5 ms·
In the past, we could have made a version of Signal without this spyware, to be installed as an APK (as I would expect the EU to force Google to ban the non-spy
by jcarrano 1y ago
In the past, we could have made a version of Signal without this spyware, to be installed as an APK (as I would expect the EU to force Google to ban the non-spying version from the app store). With the upcoming Android developer verification, this will no longer be a possibility.
- fifteen1506 1y agoSlow heating boils the frog. Move now to alternatives. If you must use Android, GrapheneOS with Sandboxed Play Services.
- asah 1y ago> If you must use Android the reasonable alternative being... ?
- fsflover 1y agoGNU/Linux phones.
- TeMPOraL 1y agoName three? Unfortunately, "reasonable" generally means "can do the things typically done with smartphones these days", which include things like banking, media streaming, and civic stuff - things mediated by the very systems whose vendors aren't just embracing remote attestation, but actually driving its proliferation. For better or worse[0], this is not a technical problem - it's a social/political one. Technology created it, by making remote attestation possible - but the actual problem is with why companies want to use it. -- [0] - Definitely worse. Technical problems are easy.
- incompatible 1y agoMaybe you need two phones then, one for the civic stuff and the other for private communication.
- tiku 1y agoPerhaps just websites for communication then, through tor or some other protocols.
- TeMPOraL 1y agoI don't care about this kind of private communication. I care about automating and debullshittifying my life, which includes stuff like banking and civics. I didn't learn to program computers so I could use it to shitpost more privately. I learned it so I can make machines deal with things for me the way I want them to.
- fsflover 1y ago> Name three? Openmoko, Pinephone, Librem 5
- concinds 1y agoAre there any that aren't laughably insecure? No? Oh well.
- fsflover 1y agoAccording to which threat model?
- fifteen1506 1y agoYou got me. None. I do wish ubports + waydroid would be a reasonable alternative -- but it's wishful thinking.
- bboygravity 1y agoMy only hope is Tesla bringing out a phone with it's own OS at some point.
- macNchz 1y agoTesla...certainly isn't top of mind when I think about makers of technology products that permit true ownership of the hardware / respect their users' privacy.
- tiku 1y agoAlso government will not allow it.
- soraminazuki 1y agoA phone made by a car manufacturer that abuses access to car cameras to spy on customers in their homes and share videos of them being naked? You can't even pay me to make me use such crap. https://www.reuters.com/technology/tesla-workers-shared-sensitive-images-recorded-by-customer-cars-2023-04-06/ https://www.reuters.com/technology/tesla-workers-shared-sens... https://www.independent.co.uk/news/world/americas/tesla-workers-video-naked-customer-b2315922.html https://www.independent.co.uk/news/world/americas/tesla-work...
- frm88 1y agoFor people looking for a new phone it could be either Jolla [0] or Fairphone 6 [1]. Both come with their own OS. [0] https://jolla-devices.com/sailfish_devices/ https://jolla-devices.com/sailfish_devices/ [1] https://shop.fairphone.com/de/the-fairphone-gen-6-e-operating-system https://shop.fairphone.com/de/the-fairphone-gen-6-e-operatin...
- zelphirkalt 1y agoIt already took a mountain of resisting the network effect to get at least some half of my friends to chat with me on Signal. The chances to get them to move to something more obscure, that has any additional friction is low and the effort in convincing them will be high. That's not to say I won't try, but man I hope it doesn't come to that.
- jofla_net 1y agoPretty neat how, out of the blue, two seemingly unrelated efforts manage to tighten together to create the perfect unavoidable storm. I swear those Thursday bilderberg meetings are a thing.
- varispeed 1y agoPeople have been talking about this for years. Corruption, authoritarianism and fascism is eating the EU from within and people who warned about it were called from tin foil hatters to just nutters.
- bboygravity 1y agoStill are being called that now. Any political party of any member state that even thinks about being critical of the EU will instantly be completely destroyed by "independent" national (state sponsored) media.
- Yeul 1y agoMate everyone in the Netherlands hates the EU. But after calculating it is still more profitable to be in it. We can see how Trump treated Switzerland.
