5 ms·
The URL has "GNU" in it, I knew better than to click. Respectfully, waaaahhh. From the article: I still think it's extremely weird that you actually buy a de
by iigs 18y ago
The URL has "GNU" in it, I knew better than to click.
Respectfully, waaaahhh.
From the article:
I still think it's extremely weird that you actually buy a device, and then don't own it. I would have no problem if the device is rented from the manufacturer or the mobile network operator. Sure, then in this rented device, only they control what kind of software you use. But this is not the case. People buy it, pay money, legally own the device but technically don't.
You absolutely do own the device. You're just not capable of getting the software you want onto it. I own my house, even though I have no idea how to move walls and put up new drywall (in my case, I did but it didn't work out as well as I'd hoped).
If you really can't live without the kernel of your choice, perhaps you should desolder the IC that contains the crypto keys and install one that has keys you created. Worst probable case is that you're out an integrated CPU/EPROM device. As mentioned by sayrer elsewhere in this thread, the route this guy would be better off taking is to get a Developer one.
I'm sure the GNU "I hold my nose at your lack of freedom" attitude provides many mutual high-fiving opportunities for The Free. Unfortunately the real world, particularly as it concerns security, is made up of endless compromises and trade-offs. Practically speaking, the decision to outsource security of the device to a group of people who are paid full time to do it makes the devices safer for the five orders of magnitude of people who are unable to or unwilling to understand the decisions they'd otherwise be asked to make.
Sorry to get lathered up about this, but statements of this nature sway uninformed geeks in dangerous ways. There's a ton of legitimate value to having a solid crypto foundation within devices, and one man's open certificate authority access to the device's firmware is ten million men's malware attack vector.
I agree with the guy in some aspects, in that I'd like to be able to control the boot loader and other fundamental aspects of a mobile device. At one time I had an idea to create a micro/mini-payment application that would live within your telephone. With the computing resources of even a free-with-contract phone you could greatly reduce the risks that credit cards are increasingly facing. This could prove a very lucrative business for someone who could out-efficient Visa. Unfortunately, as noted in the article, the keys to the device are held by the carrier, and this, for me, would be insufficient to trust my banking information with, so I never pursued the idea.
- kragen 18y agoI own my house, even though I have no idea how to move walls and put up new drywall (in my case, I did but it didn't work out as well as I'd hoped). You can hire someone else to put up new drywall. If you can't, you don't own the house; you're just renting. Outsourcing your security to a group of people makes you vulnerable to that group of people, and anybody who can lean on them. As you point out yourself, mobile phone carriers have not proven trustworthy in that way. The guy who buys the phone has the right to choose who they want to trust; mobile carriers blackmailing phone manufacturers into giving them backdoors into this most personal of devices is a violation of that right, and it imperils us all.