8 ms·

It's an interesting article (and thanks to the author for putting it out) but I wonder what their end goal is. Is it to have a 100% secure/private phone? I'm no

It's an interesting article (and thanks to the author for putting it out) but I wonder what their end goal is. Is it to have a 100% secure/private phone? I'm not sure if that's possible with the proprietary firmware (though the hardware kill switches are certainly a good idea). Most importantly, the questionable usability means that either the Librem team needs to work much more, or... this becomes a "smarter" alternative to a dumb brick without giving data to Big Tech. (Ignoring the fact that a sim card automatically makes you lose privacy to the government/telecos). When comparing against something like a Pixel running GrapheneOS, it's honestly a bit more puzzling to me. Granted, I'm definitely not the audience for this, but with G_OS you can do most things that a regular phone can do, without taking several minutes to install Firefox. As much as I love privacy (going as far as having a semi-random username), this phone is a bit puzzling. I hope someone can throw more light on this.

blihp 5y ago
The general idea behind any 'pure' Linux phone is to have a device that you can trust at least as much as a desktop running Linux. Security is definitely a key aspect for many. But it's also the flexibility of not being locked in to anything on the software side. Ideally, it also extends the useful life of the device as when vulnerabilities and bugs are found, they can be fixed rather than junking the device for lack of updates. It's still pretty early days re: 'full' Linux on mobile and so it doesn't look like much yet... it takes time. Desktop Linux didn't look like much in 1994 either. I'm not familiar with GrapheneOS but I assume it follows the usual model when repurposing Android devices of taking various closed source blobs (i.e. drivers etc) and rebuilding the open source bits around them? If so, this approach usually locks you into a Linux kernel version to remain compatible with the blobs which limits you on kernel features and fixes as well as who knows what exposure the blobs have to offer, which also will likely never get updates.
- user_7832 5y ago
  You've got valid points regarding the Linux usability aspect and kernel updates (I'm not exactly sure what Graphene does regarding kernels). But in such a context wouldn't it be more useful to say have a dumb phone and a separate laptop/tablet running Linux? I'm just playing the devil's advocate/trying to understand why someone would actually use it. And yes if desktop Linux gets big that'll certainly make this entire comment seem stupid (which would be pretty nice:)
  - blihp 5y ago
    For around the house/office, a two (or more) device solution is fine for many. But when you're truly mobile people generally want to minimize the number of devices they have to deal with. For most Linux users, including myself, we're not there yet but the day is getting closer. What is this 'if' of which you speak? I've been using Linux as my daily driver desktop for over a decade ;-) It's not likely to ever become a mainstream desktop, nor are these Linux phones, but there are a fair number of us who don't care if they do or not. We just want them for ourselves.
- strcat 5y ago
  GrapheneOS and AOSP are Linux-based and there are no closed source kernel modules. They aren't somehow not actual Linux due to not using systemd, glibc, binutils, GCC, pulseaudio/pipewire, polkit, NetworkManager, GNOME, etc. If that's what you mean, you should say so, because those userspace components are not Linux and not using those doesn't make it any less of a Linux distribution. Is Alpine not a real Linux distribution? Is it only a real Linux distribution if it looks like what you're familiar with? More developers are familiar with Android than the desktop Linux software stack. More work goes into it. Far more apps are written for it, and that includes a very active open source app ecosystem. Sticking to an LTS kernel branch for the lifetime of the device isn't due to anything closed source. GrapheneOS only supports devices with proper security support for all the firmware, drivers, etc. and again there are no closed source kernel drivers. We can support pretty much any mobile device with alternate OS support since any serious one will have AOSP support. Most devices have lackluster security and don't meet our requirements. We're working with a hardware vendor to get a non-Pixel phone actually meeting reasonable security requirements. Librem 5 has a bunch of components where they are not shipping updates. You have things very much backwards on that front. The Librem 5 does not come close to meeting the security requirements to run GrapheneOS. It has a bunch of poorly secured and insecurely configured legacy hardware often without proper updates available, components that are not properly isolated via IOMMU, no secure element or all the stuff that comes along with that (HSM keystore with a nice API used by apps, Weaver to make disk encryption work for users without a high entropy passphrase like 7 diceware words, insider attack resistance, working attestation not depending on hard-wiring hashes and a lot more) and many other things. The OS they use has a near total lack of any systemic overall privacy/security work or privacy/security model and only falls further and further