> A phone operating system probably uses hundreds of libraries/codebases. Are you seriously keeping tabs on all of them? No but I have a right to inspect & mod

> A phone operating system probably uses hundreds of libraries/codebases. Are you seriously keeping tabs on all of them? No but I have a right to inspect & modify whatever is running on my device and check it's behavior / replace it if I want to. > Sounds like you're more objecting to the "FOSS" label than the general attitude of "the entire software/hardware stack has to be open source". I have no problem with apps being closed source providing that they can use open formats. For operating systems / drivers though, it's kind of essential to have access to the source for security reasons & long term support of devices. Additionally, openness is even more important to me than open-source and I would still be okay with a closed-source system but very open in mentality, Android currently lacks both. > exactly zero? https://twitter.com/topjohnwu/status/1234547148785475585?lan https://twitter.com/topjohnwu/status/1234547148785475585?lan... This guy is from Google and reviewing Android software, that's not an external review and that's not even a rom review itself but a security bug... > 2. what's your definition of vanilla? If google makes android, then arguably whatever they puts out can be considered vanilla, even if it isn't part of AOSP. Of all the chromium based browsers out there, I'd still consider google chrome "mostly vanilla", even if it does has proprietary bits that aren't part of the chromium project. Vanilla for me is flashing AOSP straight into the device and booting it. This represents zero device on earth right now. > "There's a lot of stuff running" =/= "The most common security threat aren't coming from the trusted boot but play services blobs & manufacturer blobs" Just ask your average user if he knows that all his behaviour & data is recorded and sent to Google on a standard ROM by default and see their reaction.