4 ms·

I'm not even talking about reproducible builds, pre-installed phone ROMs are one step below that, there's no "builds". You just have no idea at all what's in it

I'm not even talking about reproducible builds, pre-installed phone ROMs are one step below that, there's no "builds". You just have no idea at all what's in it, there's not even a simple list available of what's in it... Here's a reminder that there's not a single android phone on the planet which runs AOSP. > They're probably better off using a locked down phone with OEM ROM (you already have to trust the OEM) than with a locked down phone that can possibly be replaced with malicious firmware. I don't think so, unless OEM are going to increase their standards, a thirdparty ROM will always be better since they can be reviewed and have at least a list of what's in there. That's a very low bar indeed but preinstalled ROMs have such low standards, that makes it better. > source? Which source? They aren't publishing any. Those services blobs have full permission to do whatever they want. They update in the background, can escape the sandbox, send device data home...

gruez 5y ago
>You just have no idea at all what's in it, there's not even a simple list available of what's in it... What can you meaningfully do with this information? >Here's a reminder that there's not a single android phone on the planet which runs AOSP. Again, for the people who don't care about running a full FOSS stack, why does it matter? >a thirdparty ROM will always be better since they can be reviewed You mean how on lineageos, most devices have a grand total of two maintainers? >That's a very low bar indeed but preinstalled ROMs have such low standards, that makes it better. motorola and google puts out mostly vanilla android on their phones. >>>The most common security threat aren't coming from the trusted boot but play services blobs & manufacturer blobs >> source? >Which source? You're being obtuse here. "source?" in this context obviously refers to me asking you for evidence for your claim you made.
- realusername 5y ago
  > What can you meaningfully do with this information? Check the security of my device and my data? It would help build a trust with my device. Until that happens, phones are at best toys and not real computers you can trust. > Again, for the people who don't care about running a full FOSS stack, why does it matter? It's not about FOSS but basic freedom & security here. > You mean how on lineageos, most devices have a grand total of two maintainers? As opposed to preinstalled roms which have exactly zero external people reviewing them. Yes, the standards are THAT low. > motorola and google puts out mostly vanilla android on their phones. No they don't. Some people are trying to replicate the ROMs for other phones (like https://download.pixelexperience.org/ https://download.pixelexperience.org/ ) but that's some community effort. There's nothing vanilla about motorola or google phones. > You're being obtuse here. "source?" in this context obviously refers to me asking you for evidence for your claim you made. Why though? Even Android admits it, just go into Settings > Security and Settings > Account and look the amount of stuff that they say runs in the background. That's only what they want to admit though, who really knows what it's doing.
  - gruez 5y ago
    >Check the security of my device and my data? A phone operating system probably uses hundreds of libraries/codebases. Are you seriously keeping tabs on all of them? >It's not about FOSS but basic freedom & security here. Sounds like you're more objecting to the "FOSS" label than the general attitude of "the entire software/hardware stack has to be open source". >As opposed to preinstalled roms which have exactly zero external people reviewing them. Yes, the standards are THAT low. exactly zero? https://twitter.com/topjohnwu/status/1234547148785475585?lang=en https://twitter.com/topjohnwu/status/1234547148785475585?lan... >No they don't. Some people are trying to replicate the ROMs for other phones (like https://download.pixelexperience.org/ https://download.pixelexperience.org/ ) but that's some community effort. There's nothing vanilla about motorola or google phones. 1. I said "mostly" vanilla 2. what's your definition of vanilla? If google makes android, then arguably whatever they puts out can be considered vanilla, even if it isn't part of AOSP. Of all the chromium based browsers out there, I'd still consider google chrome "mostly vanilla", even if it does has proprietary bits that aren't part of the chromium project. >Why though? Because you're making the claim. >Even Android admits it, just go into Settings > Security and Settings > Account and look the amount of stuff that they say runs in the background. "There's a lot of stuff running" =/= "The most common security threat aren't coming from the trusted boot but play services blobs & manufacturer blobs"
    - realusername 5y ago
      > A phone operating system probably uses hundreds of libraries/codebases. Are you seriously keeping tabs on all of them? No but I have a right to inspect & modify whatever is running on my device and check it's behavior / replace it if I want to. > Sounds like you're more objecting to the "FOSS" label than the general attitude of "the entire software/hardware stack has to be open source". I have no problem with apps being closed source providing that they can use open formats. For operating systems / drivers though, it's kind of essential to have access to the source for security reasons & long term support of devices. Additionally, openness is even more important to me than open-source and I would still be okay with a closed-source system but very open in mentality, Android currently lacks both. > exactly zero? https://twitter.com/topjohnwu/status/1234547148785475585?lan https://twitter.com/topjohnwu/status/1234547148785475585?lan... This guy is from Google and reviewing Android software, that's not an external review and that's not even a rom review itself but a security bug... > 2. what's your definition of vanilla? If google makes android, then arguably whatever they puts out can be considered vanilla, even if it isn't part of AOSP. Of all the chromium based browsers out there, I'd still consider google chrome "mostly vanilla", even if it does has proprietary bits that aren't part of the chromium project. Vanilla for me is flashing AOSP straight into the device and booting it. This represents zero device on earth right now. > "There's a lot of stuff running" =/= "The most common security threat aren't coming from the trusted boot but play services blobs & manufacturer blobs" Just ask your average user if he knows that all his behaviour & data is recorded and sent to Google on a standard ROM by default and see their reaction.
- infamia 5y ago
  > You mean how on lineageos, most devices have a grand total of two maintainers? So you're saying that there are hundreds of LineageOS maintainers who overlap each other and test a lot of the same things, but have a relatively few number of things only they're responsible for. Additionally, many of the third-party open source libraries have ecosystems of their own that are looking after their libraries source code. That sounds pretty good to me, especially when you consider the transparency that Linux provides.

