5 ms·

Despite reading the article, I don't understand how the security exploits would get on your phone. This isnt some iMessage that is pre-installed that is full o

Despite reading the article, I don't understand how the security exploits would get on your phone. This isnt some iMessage that is pre-installed that is full of 0 click exploits. This is FOSS that has been tried and tested for a few decades. Sure there might be some cases where someone didn't update software for an exploit, but you'd still need to have that specific software, and I imagine that you'd need to chain a few to make it useful. I can't see how a Linux phone is more dangerous than an iPhone. (aside from social engineering scams)

jonfw 3y ago
Are we expecting people to run tried and true FOSS on their phones? I would have expected users to be running software specific to mobile devices, which is very niche and much less tried than it’s closed source competition. You can’t text or make phone calls from VIM
- Bu9818 3y ago
  That's definitely the appeal for many of its users, being able to escape the locked down and restrictive environment of Android/iOS and having the functionality of a general purpose desktop Linux device in your pocket. And you can definitely text with VIM, by using scripts like https://man.sr.ht/~anjan/sxmo-docs/ https://man.sr.ht/~anjan/sxmo-docs/ or something custom ;)
  - ewzimm 3y ago
    This sounds very appealing, but since the earliest days of Android, we've been able to set up a chroot environment and install any distro and Linux app we want. Apps like UserLAnd make this trivial. I can't think of anything I'd want to do on a phone that I couldn't do with Termux. I can see the appeal of having a fully libre phone, but since that isn't possible, it's hard for most people to justify going full Linux.
    - Bu9818 3y ago
      If you want to be able to run most command-line programs (and probably GUI apps through VNC) in an isolated environment (similar to WSL or Chrome OS), then it will suffice, but there are some that appreciate having the desktop Linux environment and functionality across the whole of the device (like what sxmo is doing). Definitely a niche within a niche (desktop Linux users), I currently just avoid using a phone aside from the most basic tasks like using it as a phone to call/text or where it's required like banking.
  - jonfw 3y ago
    I wouldn't call that tried and true by any means
- hospitalJail 3y ago
  >Are we expecting people to run tried and true FOSS on their phones? Arent they running tried and true FOSS when they use chrome? Android? I think I'm not understanding your point.
Bu9818 3y ago
I agree there is less bloat like iMessage and less installing random crap apps. The biggest holes if an attacker is determined are probably the browser and images/video, and maybe common networking libraries or networked games which often have poor security. Once the image/video decoder is exploited and you get RCE (if in the browser you'd have to escape the browser sandbox too), there are less exploit mitigations on desktop Linux and maybe less chaining you'd need to do. And the lack of/worse verified boot than Android/iOS if that's something you need to worry about.
akyuu 3y ago
There is plenty of software written in memory-unsafe languages that interacts with untrusted input: browsers are the most prominent example, but also email clients, media players, PDF viewers, archivers, IRC clients, torrent clients... not to mention all the network stack and firmware involved. iPhones and Pixels have many defense layers, both on software (sandboxing, JITCage...) and hardware (Secure Boot backed by root of trust, IOMMU for hardware isolation, PAC, PPL, MTE soon on Armv9...). The Linux desktop stack, including Linux phones, has none of this. Linux phones might be good as a hackable/tinkering-friendly gadget, but they are definitely not secure.
- hospitalJail 3y ago
  I suppose we can give credit to Pixels, but iPhones and their 0 clicks are so prevalent that I don't think they are a good comparison for 'good' security in this conversation. Everything you mentioned is still optional, where as iMessage is not. I'm not sure of ANY linux 0 clicks found in the wild.
  - aftbit 3y ago
    >I'm not sure of ANY linux 0 clicks found in the wild. Some sizable fraction of that is because there is not as big of an audience, so there's less money and attention on developing exploits targeting that OS.
    - hospitalJail 3y ago
      I half believe this because we see that Apple was never actually good at security, but they could claim they had few 'viruses' back in the day because few people used this. But also FOSS doesn't rely on security by obscurity. We'd see way way more linux based server hacking. Right now, it seems like these are almost exclusively social engineering attacks.

jonfw 3y ago

Are we expecting people to run tried and true FOSS on their phones? I would have expected users to be running software specific to mobile devices, which is very niche and much less tried than it’s closed source competition. You can’t text or make phone calls from VIM

Bu9818 3y ago
That's definitely the appeal for many of its users, being able to escape the locked down and restrictive environment of Android/iOS and having the functionality of a general purpose desktop Linux device in your pocket. And you can definitely text with VIM, by using scripts like https://man.sr.ht/~anjan/sxmo-docs/ https://man.sr.ht/~anjan/sxmo-docs/ or something custom ;)
- ewzimm 3y ago
  This sounds very appealing, but since the earliest days of Android, we've been able to set up a chroot environment and install any distro and Linux app we want. Apps like UserLAnd make this trivial. I can't think of anything I'd want to do on a phone that I couldn't do with Termux. I can see the appeal of having a fully libre phone, but since that isn't possible, it's hard for most people to justify going full Linux.
  - Bu9818 3y ago
    If you want to be able to run most command-line programs (and probably GUI apps through VNC) in an isolated environment (similar to WSL or Chrome OS), then it will suffice, but there are some that appreciate having the desktop Linux environment and functionality across the whole of the device (like what sxmo is doing). Definitely a niche within a niche (desktop Linux users), I currently just avoid using a phone aside from the most basic tasks like using it as a phone to call/text or where it's required like banking.
- jonfw 3y ago
  I wouldn't call that tried and true by any means
hospitalJail 3y ago
>Are we expecting people to run tried and true FOSS on their phones? Arent they running tried and true FOSS when they use chrome? Android? I think I'm not understanding your point.

Bu9818 3y ago

I agree there is less bloat like iMessage and less installing random crap apps. The biggest holes if an attacker is determined are probably the browser and images/video, and maybe common networking libraries or networked games which often have poor security. Once the image/video decoder is exploited and you get RCE (if in the browser you'd have to escape the browser sandbox too), there are less exploit mitigations on desktop Linux and maybe less chaining you'd need to do. And the lack of/worse verified boot than Android/iOS if that's something you need to worry about.

akyuu 3y ago

There is plenty of software written in memory-unsafe languages that interacts with untrusted input: browsers are the most prominent example, but also email clients, media players, PDF viewers, archivers, IRC clients, torrent clients... not to mention all the network stack and firmware involved. iPhones and Pixels have many defense layers, both on software (sandboxing, JITCage...) and hardware (Secure Boot backed by root of trust, IOMMU for hardware isolation, PAC, PPL, MTE soon on Armv9...). The Linux desktop stack, including Linux phones, has none of this. Linux phones might be good as a hackable/tinkering-friendly gadget, but they are definitely not secure.

hospitalJail 3y ago
I suppose we can give credit to Pixels, but iPhones and their 0 clicks are so prevalent that I don't think they are a good comparison for 'good' security in this conversation. Everything you mentioned is still optional, where as iMessage is not. I'm not sure of ANY linux 0 clicks found in the wild.
- aftbit 3y ago
  >I'm not sure of ANY linux 0 clicks found in the wild. Some sizable fraction of that is because there is not as big of an audience, so there's less money and attention on developing exploits targeting that OS.
  - hospitalJail 3y ago
    I half believe this because we see that Apple was never actually good at security, but they could claim they had few 'viruses' back in the day because few people used this. But also FOSS doesn't rely on security by obscurity. We'd see way way more linux based server hacking. Right now, it seems like these are almost exclusively social engineering attacks.