3 ms·

> What can you meaningfully do with this information? Check the security of my device and my data? It would help build a trust with my device. Until that happe

> What can you meaningfully do with this information? Check the security of my device and my data? It would help build a trust with my device. Until that happens, phones are at best toys and not real computers you can trust. > Again, for the people who don't care about running a full FOSS stack, why does it matter? It's not about FOSS but basic freedom & security here. > You mean how on lineageos, most devices have a grand total of two maintainers? As opposed to preinstalled roms which have exactly zero external people reviewing them. Yes, the standards are THAT low. > motorola and google puts out mostly vanilla android on their phones. No they don't. Some people are trying to replicate the ROMs for other phones (like https://download.pixelexperience.org/ https://download.pixelexperience.org/ ) but that's some community effort. There's nothing vanilla about motorola or google phones. > You're being obtuse here. "source?" in this context obviously refers to me asking you for evidence for your claim you made. Why though? Even Android admits it, just go into Settings > Security and Settings > Account and look the amount of stuff that they say runs in the background. That's only what they want to admit though, who really knows what it's doing.

gruez 5y ago
>Check the security of my device and my data? A phone operating system probably uses hundreds of libraries/codebases. Are you seriously keeping tabs on all of them? >It's not about FOSS but basic freedom & security here. Sounds like you're more objecting to the "FOSS" label than the general attitude of "the entire software/hardware stack has to be open source". >As opposed to preinstalled roms which have exactly zero external people reviewing them. Yes, the standards are THAT low. exactly zero? https://twitter.com/topjohnwu/status/1234547148785475585?lang=en https://twitter.com/topjohnwu/status/1234547148785475585?lan... >No they don't. Some people are trying to replicate the ROMs for other phones (like https://download.pixelexperience.org/ https://download.pixelexperience.org/ ) but that's some community effort. There's nothing vanilla about motorola or google phones. 1. I said "mostly" vanilla 2. what's your definition of vanilla? If google makes android, then arguably whatever they puts out can be considered vanilla, even if it isn't part of AOSP. Of all the chromium based browsers out there, I'd still consider google chrome "mostly vanilla", even if it does has proprietary bits that aren't part of the chromium project. >Why though? Because you're making the claim. >Even Android admits it, just go into Settings > Security and Settings > Account and look the amount of stuff that they say runs in the background. "There's a lot of stuff running" =/= "The most common security threat aren't coming from the trusted boot but play services blobs & manufacturer blobs"
- realusername 5y ago
  > A phone operating system probably uses hundreds of libraries/codebases. Are you seriously keeping tabs on all of them? No but I have a right to inspect & modify whatever is running on my device and check it's behavior / replace it if I want to. > Sounds like you're more objecting to the "FOSS" label than the general attitude of "the entire software/hardware stack has to be open source". I have no problem with apps being closed source providing that they can use open formats. For operating systems / drivers though, it's kind of essential to have access to the source for security reasons & long term support of devices. Additionally, openness is even more important to me than open-source and I would still be okay with a closed-source system but very open in mentality, Android currently lacks both. > exactly zero? https://twitter.com/topjohnwu/status/1234547148785475585?lan https://twitter.com/topjohnwu/status/1234547148785475585?lan... This guy is from Google and reviewing Android software, that's not an external review and that's not even a rom review itself but a security bug... > 2. what's your definition of vanilla? If google makes android, then arguably whatever they puts out can be considered vanilla, even if it isn't part of AOSP. Of all the chromium based browsers out there, I'd still consider google chrome "mostly vanilla", even if it does has proprietary bits that aren't part of the chromium project. Vanilla for me is flashing AOSP straight into the device and booting it. This represents zero device on earth right now. > "There's a lot of stuff running" =/= "The most common security threat aren't coming from the trusted boot but play services blobs & manufacturer blobs" Just ask your average user if he knows that all his behaviour & data is recorded and sent to Google on a standard ROM by default and see their reaction.

gruez 5y ago

>Check the security of my device and my data? A phone operating system probably uses hundreds of libraries/codebases. Are you seriously keeping tabs on all of them? >It's not about FOSS but basic freedom & security here. Sounds like you're more objecting to the "FOSS" label than the general attitude of "the entire software/hardware stack has to be open source". >As opposed to preinstalled roms which have exactly zero external people reviewing them. Yes, the standards are THAT low. exactly zero? https://twitter.com/topjohnwu/status/1234547148785475585?lang=en https://twitter.com/topjohnwu/status/1234547148785475585?lan... >No they don't. Some people are trying to replicate the ROMs for other phones (like https://download.pixelexperience.org/ https://download.pixelexperience.org/ ) but that's some community effort. There's nothing vanilla about motorola or google phones. 1. I said "mostly" vanilla 2. what's your definition of vanilla? If google makes android, then arguably whatever they puts out can be considered vanilla, even if it isn't part of AOSP. Of all the chromium based browsers out there, I'd still consider google chrome "mostly vanilla", even if it does has proprietary bits that aren't part of the chromium project. >Why though? Because you're making the claim. >Even Android admits it, just go into Settings > Security and Settings > Account and look the amount of stuff that they say runs in the background. "There's a lot of stuff running" =/= "The most common security threat aren't coming from the trusted boot but play services blobs & manufacturer blobs"

realusername 5y ago
> A phone operating system probably uses hundreds of libraries/codebases. Are you seriously keeping tabs on all of them? No but I have a right to inspect & modify whatever is running on my device and check it's behavior / replace it if I want to. > Sounds like you're more objecting to the "FOSS" label than the general attitude of "the entire software/hardware stack has to be open source". I have no problem with apps being closed source providing that they can use open formats. For operating systems / drivers though, it's kind of essential to have access to the source for security reasons & long term support of devices. Additionally, openness is even more important to me than open-source and I would still be okay with a closed-source system but very open in mentality, Android currently lacks both. > exactly zero? https://twitter.com/topjohnwu/status/1234547148785475585?lan https://twitter.com/topjohnwu/status/1234547148785475585?lan... This guy is from Google and reviewing Android software, that's not an external review and that's not even a rom review itself but a security bug... > 2. what's your definition of vanilla? If google makes android, then arguably whatever they puts out can be considered vanilla, even if it isn't part of AOSP. Of all the chromium based browsers out there, I'd still consider google chrome "mostly vanilla", even if it does has proprietary bits that aren't part of the chromium project. Vanilla for me is flashing AOSP straight into the device and booting it. This represents zero device on earth right now. > "There's a lot of stuff running" =/= "The most common security threat aren't coming from the trusted boot but play services blobs & manufacturer blobs" Just ask your average user if he knows that all his behaviour & data is recorded and sent to Google on a standard ROM by default and see their reaction.