6 ms·

> How is this "BS"? If you can replace the software to whatever you like, so can the baddies. And how are we confident that the ROM preinstalled is itself secu

> How is this "BS"? If you can replace the software to whatever you like, so can the baddies. And how are we confident that the ROM preinstalled is itself secure? Nobody can assert that and the owner is even prevented to check it. The most common security threat aren't coming from the trusted boot but play services blobs & manufacturer blobs, all behind the so-called trusted boot.

gruez 5y ago
>And how are we confident that the ROM preinstalled is itself secure? And what about your linux phone's rom? Do they have reproducible builds yet? Sure, it might be open source, but did anyone audit the millions of line of code to make sure it's actually backdoor/bug free? Moreover, HN readers might actually understand this stuff, but what about non-technical people? They're probably better off using a locked down phone with OEM ROM (you already have to trust the OEM) than with a locked down phone that can possibly be replaced with malicious firmware. >The most common security threat aren't coming from the trusted boot but play services blobs & manufacturer blobs source?
- realusername 5y ago
  I'm not even talking about reproducible builds, pre-installed phone ROMs are one step below that, there's no "builds". You just have no idea at all what's in it, there's not even a simple list available of what's in it... Here's a reminder that there's not a single android phone on the planet which runs AOSP. > They're probably better off using a locked down phone with OEM ROM (you already have to trust the OEM) than with a locked down phone that can possibly be replaced with malicious firmware. I don't think so, unless OEM are going to increase their standards, a thirdparty ROM will always be better since they can be reviewed and have at least a list of what's in there. That's a very low bar indeed but preinstalled ROMs have such low standards, that makes it better. > source? Which source? They aren't publishing any. Those services blobs have full permission to do whatever they want. They update in the background, can escape the sandbox, send device data home...
  - gruez 5y ago
    >You just have no idea at all what's in it, there's not even a simple list available of what's in it... What can you meaningfully do with this information? >Here's a reminder that there's not a single android phone on the planet which runs AOSP. Again, for the people who don't care about running a full FOSS stack, why does it matter? >a thirdparty ROM will always be better since they can be reviewed You mean how on lineageos, most devices have a grand total of two maintainers? >That's a very low bar indeed but preinstalled ROMs have such low standards, that makes it better. motorola and google puts out mostly vanilla android on their phones. >>>The most common security threat aren't coming from the trusted boot but play services blobs & manufacturer blobs >> source? >Which source? You're being obtuse here. "source?" in this context obviously refers to me asking you for evidence for your claim you made.
    - realusername 5y ago
      > What can you meaningfully do with this information? Check the security of my device and my data? It would help build a trust with my device. Until that happens, phones are at best toys and not real computers you can trust. > Again, for the people who don't care about running a full FOSS stack, why does it matter? It's not about FOSS but basic freedom & security here. > You mean how on lineageos, most devices have a grand total of two maintainers? As opposed to preinstalled roms which have exactly zero external people reviewing them. Yes, the standards are THAT low. > motorola and google puts out mostly vanilla android on their phones. No they don't. Some people are trying to replicate the ROMs for other phones (like https://download.pixelexperience.org/ https://download.pixelexperience.org/ ) but that's some community effort. There's nothing vanilla about motorola or google phones. > You're being obtuse here. "source?" in this context obviously refers to me asking you for evidence for your claim you made. Why though? Even Android admits it, just go into Settings > Security and Settings > Account and look the amount of stuff that they say runs in the background. That's only what they want to admit though, who really knows what it's doing.
      - gruez 5y ago
        >Check the security of my device and my data? A phone operating system probably uses hundreds of libraries/codebases. Are you seriously keeping tabs on all of them? >It's not about FOSS but basic freedom & security here. Sounds like you're more objecting to the "FOSS" label than the general attitude of "the entire software/hardware stack has to be open source". >As opposed to preinstalled roms which have exactly zero external people reviewing them. Yes, the standards are THAT low. exactly zero? https://twitter.com/topjohnwu/status/1234547148785475585?lang=en https://twitter.com/topjohnwu/status/1234547148785475585?lan... >No they don't. Some people are trying to replicate the ROMs for other phones (like https://download.pixelexperience.org/ https://download.pixelexperience.org/ ) but that's some community effort. There's nothing vanilla about motorola or google phones. 1. I said "mostly" vanilla 2. what's your definition of vanilla? If google makes android, then arguably whatever they puts out can be considered vanilla, even if it isn't part of AOSP. Of all the chromium based browsers out there, I'd still consider google chrome "mostly vanilla", even if it does has proprietary bits that aren't part of the chromium project. >Why though? Because you're making the claim. >Even Android admits it, just go into Settings > Security and Settings > Account and look the amount of stuff that they say runs in the background. "There's a lot of stuff running" =/= "The most common security threat aren't coming from the trusted boot but play services blobs & manufacturer blobs"
- goodpoint 5y ago
  > And what about your linux phone's rom? Do they have reproducible builds yet? Actually, yes. > Sure, it might be open source, but did anyone audit the millions of line of code to make sure it's actually backdoor/bug free? Yes, that's what Linux distribution, large companies and independent researchers do. I reviewed an amount of code myself. Also wrote sandboxes.