behind. The most exciting feature for securing devices right now is hardware memory tagging support in ARMv9, but there are years and years of tons of important privacy/security work done in a systemic way across hardware/firmware/software which are missing there before worrying about stuff like that. Marketing something as private/secure and spreading tons of misinformation and outright lies about the mainstream options doesn't make it secure or more secure than those. It's actually pretty funny that they mislead people about the isolation of hardware components like the cellular baseband in other devices when the vast majority of mainstream phones (iPhone, Pixel, Qualcomm SoC devices, Exynos SoC devices) have it done quite well when they don't. Strange that they get away with these games of misrepresenting things, hiding the fact that they still have entirely proprietary hardware and near entirely proprietary firmware for the SoC and other hardware components, etc. Hiding proprietary stuff doesn't make it go away. Not updating it doesn't make it go away and simply ensures a highly insecure device.
- kaba0 5y ago
  Linux desktops are not secure in any meaning of the word. Running everything as the same user is a catastrophe, see the recent “package-manager wiping out $HOME issue”. This should simply not happen in the 21st century, and we really should not make ourselves believe that we are safe just because desktop linux is seldom targeted and that the community is giving and well-intentioned for the most part. It is no longer a small village where everyone knows everyone and we could leave the doors open.
  - fsflover 5y ago
    > Linux desktops are not secure in any meaning of the word. Yes, they are: https://puri.sm/security https://puri.sm/security and https://source.puri.sm/Librem5/community-wiki/-/wikis/Frequently-Asked-Questions#43-how-secure-is-the-librem-5-compared-to-an-android-phone https://source.puri.sm/Librem5/community-wiki/-/wikis/Freque....
    - kaba0 5y ago
      Strcat does a much better job than I could to refute it: https://news.ycombinator.com/item?id=30761693 https://news.ycombinator.com/item?id=30761693 But basically, it is not secure neither on a hardware front, neither on software. The latter runs everything as the same user so a rouge bash script can encrypt your whole photo gallery, exfiltrate any data, etc.
      - deleted 5y ago
        [deleted]
  - blihp 5y ago
    Sure, if you run (most of) them in their default configuration. However, they can trivially be made much more secure which is one of the appeals of Linux to some: you're not limited to whatever set of compromises a vendor decided was acceptable.
    - kaba0 5y ago
      Just because there is firejail, it won’t magically make it secure. It also has to be comfortable to use, for which you need communication between the app and the os handling permissions a la ios/android. Flatpak is going in that direction but I don’t necessarily like the approach of mixing packaging and sandboxing together.
vinceguidry 5y ago
Apart from the fact that it's custom hardware designed to run Linux, (you buy this for the same reason you buy System76 or Purism's other hardware, even though you could build your own machine or install Linux on hardware built for Windows) I would much rather have a phone built on Linux than a phone built on Android. Android really doesn't offer anything more on a fundamental level than Google-made ease-of-use layers and a development platform that I can really take or leave. I run Arch Linux on all my devices with no Desktop Environment. The simpler the system the better. Running Android Framework along with a runtime, even though it's all open source, I'd rather as much of it be free software as possible. If I could run my phone like this I absolutely would but the Librem 5 is as good as it gets while still having a device that fits in my pocket that can make calls and text.
monkeycantype 5y ago
Answering personally, I seem to be 'the swing voter' demographic for this phone - I have gone to their site many times, but have never paid them a dollar. I'm interested less because of what I could do with this phone - apple works great for me - but because I'm interested in how much the hardware can be open sourced, can a phone or laptop be built where only the low level components are sourced from existing manufacturers, without needing google or apple etc to curate the assembly. I like the idea of having what I have with apple, but not having apple or google or anyone own the ecosystem.
- user_7832 5y ago
  If you bought it (assuming you would if you were impressed enough by their work and had the funds), would you be willing to daily it? (Perhaps assuming some bugs got fixed by then, but realistically not all)
  - monkeycantype 5y ago
    I enjoy pretending that I would.
fsflover 5y ago
> (Ignoring the fact that a sim card automatically makes you lose privacy to the government/telecos). https://puri.sm/products/librem-awesim/ https://puri.sm/products/librem-awesim/
kaba0 5y ago
We really should not consider linux phones (and desktops!) secure. It’s only secure by obscurity and by not being a valuable target at all — they have no sane sandboxing, hardware kill switches are pretty much useless in that if you can’t trust the OS you are already lost, etc. GrapheneOS is a secure option as well as ios. But security doesn’t come for free and not a binary thing.

