asking because to my knowledge no such verification has been attempted. Background: I used to push firmware updates to phones in the 90's on a GSM network. The only reason we didn't do this globally was risk of customer support issues.
  - fsflover 5y ago
    Both phones have their modems separated from the OS with USB/M.2 interfaces. Also, they have kill switches. Pinephone's modem even runs Linux: https://linuxsmartphones.com/hackers-develop-open-source-firmware-for-the-pinephone-modem-use-it-to-make-phone-calls/ https://linuxsmartphones.com/hackers-develop-open-source-fir....
    - LinuxBender 5y ago
      I understand what you are saying, but in my opinion that doesn't really answer the question. For a phone to attach to a network, there is some level of bidirectional trust and those kill-switches aren't going to just arbitrarily activate. Has anyone at a wireless provider tested pushing OTA updates to those phones? Has the vendor explicitly stated that the phones will explicitly block by default any attempts at OTA updates or that the phones explicitly do not have the capability?
      - fsflover 5y ago
        I don't think any vendor confirmed that. But is this possible to update software on my device without permission by its OS via a well-defined external interface? These phones are desktop computers running GNU/Linux. If they can be updated this way, then my laptop can as well be updated by a WiFi card, can't it? (I don't think so) Upd: I am not an expert, but maybe the schematics could help you here: https://source.puri.sm/Librem5/l5-schematic https://source.puri.sm/Librem5/l5-schematic and https://wiki.pine64.org/index.php/PinePhone#PinePhone_board_information.2C_schematics_and_certifications https://wiki.pine64.org/index.php/PinePhone#PinePhone_board_....
        LinuxBender 5y ago
        I suppose it depends on what standards each of these Linux phone implementations have followed. Android also runs Linux, but they modified it to give the wireless providers and Google full control, hence people wanting to root their phones. Just running Linux is not enough to give me confidence that the phone is truly isolated from network management. So I suppose it comes down to what kernel modules, libraries and trust these phones are giving to the provider and what standards they are following. A good start would be independent kernel hackers digging into the hardware and OS to see what they can make the phone do and what they see the phone doing under normal operations when attaching to the network and how the phone responds to OTA update attempts and what the firmware on the phone is doing. If I control the firmware and you control the OS, I control what your OS can read and write to. So I suppose my unanswered questions are: - Who writes and maintains the firmware the OS is running on. - Who writes and maintains the modem firmware and who can update it. - Who can update that firmware for the board the OS is running on. This could be a different answer than who initially creates it for the retail distribution of the phone. - What level of trust has been inserted into the OS by kernel modules and who maintains those kernel modules. - What control is given to the end user to see what those modules are doing and limit what they can do. I suspect more questions could arise as kernel hackers audited the phone. The dilemma I see is that such kernel hackers won't be interested until those phones are wildly popular. The only other way to get their interest is with money.
norov 5y ago
Starting to suspect that a trillion dollar corporation is more interested in profits than fighting for the little guy?

fsflover 5y ago

Why a dumb phone if you have a verifiable FLOSS GNU/Linux phone in 2021, Librem 5 or Pinephone?

LinuxBender 5y ago
Have any wireless providers verified that Firmware/OS/App updates can't be pushed via OTA to those devices? Asking because to my knowledge no such verification has been attempted. Background: I used to push firmware updates to phones in the 90's on a GSM network. The only reason we didn't do this globally was risk of customer support issues.
- fsflover 5y ago
  Both phones have their modems separated from the OS with USB/M.2 interfaces. Also, they have kill switches. Pinephone's modem even runs Linux: https://linuxsmartphones.com/hackers-develop-open-source-firmware-for-the-pinephone-modem-use-it-to-make-phone-calls/ https://linuxsmartphones.com/hackers-develop-open-source-fir....
  - LinuxBender 5y ago
    I understand what you are saying, but in my opinion that doesn't really answer the question. For a phone to attach to a network, there is some level of bidirectional trust and those kill-switches aren't going to just arbitrarily activate. Has anyone at a wireless provider tested pushing OTA updates to those phones? Has the vendor explicitly stated that the phones will explicitly block by default any attempts at OTA updates or that the phones explicitly do not have the capability?
    - fsflover 5y ago
      I don't think any vendor confirmed that. But is this possible to update software on my device without permission by its OS via a well-defined external interface? These phones are desktop computers running GNU/Linux. If they can be updated this way, then my laptop can as well be updated by a WiFi card, can't it? (I don't think so) Upd: I am not an expert, but maybe the schematics could help you here: https://source.puri.sm/Librem5/l5-schematic https://source.puri.sm/Librem5/l5-schematic and https://wiki.pine64.org/index.php/PinePhone#PinePhone_board_information.2C_schematics_and_certifications https://wiki.pine64.org/index.php/PinePhone#PinePhone_board_....
      - LinuxBender 5y ago
        I suppose it depends on what standards each of these Linux phone implementations have followed. Android also runs Linux, but they modified it to give the wireless providers and Google full control, hence people wanting to root their phones. Just running Linux is not enough to give me confidence that the phone is truly isolated from network management. So I suppose it comes down to what kernel modules, libraries and trust these phones are giving to the provider and what standards they are following. A good start would be independent kernel hackers digging into the hardware and OS to see what they can make the phone do and what they see the phone doing under normal operations when attaching to the network and how the phone responds to OTA update attempts and what the firmware on the phone is doing. If I control the firmware and you control the OS, I control what your OS can read and write to. So I suppose my unanswered questions are: - Who writes and maintains the firmware the OS is running on. - Who writes and maintains the modem firmware and who can update it. - Who can update that firmware for the board the OS is running on. This could be a different answer than who initially creates it for the retail distribution of the phone. - What level of trust has been inserted into the OS by kernel modules and who maintains those kernel modules. - What control is given to the end user to see what those modules are doing and limit what they can do. I suspect more questions could arise as kernel hackers audited the phone. The dilemma I see is that such kernel hackers won't be interested until those phones are wildly popular. The only other way to get their interest is with money.

norov 5y ago

Starting to suspect that a trillion dollar corporation is more interested in profits than fighting for the little guy?