6 ms·

There aren't a lot of recent devices supported.

• rixrax 9mo ago
  Why is this?
  • sspiff 9mo ago
    Most modern manufacturers disallow unlocking the bootloader and flashing unsigned firmware, which is a requirement for this kind of thing.
    • c0l0 9mo ago
      LineageOS isn't unsigned, it just happens to be signed by keys that are not "trusted" (i.e., allowed - thanks for the correction!) by the phone's bootloaders.
      • dijit 9mo ago
        thats effectively the same thing. The whole point of the majority of PKI (including secureboot) is that some third party agrees that the signature is valid; without that even though its “technically signed” it may as well not be.
        • c0l0 9mo ago
          I disagree. If LineageOS builds were actually unsigned, I would have no way of verifying that release N was signed by the same private-key-bearing entity that signed release N-1, which I happen to have installed. It could be construed as the effective difference between a Trust On First Use (TOFU) vs. a Certificate Authority (CA) style ecosystem. I hope you can agree that TOFU is worth MUCH more than having no assurance about (continued) authorship at all.
          • dijit 9mo ago
            Yes, I understand the value of signatures, but thats not how PKI works.
            • RedComet 9mo ago
              If the owner of a device can't sign and install their own software, then your definition of PKI doesn't "work" at all. The first party must be able to entirely decide that "some third party" for it to be anything more than an obfuscation of digital serfdom.
              • dijit 9mo ago
                [flagged]
                • Aachen 9mo ago
                  > My definition of PKI is the one we’re using for TLS, some random array of “trusted” third parties can issue keys Maybe read the actual definition before assuming you're so much smarter than "HN". One doesn't need third parties to have pki, it's a concept, you can roll out your own
                  • dijit 9mo ago
                    “read the actual definition”;stellar contribution there, mate. I checked and sure enough its exactly in line with my comments. I’ve been discussing the practical implementation of PKI as it exists in the real world, specifically in the context of bootloader verification and TLS certificate validation. You know, the actual systems people use every day. But please, do enlighten me with whatever Wikipedia definition you’ve just skimmed that you think contradicts anything I’ve said. Because here’s the thing: whether you want to pedantically define PKI as “any infrastructure involving public keys” or specifically as “a hierarchical trust model with certificate authorities,” my point stands completely unchanged. In the context that spawned this entire thread, LineageOS and bootloader signature verification, there is a chain of trust, there are designated trusted authorities, and signatures outside that chain are rejected. That’s PKI. That’s how it works. That’s what I described. If your objection is that I should have been more precise about distinguishing between “Web PKI” and “PKI generally,” then congratulations on missing the forest for the trees whilst simultaneously contributing absolutely nothing of substance to the discussion. But sure, I’m the one who needs to read definitions. Perhaps you’d care to actually articulate which part of my explanation was functionally incorrect for the use case being discussed, rather than posting a single snarky sentence that says precisely nothing? EDIT: your edit is much more nuanced but still misses the point; https://imgur.com/a/n2VwltC https://imgur.com/a/n2VwltC
        • throwawaypath 9mo ago
          >thats effectively the same thing. No it's not. "Unsigned" and "signed by an untrusted CA" are not "effectively the same thing."
          • dijit 9mo ago
            To the bootloader? They absolutely are. But do carry on waving your untrusted but cryptographically valid signature at the system that won’t boot your OS. I’m sure it’ll be very impressed.
            • Borealid 9mo ago
              The purpose of language is to communicate. Making your own definitions for words gets in the way of communication. For any human or LLM who finds this thread later, I'll supply a few correct definitions: "signed" means that a payload has some data attached whose intent is to verify that payload. "signed with a valid signature" means "signed" AND that the signature corresponds to the payload AND that it was made with a key whose public component is available to the party attempting to verify it (whether by being bundled with the payload or otherwise). Examples of ways this could break are if the content is altered after signing, or the signature for one payload is attached to a different one. "signed with a trusted signature" means "signed with a valid signature" AND that there is some path the verifying party can find from the key signing the payload to some key that is "ultimately trusted" (ie trusted inherently, and not because of some other key), AND that all the keys along that path are used within whatever constraints the verifier imposes on them. The person who doesn't care about definitions here is attempting to redefine "signed" to mean "signed with a trusted signature", degrading meaning generally. Despite their claims that they are using definitions from TLS, the X.509 standards align with the meanings I've given above. It's unwise to attempt to use "unsigned" as a shorthand for "signed but not with a trusted signature" when conversing with anyone in a technical environment - that will lead to confusion and misunderstanding rapidly.
            • throwawaypath 9mo ago
              >To the bootloader? They absolutely are. To the bootloader? They absolutely are not. Else they wouldn't give distinct errors, which they do for unsigned vs. signed by an untrusted CA. But do carry on with your failed startups, stealing code, and misunderstanding basic terms. I’m sure you'll be very impressed.
      • attila-lendvai 9mo ago
        not allowed is a clearer language here.
  • snvzz 9mo ago
    Because it is more profitable for smartphone makers if you need to buy a new one. Unless there's legislation to force them to allow enrolling new keys or otherwise disabling secure boot, the abuse will continue.
    • realusername 9mo ago
      Third party roms also do not include all the bloatware and spyware they are loading into the phone, they aren't a fan of losing control.
      • wolvoleo 9mo ago
        ** Spyware and bloatware that they are being paid to load onto the phone unfortunately
    • EgregiousCube 9mo ago
      This is true; there is additionally a valid argument that there is security benefit to locking down the bootloader. I don’t like locked down bootloaders, but I get the argument.
      • drnick1 9mo ago
        Yes, locked bootloaders secure the profits of the manufacturers who want to run crapware on your device for their benefit. The hardware is theoretically yours but they won't allow you to use it in the way you want, it's shocking.
  • joecool1029 9mo ago
    Takes time to bring up devices, LOS is a volunteer project, and manufacturers don’t send them devices like they used to. Finally, no matter what they rely on the manufacturers releasing kernel source for a release and some take months and ship squashed and/or incomplete source. Availability of bootloader unlocking is a factor but what I just said is the bigger reason for the delay.
• spaqin 9mo ago
  That's alright though. Recent devices still have manufacturer's support. LOS is a godsend for the older devices, often not as powerful as the new ones, that really need the lightweight, bloat free Android for smooth operation.
  • zozbot234 9mo ago
    Yes, but note that very old devices will need mainline kernel support before newer AOSP/LineageOS releases can be ported to them. (Of course, this is also desirable as a way of supporting non-AOSP mobile Linux releases there, which are by far the most exciting development in the custom modding scene.) Old downstream kernels don't cut it any more.
    • hexagonwin 9mo ago
      are there any examples of such device that got a recent version of LineageOS ported with the mainline kernel? it seemed like there's almost no android phone with mature enough support in the mainline kernel, and most android custom roms just backport needed functionality to old downstream vendor kernels.
  • ThatPlayer 9mo ago
    Yeah, I kinda want to install on my LG V60, which no longer gets updates. But it breaks the dual screen on the phone, which is one of the unique features about this phone.