blihp 5y ago

The general idea behind any 'pure' Linux phone is to have a device that you can trust at least as much as a desktop running Linux. Security is definitely a key aspect for many. But it's also the flexibility of not being locked in to anything on the software side. Ideally, it also extends the useful life of the device as when vulnerabilities and bugs are found, they can be fixed rather than junking the device for lack of updates. It's still pretty early days re: 'full' Linux on mobile and so it doesn't look like much yet... it takes time. Desktop Linux didn't look like much in 1994 either. I'm not familiar with GrapheneOS but I assume it follows the usual model when repurposing Android devices of taking various closed source blobs (i.e. drivers etc) and rebuilding the open source bits around them? If so, this approach usually locks you into a Linux kernel version to remain compatible with the blobs which limits you on kernel features and fixes as well as who knows what exposure the blobs have to offer, which also will likely never get updates.

user_7832 5y ago
You've got valid points regarding the Linux usability aspect and kernel updates (I'm not exactly sure what Graphene does regarding kernels). But in such a context wouldn't it be more useful to say have a dumb phone and a separate laptop/tablet running Linux? I'm just playing the devil's advocate/trying to understand why someone would actually use it. And yes if desktop Linux gets big that'll certainly make this entire comment seem stupid (which would be pretty nice:)
- blihp 5y ago
  For around the house/office, a two (or more) device solution is fine for many. But when you're truly mobile people generally want to minimize the number of devices they have to deal with. For most Linux users, including myself, we're not there yet but the day is getting closer. What is this 'if' of which you speak? I've been using Linux as my daily driver desktop for over a decade ;-) It's not likely to ever become a mainstream desktop, nor are these Linux phones, but there are a fair number of us who don't care if they do or not. We just want them for ourselves.
strcat 5y ago
GrapheneOS and AOSP are Linux-based and there are no closed source kernel modules. They aren't somehow not actual Linux due to not using systemd, glibc, binutils, GCC, pulseaudio/pipewire, polkit, NetworkManager, GNOME, etc. If that's what you mean, you should say so, because those userspace components are not Linux and not using those doesn't make it any less of a Linux distribution. Is Alpine not a real Linux distribution? Is it only a real Linux distribution if it looks like what you're familiar with? More developers are familiar with Android than the desktop Linux software stack. More work goes into it. Far more apps are written for it, and that includes a very active open source app ecosystem. Sticking to an LTS kernel branch for the lifetime of the device isn't due to anything closed source. GrapheneOS only supports devices with proper security support for all the firmware, drivers, etc. and again there are no closed source kernel drivers. We can support pretty much any mobile device with alternate OS support since any serious one will have AOSP support. Most devices have lackluster security and don't meet our requirements. We're working with a hardware vendor to get a non-Pixel phone actually meeting reasonable security requirements. Librem 5 has a bunch of components where they are not shipping updates. You have things very much backwards on that front. The Librem 5 does not come close to meeting the security requirements to run GrapheneOS. It has a bunch of poorly secured and insecurely configured legacy hardware often without proper updates available, components that are not properly isolated via IOMMU, no secure element or all the stuff that comes along with that (HSM keystore with a nice API used by apps, Weaver to make disk encryption work for users without a high entropy passphrase like 7 diceware words, insider attack resistance, working attestation not depending on hard-wiring hashes and a lot more) and many other things. The OS they use has a near total lack of any systemic overall privacy/security work or privacy/security model and only falls further and further behind. The most exciting feature for securing devices right now is hardware memory tagging support in ARMv9, but there are years and years of tons of important privacy/security work done in a systemic way across hardware/firmware/software which are missing there before worrying about stuff like that. Marketing something as private/secure and spreading tons of misinformation and outright lies about the mainstream options doesn't make it secure or more secure than those. It's actually pretty funny that they mislead people about the isolation of hardware components like the cellular baseband in other devices when the vast majority of mainstream phones (iPhone, Pixel, Qualcomm SoC devices, Exynos SoC devices) have it done quite well when they don't. Strange that they get away with these games of misrepresenting things, hiding the fact that they still have entirely proprietary hardware and near entirely proprietary firmware for the SoC and other hardware components, etc. Hiding proprietary stuff doesn't make it go away. Not updating it doesn't make it go away and simply ensures a highly insecure device.
kaba0 5y ago
Linux desktops are not secure in any meaning of the word. Running everything as the same user is a catastrophe, see the recent “package-manager wiping out $HOME issue”. This should simply not happen in the 21st century, and we really should not make ourselves believe that we are safe just because desktop linux is seldom targeted and that the community is giving and well-intentioned for the most part. It is no longer a small village where everyone knows everyone and we could leave the doors open.
- fsflover 5y ago
  > Linux desktops are not secure in any meaning of the word. Yes, they are: https://puri.sm/security https://puri.sm/security and https://source.puri.sm/Librem5/community-wiki/-/wikis/Frequently-Asked-Questions#43-how-secure-is-the-librem-5-compared-to-an-android-phone https://source.puri.sm/Librem5/community-wiki/-/wikis/Freque....
  - kaba0 5y ago
    Strcat does a much better job than I could to refute it: https://news.ycombinator.com/item?id=30761693 https://news.ycombinator.com/item?id=30761693 But basically, it is not secure neither on a hardware front, neither on software. The latter runs everything as the same user so a rouge bash script can encrypt your whole photo gallery, exfiltrate any data, etc.
    - deleted 5y ago
      [deleted]
- blihp 5y ago
  Sure, if you run (most of) them in their default configuration. However, they can trivially be made much more secure which is one of the appeals of Linux to some: you're not limited to whatever set of compromises a vendor decided was acceptable.
  - kaba0 5y ago
    Just because there is firejail, it won’t magically make it secure. It also has to be comfortable to use, for which you need communication between the app and the os handling permissions a la ios/android. Flatpak is going in that direction but I don’t necessarily like the approach of mixing packaging and sandboxing together.