gruez 5y ago

>You just have no idea at all what's in it, there's not even a simple list available of what's in it... What can you meaningfully do with this information? >Here's a reminder that there's not a single android phone on the planet which runs AOSP. Again, for the people who don't care about running a full FOSS stack, why does it matter? >a thirdparty ROM will always be better since they can be reviewed You mean how on lineageos, most devices have a grand total of two maintainers? >That's a very low bar indeed but preinstalled ROMs have such low standards, that makes it better. motorola and google puts out mostly vanilla android on their phones. >>>The most common security threat aren't coming from the trusted boot but play services blobs & manufacturer blobs >> source? >Which source? You're being obtuse here. "source?" in this context obviously refers to me asking you for evidence for your claim you made.

realusername 5y ago
> What can you meaningfully do with this information? Check the security of my device and my data? It would help build a trust with my device. Until that happens, phones are at best toys and not real computers you can trust. > Again, for the people who don't care about running a full FOSS stack, why does it matter? It's not about FOSS but basic freedom & security here. > You mean how on lineageos, most devices have a grand total of two maintainers? As opposed to preinstalled roms which have exactly zero external people reviewing them. Yes, the standards are THAT low. > motorola and google puts out mostly vanilla android on their phones. No they don't. Some people are trying to replicate the ROMs for other phones (like https://download.pixelexperience.org/ https://download.pixelexperience.org/ ) but that's some community effort. There's nothing vanilla about motorola or google phones. > You're being obtuse here. "source?" in this context obviously refers to me asking you for evidence for your claim you made. Why though? Even Android admits it, just go into Settings > Security and Settings > Account and look the amount of stuff that they say runs in the background. That's only what they want to admit though, who really knows what it's doing.
- gruez 5y ago
  >Check the security of my device and my data? A phone operating system probably uses hundreds of libraries/codebases. Are you seriously keeping tabs on all of them? >It's not about FOSS but basic freedom & security here. Sounds like you're more objecting to the "FOSS" label than the general attitude of "the entire software/hardware stack has to be open source". >As opposed to preinstalled roms which have exactly zero external people reviewing them. Yes, the standards are THAT low. exactly zero? https://twitter.com/topjohnwu/status/1234547148785475585?lang=en https://twitter.com/topjohnwu/status/1234547148785475585?lan... >No they don't. Some people are trying to replicate the ROMs for other phones (like https://download.pixelexperience.org/ https://download.pixelexperience.org/ ) but that's some community effort. There's nothing vanilla about motorola or google phones. 1. I said "mostly" vanilla 2. what's your definition of vanilla? If google makes android, then arguably whatever they puts out can be considered vanilla, even if it isn't part of AOSP. Of all the chromium based browsers out there, I'd still consider google chrome "mostly vanilla", even if it does has proprietary bits that aren't part of the chromium project. >Why though? Because you're making the claim. >Even Android admits it, just go into Settings > Security and Settings > Account and look the amount of stuff that they say runs in the background. "There's a lot of stuff running" =/= "The most common security threat aren't coming from the trusted boot but play services blobs & manufacturer blobs"
  - realusername 5y ago
    > A phone operating system probably uses hundreds of libraries/codebases. Are you seriously keeping tabs on all of them? No but I have a right to inspect & modify whatever is running on my device and check it's behavior / replace it if I want to. > Sounds like you're more objecting to the "FOSS" label than the general attitude of "the entire software/hardware stack has to be open source". I have no problem with apps being closed source providing that they can use open formats. For operating systems / drivers though, it's kind of essential to have access to the source for security reasons & long term support of devices. Additionally, openness is even more important to me than open-source and I would still be okay with a closed-source system but very open in mentality, Android currently lacks both. > exactly zero? https://twitter.com/topjohnwu/status/1234547148785475585?lan https://twitter.com/topjohnwu/status/1234547148785475585?lan... This guy is from Google and reviewing Android software, that's not an external review and that's not even a rom review itself but a security bug... > 2. what's your definition of vanilla? If google makes android, then arguably whatever they puts out can be considered vanilla, even if it isn't part of AOSP. Of all the chromium based browsers out there, I'd still consider google chrome "mostly vanilla", even if it does has proprietary bits that aren't part of the chromium project. Vanilla for me is flashing AOSP straight into the device and booting it. This represents zero device on earth right now. > "There's a lot of stuff running" =/= "The most common security threat aren't coming from the trusted boot but play services blobs & manufacturer blobs" Just ask your average user if he knows that all his behaviour & data is recorded and sent to Google on a standard ROM by default and see their reaction.
infamia 5y ago
> You mean how on lineageos, most devices have a grand total of two maintainers? So you're saying that there are hundreds of LineageOS maintainers who overlap each other and test a lot of the same things, but have a relatively few number of things only they're responsible for. Additionally, many of the third-party open source libraries have ecosystems of their own that are looking after their libraries source code. That sounds pretty good to me, especially when you consider the transparency that Linux provides.