5 ms·

One approach, not ideal by a long shot but one of the easiest, is to only use old devices and old OSes. Things that have been cracked and/or are easy to root.

by bambax 1y ago

One approach, not ideal by a long shot but one of the easiest, is to only use old devices and old OSes. Things that have been cracked and/or are easy to root. "But it's not secure!" -- yeah, that really is the point.

matheusmoreira 1y ago
Utterly pointless. We'll be systematically discriminated against at every turn. We'll lose access to finances, services, communities and even simple sites because our computers aren't corporate owned. We'll become so marginalized we'll only be able to visit places like HN, places that at least try to pay some lip service to everything the word "hacker" stands for. And then they will make it so our devices need to pass hardware remote attestation to connect to the internet and even that will be taken away from us. I don't know what to do anymore. The future is bleak. The free computing we love is being destroyed by forces outside our control, forces that cannot be stopped no matter what we do because they have trillions of dollars and their interests are aligned with those of governments the world over.
- bambax 1y ago
  They may try that, sure, but 1/ it will take some time, during which we can still enjoy some amount of freedom and 2/ they may not succeed everywhere, or all of the time.
- CalRobert 1y ago
  Get in to woodworking and ham radio I guess
ddalex 1y ago
This is not going to be successful once they demand strong authentication of clients on the server side - the banking apps already do this, you can't have your phone rooted or compromised. Wait until the authorities will require strong client side authentication for social media sites, news sites, and everywhere user generated content is accepted, tied to official ID issued by the government
- Al-Khwarizmi 1y ago
  To be honest I don't see an easy path to escaping the walled garden in our interactions with big companies and governments (banking, traveling, mainstream social networks, etc.). But at least we can build alternatives for interpersonal communication and other uses independent from big companies, like the late 90s-early 2000s Internet, and access that with free devices.
  - CalRobert 1y ago
    Chat control will make this illegal.
    - anthk 1y ago
      If you want the whole commerce in the EU collapse and the CEO's wanting to really hurt and then kill Ursula von del Leyen and the associated lobbies, yeah sure. Let them suicide.
      - CalRobert 1y ago
        CEOs don't seem too bothered about security or the ability to use custom ROMs
  - marcosdumay 1y ago
    > But at least we can build alternatives for interpersonal communication and other uses independent from big companies We mostly can't. The most we can do is grow new big companies. The internet was carefully reorganized so that it's impossible to do anything without money moving around.
- spaqin 1y ago
  Maybe that would be a good thing. Don't get hooked on social media or news that survive on outrage and echochamers, just... enjoy life.
andrepd 1y ago
This is not enough. Things like banking apps are virtually necessary for many people's daily lives, yet they often require a non-rooted phone with Google Play Services spyware installed at the OS level, or they will simply refuse to open. Never mind the fact that we're so into late capitalist consumerism that it's routine to deprecate support for 2 year old OSes. This needs law/regulation forcing the duopoly to open up, unfortunately even in the EU we're moving in the opposite direction.
- mdp2021 1y ago
  > routine to deprecate support for 2 year old OSes > unfortunately even in the EU ("Save the planet".)
- BrenBarn 1y ago
  Not just forcing the app store duopoly to open up, forcing banks to open up and prohibiting these kinds of restrictions that are based on "we insist that you trust some large corporation that we also trust".
  - vrighter 1y ago
    Exactly. I'm literally penalized because I have control of my own device (which somehow isn't an issue with the much more "insecure", root-wise, browser on a linux desktop)
    - baq 1y ago
      > which somehow isn't an issue now. In general it certainly is; web interfaces will be phased out unless web browsers gain client attestation capabilities (at which point it's game over for the open web). E.g. Revolut never had a web interface and is doing just fine.
      - vrighter 1y ago
        Revolut does have a web interface, with some limited functionality. It's still useless to me because I need the phone to authorize it the first time.
gorbachev 1y ago
I've been largely doing this for other reasons. It is not a good long term solution, however, because older phones do not support newer versions of the operating systems and gradually you'll notice that fewer and fewer applications work on your phone, because they require a newer operating system.
dspillett 1y ago
> only use old devices and old OSes. Things that have been cracked and/or are easy to root. > "But it's not secure!" -- yeah, that really is the point. Well, no. The point isn't just to rail against impositions from someone else wanting what they see as essential for their security, but also to keep things secure and⁰ free¹ for you, the user. Holding your devices back constrains both your security and your freedom rather than helping you in either manner. Security because you will be missing important updates in that regard, and freedom because your device won't be able to negotiate connections with external services² that you want to use³. ---- [0] And where these two conflict, you should be free to chose your threat model and therefore which compromises to make, except where that could negatively affect others. [1] The freedom of reasonable action form of free, not monetarily free etc. [2] We hit this a short while ago with some legacy code+infra using SOCKS via OpenSSH to make unauthenticated HTTPS calls from source addresses we can't fix (authentication is done with SSH, control is by the other end having the fixed address of the SOCKS host in the whitelist) - upgrading the VM running the SOCKS proxy upgraded OpenSSH which deprecated a number of encryption and negotiation options, the old client library used didn't support enough new ones to be able to negotiate a link, newer versions required a later .Net version that is supported inside SSIS, so we had to rearrange how those calls were made (obviously the long term fix is to kill all that legacy SSIS stuff, all SSIS stuff including the people that made it, with fire). The same will happen with parts of what you use your device for, if you keep it back in the way you are suggesting. [3] Banking facilities being a key area that you'll likely hit problems with first, after that other online commerce flows, and so forth.
Wowfunhappy 1y ago
I've been using an old OS as my daily driver for five years now[1]. You absolutely can do it, but it's a lot of work! 1: https://mavericksforever.com/ https://mavericksforever.com/
mkup 1y ago
I maintain a software to aid in installation of Windows 7 to new PCs (FlashBoot Pro): https://www.prime-expert.com/flashboot/ https://www.prime-expert.com/flashboot/ . Recently there was a reduction in sales. You are welcome.