vinceguidry 5y ago

Apart from the fact that it's custom hardware designed to run Linux, (you buy this for the same reason you buy System76 or Purism's other hardware, even though you could build your own machine or install Linux on hardware built for Windows) I would much rather have a phone built on Linux than a phone built on Android. Android really doesn't offer anything more on a fundamental level than Google-made ease-of-use layers and a development platform that I can really take or leave. I run Arch Linux on all my devices with no Desktop Environment. The simpler the system the better. Running Android Framework along with a runtime, even though it's all open source, I'd rather as much of it be free software as possible. If I could run my phone like this I absolutely would but the Librem 5 is as good as it gets while still having a device that fits in my pocket that can make calls and text.

monkeycantype 5y ago

Answering personally, I seem to be 'the swing voter' demographic for this phone - I have gone to their site many times, but have never paid them a dollar. I'm interested less because of what I could do with this phone - apple works great for me - but because I'm interested in how much the hardware can be open sourced, can a phone or laptop be built where only the low level components are sourced from existing manufacturers, without needing google or apple etc to curate the assembly. I like the idea of having what I have with apple, but not having apple or google or anyone own the ecosystem.

user_7832 5y ago
If you bought it (assuming you would if you were impressed enough by their work and had the funds), would you be willing to daily it? (Perhaps assuming some bugs got fixed by then, but realistically not all)
- monkeycantype 5y ago
  I enjoy pretending that I would.

fsflover 5y ago

> (Ignoring the fact that a sim card automatically makes you lose privacy to the government/telecos). https://puri.sm/products/librem-awesim/ https://puri.sm/products/librem-awesim/

kaba0 5y ago

We really should not consider linux phones (and desktops!) secure. It’s only secure by obscurity and by not being a valuable target at all — they have no sane sandboxing, hardware kill switches are pretty much useless in that if you can’t trust the OS you are already lost, etc. GrapheneOS is a secure option as well as ios. But security doesn’t come for free and not a binary thing.