3 ms·

>An example of why software freedom is important in basebands; the proprietary PinePhone baseband software contains a vulnerability (IIRC RCE) and the vendor ne

>An example of why software freedom is important in basebands; the proprietary PinePhone baseband software contains a vulnerability (IIRC RCE) and the vendor never fixed that issue, but the libre PinePhone baseband fixed that vulnerability. I agree that's a great part of open source -- you can write a patch. My concern is that without some kind of security person on the project, what happens is often people notice a flaw and hoard it... or they inform a tiny project, ride out whatever window the jerks at CERT or whatever set, then start going buck wild with it. On my end, my big concern was privacy. You can't obtain privacy until you have security -- until you lock down your projects. And every time a project gets good enough to trust someone seems to come and fuck it up[1]. The classic example being Ubuntu -- just as I was ready to possibly switch to them from OSX, they added privacy invading features that made me think it was better to stick with Apple and start using VMs for the important stuff. (If you or others have thoughts on distros, I'm leaning towards Debian but I worry that if I switch to that some asshole will come make that one shit the bed in the MOTD[2] like happened with Ubuntu -- I used to have one that popped up an ASCII dinosaur and said "This is a Unix system, I know this" -- but no one except me and the folks at the Apple Store should know that.) [1] https://en.wikipedia.org/wiki/Ubuntu#Conformity_with_European_data_privacy_law https://en.wikipedia.org/wiki/Ubuntu#Conformity_with_Europea... [2] https://en.wikipedia.org/wiki/Ubuntu#System_terminal_advertising_controversies https://en.wikipedia.org/wiki/Ubuntu#System_terminal_adverti...

pabs3 4y ago
There are tons of people hoarding flaws and exploits for ever piece of software imaginable (Apple included), often these people only work at the binary level and consequently having source code isn't that useful to them. The source code however is useful to users of and contributors to the projects, and to some types of security researchers that focus on open source. Using software means you will always be subject to security issues and privacy invasions, because programmers are human. Sticking with Apple just means you're still subject to privacy invasions and cannot fix them if you are allowed to find them, but going to Ubuntu means you can at least discover them or hear about them from other folks and patch them out. Debian definitely has myriad privacy issues (link below), mostly inherited from all the open source software out there. It also has a strong culture of fixing those issues, including basic things like locally installed documentation loading images or JavaScript from the web. More help fixing them is needed though. The only official telemetry we (I'm a member) have is popularity-contest, which is opt-in and that will never change. There is also the hw-probe tool, for optionally submitting to the external Linux Hardware database site. The hw-probe tool isn't well integrated into the Debian installer/etc but if it were, it would be optional. https://wiki.debian.org/PrivacyIssues https://wiki.debian.org/PrivacyIssues https://popcon.debian.org/ https://popcon.debian.org/ https://qa.debian.org/popcon.php https://qa.debian.org/popcon.php https://wiki.debian.org/Hardware/Database https://wiki.debian.org/Hardware/Database If you're really worried about this stuff, I strongly suggest you look at QubesOS, it uses Xen VMs for compartmentalisation, both for security and privacy. It splits up your digital life into one VM per area, with temporary VMs for dealing with unsafe documents and stuff. The split is up to you and you can run whatever you want inside each VM, including Debian. https://www.qubes-os.org/ https://www.qubes-os.org/

pabs3 4y ago

There are tons of people hoarding flaws and exploits for ever piece of software imaginable (Apple included), often these people only work at the binary level and consequently having source code isn't that useful to them. The source code however is useful to users of and contributors to the projects, and to some types of security researchers that focus on open source. Using software means you will always be subject to security issues and privacy invasions, because programmers are human. Sticking with Apple just means you're still subject to privacy invasions and cannot fix them if you are allowed to find them, but going to Ubuntu means you can at least discover them or hear about them from other folks and patch them out. Debian definitely has myriad privacy issues (link below), mostly inherited from all the open source software out there. It also has a strong culture of fixing those issues, including basic things like locally installed documentation loading images or JavaScript from the web. More help fixing them is needed though. The only official telemetry we (I'm a member) have is popularity-contest, which is opt-in and that will never change. There is also the hw-probe tool, for optionally submitting to the external Linux Hardware database site. The hw-probe tool isn't well integrated into the Debian installer/etc but if it were, it would be optional. https://wiki.debian.org/PrivacyIssues https://wiki.debian.org/PrivacyIssues https://popcon.debian.org/ https://popcon.debian.org/ https://qa.debian.org/popcon.php https://qa.debian.org/popcon.php https://wiki.debian.org/Hardware/Database https://wiki.debian.org/Hardware/Database If you're really worried about this stuff, I strongly suggest you look at QubesOS, it uses Xen VMs for compartmentalisation, both for security and privacy. It splits up your digital life into one VM per area, with temporary VMs for dealing with unsafe documents and stuff. The split is up to you and you can run whatever you want inside each VM, including Debian. https://www.qubes-os.org/ https://www.qubes-os.org/