by bambax 1y ago

matheusmoreira 1y ago

Utterly pointless. We'll be systematically discriminated against at every turn. We'll lose access to finances, services, communities and even simple sites because our computers aren't corporate owned. We'll become so marginalized we'll only be able to visit places like HN, places that at least try to pay some lip service to everything the word "hacker" stands for. And then they will make it so our devices need to pass hardware remote attestation to connect to the internet and even that will be taken away from us. I don't know what to do anymore. The future is bleak. The free computing we love is being destroyed by forces outside our control, forces that cannot be stopped no matter what we do because they have trillions of dollars and their interests are aligned with those of governments the world over.

bambax 1y ago
They may try that, sure, but 1/ it will take some time, during which we can still enjoy some amount of freedom and 2/ they may not succeed everywhere, or all of the time.
CalRobert 1y ago
Get in to woodworking and ham radio I guess

ddalex 1y ago

This is not going to be successful once they demand strong authentication of clients on the server side - the banking apps already do this, you can't have your phone rooted or compromised. Wait until the authorities will require strong client side authentication for social media sites, news sites, and everywhere user generated content is accepted, tied to official ID issued by the government

Al-Khwarizmi 1y ago
To be honest I don't see an easy path to escaping the walled garden in our interactions with big companies and governments (banking, traveling, mainstream social networks, etc.). But at least we can build alternatives for interpersonal communication and other uses independent from big companies, like the late 90s-early 2000s Internet, and access that with free devices.
- CalRobert 1y ago
  Chat control will make this illegal.
  - anthk 1y ago
    If you want the whole commerce in the EU collapse and the CEO's wanting to really hurt and then kill Ursula von del Leyen and the associated lobbies, yeah sure. Let them suicide.
    - CalRobert 1y ago
      CEOs don't seem too bothered about security or the ability to use custom ROMs
- marcosdumay 1y ago
  > But at least we can build alternatives for interpersonal communication and other uses independent from big companies We mostly can't. The most we can do is grow new big companies. The internet was carefully reorganized so that it's impossible to do anything without money moving around.
spaqin 1y ago
Maybe that would be a good thing. Don't get hooked on social media or news that survive on outrage and echochamers, just... enjoy life.