gruez 5y ago

>And how are we confident that the ROM preinstalled is itself secure? And what about your linux phone's rom? Do they have reproducible builds yet? Sure, it might be open source, but did anyone audit the millions of line of code to make sure it's actually backdoor/bug free? Moreover, HN readers might actually understand this stuff, but what about non-technical people? They're probably better off using a locked down phone with OEM ROM (you already have to trust the OEM) than with a locked down phone that can possibly be replaced with malicious firmware. >The most common security threat aren't coming from the trusted boot but play services blobs & manufacturer blobs source?

realusername 5y ago
I'm not even talking about reproducible builds, pre-installed phone ROMs are one step below that, there's no "builds". You just have no idea at all what's in it, there's not even a simple list available of what's in it... Here's a reminder that there's not a single android phone on the planet which runs AOSP. > They're probably better off using a locked down phone with OEM ROM (you already have to trust the OEM) than with a locked down phone that can possibly be replaced with malicious firmware. I don't think so, unless OEM are going to increase their standards, a thirdparty ROM will always be better since they can be reviewed and have at least a list of what's in there. That's a very low bar indeed but preinstalled ROMs have such low standards, that makes it better. > source? Which source? They aren't publishing any. Those services blobs have full permission to do whatever they want. They update in the background, can escape the sandbox, send device data home...
- gruez 5y ago
  >You just have no idea at all what's in it, there's not even a simple list available of what's in it... What can you meaningfully do with this information? >Here's a reminder that there's not a single android phone on the planet which runs AOSP. Again, for the people who don't care about running a full FOSS stack, why does it matter? >a thirdparty ROM will always be better since they can be reviewed You mean how on lineageos, most devices have a grand total of two maintainers? >That's a very low bar indeed but preinstalled ROMs have such low standards, that makes it better. motorola and google puts out mostly vanilla android on their phones. >>>The most common security threat aren't coming from the trusted boot but play services blobs & manufacturer blobs >> source? >Which source? You're being obtuse here. "source?" in this context obviously refers to me asking you for evidence for your claim you made.
  - realusername 5y ago
    > What can you meaningfully do with this information? Check the security of my device and my data? It would help build a trust with my device. Until that happens, phones are at best toys and not real computers you can trust. > Again, for the people who don't care about running a full FOSS stack, why does it matter? It's not about FOSS but basic freedom & security here. > You mean how on lineageos, most devices have a grand total of two maintainers? As opposed to preinstalled roms which have exactly zero external people reviewing them. Yes, the standards are THAT low. > motorola and google puts out mostly vanilla android on their phones. No they don't. Some people are trying to replicate the ROMs for other phones (like https://download.pixelexperience.org/ https://download.pixelexperience.org/ ) but that's some community effort. There's nothing vanilla about motorola or google phones. > You're being obtuse here. "source?" in this context obviously refers to me asking you for evidence for your claim you made. Why though? Even Android admits it, just go into Settings > Security and Settings > Account and look the amount of stuff that they say runs in the background. That's only what they want to admit though, who really knows what it's doing.
    - gruez 5y ago
      >Check the security of my device and my data? A phone operating system probably uses hundreds of libraries/codebases. Are you seriously keeping tabs on all of them? >It's not about FOSS but basic freedom & security here. Sounds like you're more objecting to the "FOSS" label than the general attitude of "the entire software/hardware stack has to be open source". >As opposed to preinstalled roms which have exactly zero external people reviewing them. Yes, the standards are THAT low. exactly zero? https://twitter.com/topjohnwu/status/1234547148785475585?lang=en https://twitter.com/topjohnwu/status/1234547148785475585?lan... >No they don't. Some people are trying to replicate the ROMs for other phones (like https://download.pixelexperience.org/ https://download.pixelexperience.org/ ) but that's some community effort. There's nothing vanilla about motorola or google phones. 1. I said "mostly" vanilla 2. what's your definition of vanilla? If google makes android, then arguably whatever they puts out can be considered vanilla, even if it isn't part of AOSP. Of all the chromium based browsers out there, I'd still consider google chrome "mostly vanilla", even if it does has proprietary bits that aren't part of the chromium project. >Why though? Because you're making the claim. >Even Android admits it, just go into Settings > Security and Settings > Account and look the amount of stuff that they say runs in the background. "There's a lot of stuff running" =/= "The most common security threat aren't coming from the trusted boot but play services blobs & manufacturer blobs"
goodpoint 5y ago
> And what about your linux phone's rom? Do they have reproducible builds yet? Actually, yes. > Sure, it might be open source, but did anyone audit the millions of line of code to make sure it's actually backdoor/bug free? Yes, that's what Linux distribution, large companies and independent researchers do. I reviewed an amount of code myself. Also wrote sandboxes.