6 ms·

Ubuntu Touch is drastically less private and secure than AOSP let alone GrapheneOS. Volla's devices don't come anywhere close to meeting the update and security

by strcat 3mo ago

Ubuntu Touch is drastically less private and secure than AOSP let alone GrapheneOS. Volla's devices don't come anywhere close to meeting the update and security requirements for GrapheneOS. GrapheneOS is a Linux distribution much closely following along with the Linux kernel LTS releases, unlike those devices. It also regularly moves to new Linux kernel LTS branches. Pixels are in the process of moving to the 6.12 LTS branch with Android 17 QPR2. 6.18 is currently in the early stage of stabilization.

d3Xt3r 3mo ago
Ubuntu Touch (or any Linux distro for that matter) offers drastically more freedom than GrapheneOS or any other Android distribution. Some people care more about freedom than so called "security", and I don't know about you, but I'll take freedom any day.
- gf000 3mo ago
  Freedom to get a stroke from an incomplete toy OS? Snark aside, desktop Linux userspace (or gnu Linux, call it how you want) is nowhere near production ready. And even for the more general point, giving out root willy-nilly is not more freedom. It's more like letting your child play on the 5th floor of a half-constructed building that's about to be exploded. Your kid can enjoy their time just as much in the safe forest trail.
  - d3Xt3r 3mo ago
    Not everything needs to be "production ready". And giving out root willy-nilly is freedom. It's my device, I should get to decide how I want to use it and not have artificial restrictions put on my be by someone else. If I want to rm -rf /, I should be able to do just that.
    - gf000 3mo ago
      You can, but maybe don't make it an easy to accidentally invoke default. Like even `rm` added a flag to not do that without explicitly asking. Also, there are plenty of immutable OSs now among Linux distros, are they also limiting your freedom?
      - akimbostrawman 3mo ago
        >there are plenty of immutable OSs now among Linux distros, are they also limiting your freedom? By definition they very much can. For example SteamOS wipes all non system application (except flatpaks) on updates unless you disable read only mode. I use and enjoy GrapheneOS but there is no question that the security comes with the trade off of freedom. It's up to the user to decide if they prioritize one over the other for there use cases. I take GrapheneOS for mobile because of it's security and GNU/Linux on desktop for its freedom.
        gf000 3mo ago
        What about Fedora? Good security is about allowing everything you might want to do, but limiting what you don't want happening. Of course it's easier to just put up our hands and don't care about it, but I think we should strive for better security as we are no longer running 3 hand-started processes in a terminal, but 10s of thousands of unknown ones. Even if the processes themselves are trusted, they can easily have vulnerabilities that paired with malicious data can cause real harm. We are just lucky that desktop linux is not a popular target. Also, I don't think a dead man’s switch on a lawn mower has reasonably limited anyone’s freedom, but it probably saved a few arms and legs.
        akimbostrawman 3mo ago
        >What about Fedora? You still have sudo don't you? So still less secure but also more freedom than GOS. >We are just lucky that desktop linux is not a popular target. Its not only that. The fact that software is expected to be mostly installed and updated from trusted, vetted and signed repositories instead of google or root not being used willy nilly by all applications. Both of these basic usage differences are the reason why for all its security features windows will still be much less secure for the average user than even the most basic linux distro. 90% of security is low hanging fruit. >I don't think a dead man’s switch on a lawn mower has reasonably limited anyone’s freedom I'm very sure there have been not a small number of cases where such switches did limit freedom, even if you think they do more good than bad they are still there to limit something. The switch could prevent usage when faulty or otherwise prevent unofficial uses or just repairability.
  - lucb1e 3mo ago
    > giving out root willy-nilly is not more freedom. It's more like letting your child play on the 5th floor of a half-constructed building that's about to be exploded I take it you don't use desktop OSes anymore of any kind and call child support whenever you see a parent letting their kid use one? Better protect them from themselves in case they can't handle sudo / UAC prompts and give access (xkcd.com/1200) to the wrong process This sort of logic really boggles my mind to see on hacker news
- Cider9986 3mo ago
  How can you be free when you're not private or secure? Grapheneos is fully open source and comes with 0 Google services. >so called "security" Grapheneos is widely recognized as one of the most secure operating systems.
  - d3Xt3r 3mo ago
    > How can you be free when you're not private or secure? Are you serious? Have you even seen the state of modern operating systems compared to the operating systems of the 80s and 90s? I've had way more fun and learnt lot more about computers messing around with OSes that let you did whatever the hell you wanted to. Modern OSes have sacrificed a lot in that name of security. As for privacy, that's a completely separate topic. You can have privacy on a OS which offers freedom, depends on what "privacy" you're taking about.
    - Cider9986 3mo ago
      You can't have privacy without security.
      - d3Xt3r 3mo ago
        That is a vague, meaningless statement. What sort of privacy are we taking about? What sort of security? What's the target? What's the attack vector? What's the environment? What's your threat model? Without all of those details, your statement is meaningless.
      - lucb1e 3mo ago
        Privacy is when nobody is looking, whether that's because they cannot look or because there's nobody that looks. Security is the former: actively denying someone or something the ability to look in a situation where they are trying. GrapheneOS does that by encouraging a locked bootloader (preventing physical attacks) and letting you deny sensor access (preventing malicious apps from accessing unnecessary info), for example. I think we agree so far? But you can also have privacy by just not installing apps that violate your privacy. Such a device could be as open as any Linux laptop where you log in with root:root. It lets you do whatever you want and access whatever you want. It's yours through and through. That's freedom without security, which may or may not have privacy depending on who you let look: if you leave it unattended at a hacker conference or have sshd with password login enabled, yeah that won't stay private for very long. But that's your choice right? You can just not invite anyone in or, in this example, bring it to someone who would do something malicious An official GrapheneOS release has a lot of features baked in against actively malicious actors (be it apps or people at border checks), but users need to work within the boundaries and limitations of the sandpit that's provided to them. They're not granted much freedom, and that limits what privacy measures you can enact. Making a backup of /data, modifying firewall or traffic routing rules, signature spoofing to substitute an untrusted app with a trusted implementation, intercepting and faking Android API responses... a lot of things are off-limits: you don't have the freedom to shape the environment to suit your needs, for example to create privacy or security The axes (privacy, freedom, security) all influence each other, but they are still separate enough that you can have one or two without the other. I can see what you mean if you say that your threat actors are skilled exploit developers and you can't have privacy without also thwarting these constant attempts. (Paranoid as that may sound, I'm sure it's true for some people.) Most people would gain more privacy from doing something about the pervasive adtech than about exploit developers they're not likely to run into. For them, LineageOS could be more private and provide more freedom while being less secure in some ways (e.g. they need to watch out which processes they grant access, for example something claiming to be backup software that turns out to be ransomware) and more secure in others (e.g. data availability by getting to make backups)