- gambiting 1y agoWhat are you talking about. UK is the prime example of political parties being extremely critical of the EU and eventually getting exactly what they asked for. But even if you think UK is some kind of weird one-off example - it's not. Look at Poland - PiS has been openly critical of EU for years now and held power for years, will most likely win it again in the next elections. Konfederacja straight up calls EU facist on a daily basis and they have like 20% support for some insane reason. >>by "independent" national (state sponsored) media. You have to explain what you mean by this - you can't be independent and state sponsored. Or do you mean unbiasased(like what the BBC or TVP are meant to be, which they are obviously not but they are not "independent")
- cherryteastain 1y agoMolly (signal fork) on GrapheneOS will still be there
- whatshisface 1y agoSince the right people are here, can anyone explain to me why its so hard to "root" (in reality, obtain basic filesystem / networking etc. control) with that OS?
- zeech 1y agoGrapheneOS is focused on being as secure as possible. When you put root access into the equation, all the security protections are irrelevant if apps are able to bypass them at will. It's really not that hard to do, just antithetical to the purpose of the OS.
- tiku 1y agoWhy is it so hard to run virtual android on your Android as a sandbox for these kinds of things.
- userbinator 1y agoThere are plenty of devices running older versions of Android which are not under Big G's control and won't be subjected to this authoritarianism. Coincidentally they are also likely to be easily rootable, so you can still have full freedom. Just don't "upgrade" and ignore all the propaganda telling you bad things about that. Keep building apps that work on older, less-hostile devices and spread the word to oppose this very deliberate planned obsolescence.
- Hizonner 1y ago> Coincidentally they are also likely to be easily rootable, so you can still have full freedom. Also easily remotely ownable, so you can be spied on without even having to install any software at all. And any that aren't now will be a couple of years after they fall out of support. Which, by the way, is very hard for the community to step in and do, since they're full of undocumented proprietary binary blobs. > Just don't "upgrade" and ignore all the propaganda telling you bad things about that. ... and when your fully owned device finally breaks completely?
- userbinator 1y agoYou've fallen for the propaganda. "remotely ownable" is only true if you do things like visit sites with JS enabled by default, which is what has been the case with true PCs for a long time. There's a whole community keeping these devices alive, I trust them far more than Big G.
- chowells 1y agoThe... propaganda? PoC exploits demonstrating full device takeover by sending an image file are propaganda? What would a real security vulnerability that's not propaganda look like? https://nvd.nist.gov/vuln/detail/CVE-2023-4863 https://nvd.nist.gov/vuln/detail/CVE-2023-4863
- userbinator 1y agolibwebp, a Google-originated format... how convenient. via a crafted HTML page Don't forget that the majority if not all exploits will use something like JS to obfuscate their existence and frustrate analysis. Also remember the famous sayings "Those who give up freedom for security deserve neither" and "Live free or die". Accepting the insecurity, because freedom cannot exist without it, is also important.
- varenc 1y agoCouldn't someone just build that Signal APK without spyware and then get it signed/verified by Google? The Google change means that every APK has to be signed and linked to a developer with a verified identity. Unless Google might not be willing to approve this alternative version of Signal, but is there any indication of that? The Signal clients are open source with a permissive license so there's nothing unauthorized about building and distributing a modified version yourself.
- NewJazz 1y agoIs there any indication that Google will obey the laws of the EU when they have no vested interest in the outcome? They only break the law when it earns them bundles of money.
- munksbeer 1y ago>Is there any indication that Google will obey the laws of the EU when they have no vested interest in the outcome? In this context it isn't EU laws. The upcoming Android change in 2026 will stop anyone installing a non-verified app on their Android devices. This seems to be something Google arrived at "independently". But I would bet the US and EU and whoever else have put pressure on them.
- NewJazz 1y agoThe law would be "don't sign apps unless they follow these regulations". Google has put themselves in the position of being able to enforce these regs, but that doesn't mean they aren't law.
- raxxorraxor 1y agoThe EU says it wants to challenge Big Tech. What they mean is they want to blackmail them into giving them privileged access to information, control- and surveillance systems. Android as it is fails as an operating system and the same idiots ruining perfectly good software in other companies now work for Google. Not that iOS is in any way better, it has the exact same and even more deficiencies.
- rdm_blackhole 1y agoGoogle won't have to ban the non-spying version of Signal, Signal will simply cease to operate in the EU. That's what the Signal CEO said in an interview.
- akimbostrawman 1y ago>as I would expect the EU to force Google to ban the non-spying version from the app store If you expect hostile action by Google you should also expect the rootkit that is google play services to also do that. Which means in both cases the solution would be to use a actual open source mobile OS based on AOSP.