andrepd 1y ago

This is not enough. Things like banking apps are virtually necessary for many people's daily lives, yet they often require a non-rooted phone with Google Play Services spyware installed at the OS level, or they will simply refuse to open. Never mind the fact that we're so into late capitalist consumerism that it's routine to deprecate support for 2 year old OSes. This needs law/regulation forcing the duopoly to open up, unfortunately even in the EU we're moving in the opposite direction.

mdp2021 1y ago
> routine to deprecate support for 2 year old OSes > unfortunately even in the EU ("Save the planet".)
BrenBarn 1y ago
Not just forcing the app store duopoly to open up, forcing banks to open up and prohibiting these kinds of restrictions that are based on "we insist that you trust some large corporation that we also trust".
- vrighter 1y ago
  Exactly. I'm literally penalized because I have control of my own device (which somehow isn't an issue with the much more "insecure", root-wise, browser on a linux desktop)
  - baq 1y ago
    > which somehow isn't an issue now. In general it certainly is; web interfaces will be phased out unless web browsers gain client attestation capabilities (at which point it's game over for the open web). E.g. Revolut never had a web interface and is doing just fine.
    - vrighter 1y ago
      Revolut does have a web interface, with some limited functionality. It's still useless to me because I need the phone to authorize it the first time.

gorbachev 1y ago

I've been largely doing this for other reasons. It is not a good long term solution, however, because older phones do not support newer versions of the operating systems and gradually you'll notice that fewer and fewer applications work on your phone, because they require a newer operating system.

dspillett 1y ago

> only use old devices and old OSes. Things that have been cracked and/or are easy to root. > "But it's not secure!" -- yeah, that really is the point. Well, no. The point isn't just to rail against impositions from someone else wanting what they see as essential for their security, but also to keep things secure and⁰ free¹ for you, the user. Holding your devices back constrains both your security and your freedom rather than helping you in either manner. Security because you will be missing important updates in that regard, and freedom because your device won't be able to negotiate connections with external services² that you want to use³. ---- [0] And where these two conflict, you should be free to chose your threat model and therefore which compromises to make, except where that could negatively affect others. [1] The freedom of reasonable action form of free, not monetarily free etc. [2] We hit this a short while ago with some legacy code+infra using SOCKS via OpenSSH to make unauthenticated HTTPS calls from source addresses we can't fix (authentication is done with SSH, control is by the other end having the fixed address of the SOCKS host in the whitelist) - upgrading the VM running the SOCKS proxy upgraded OpenSSH which deprecated a number of encryption and negotiation options, the old client library used didn't support enough new ones to be able to negotiate a link, newer versions required a later .Net version that is supported inside SSIS, so we had to rearrange how those calls were made (obviously the long term fix is to kill all that legacy SSIS stuff, all SSIS stuff including the people that made it, with fire). The same will happen with parts of what you use your device for, if you keep it back in the way you are suggesting. [3] Banking facilities being a key area that you'll likely hit problems with first, after that other online commerce flows, and so forth.

Wowfunhappy 1y ago

I've been using an old OS as my daily driver for five years now[1]. You absolutely can do it, but it's a lot of work! 1: https://mavericksforever.com/ https://mavericksforever.com/

mkup 1y ago

I maintain a software to aid in installation of Windows 7 to new PCs (FlashBoot Pro): https://www.prime-expert.com/flashboot/ https://www.prime-expert.com/flashboot/ . Recently there was a reduction in sales. You are welcome.