by strcat 3mo ago

d3Xt3r 3mo ago

Ubuntu Touch (or any Linux distro for that matter) offers drastically more freedom than GrapheneOS or any other Android distribution. Some people care more about freedom than so called "security", and I don't know about you, but I'll take freedom any day.

gf000 3mo ago
Freedom to get a stroke from an incomplete toy OS? Snark aside, desktop Linux userspace (or gnu Linux, call it how you want) is nowhere near production ready. And even for the more general point, giving out root willy-nilly is not more freedom. It's more like letting your child play on the 5th floor of a half-constructed building that's about to be exploded. Your kid can enjoy their time just as much in the safe forest trail.
- d3Xt3r 3mo ago
  Not everything needs to be "production ready". And giving out root willy-nilly is freedom. It's my device, I should get to decide how I want to use it and not have artificial restrictions put on my be by someone else. If I want to rm -rf /, I should be able to do just that.
  - gf000 3mo ago
    You can, but maybe don't make it an easy to accidentally invoke default. Like even `rm` added a flag to not do that without explicitly asking. Also, there are plenty of immutable OSs now among Linux distros, are they also limiting your freedom?
    - akimbostrawman 3mo ago
      >there are plenty of immutable OSs now among Linux distros, are they also limiting your freedom? By definition they very much can. For example SteamOS wipes all non system application (except flatpaks) on updates unless you disable read only mode. I use and enjoy GrapheneOS but there is no question that the security comes with the trade off of freedom. It's up to the user to decide if they prioritize one over the other for there use cases. I take GrapheneOS for mobile because of it's security and GNU/Linux on desktop for its freedom.
      - gf000 3mo ago
        What about Fedora? Good security is about allowing everything you might want to do, but limiting what you don't want happening. Of course it's easier to just put up our hands and don't care about it, but I think we should strive for better security as we are no longer running 3 hand-started processes in a terminal, but 10s of thousands of unknown ones. Even if the processes themselves are trusted, they can easily have vulnerabilities that paired with malicious data can cause real harm. We are just lucky that desktop linux is not a popular target. Also, I don't think a dead man’s switch on a lawn mower has reasonably limited anyone’s freedom, but it probably saved a few arms and legs.
        akimbostrawman 3mo ago
        >What about Fedora? You still have sudo don't you? So still less secure but also more freedom than GOS. >We are just lucky that desktop linux is not a popular target. Its not only that. The fact that software is expected to be mostly installed and updated from trusted, vetted and signed repositories instead of google or root not being used willy nilly by all applications. Both of these basic usage differences are the reason why for all its security features windows will still be much less secure for the average user than even the most basic linux distro. 90% of security is low hanging fruit. >I don't think a dead man’s switch on a lawn mower has reasonably limited anyone’s freedom I'm very sure there have been not a small number of cases where such switches did limit freedom, even if you think they do more good than bad they are still there to limit something. The switch could prevent usage when faulty or otherwise prevent unofficial uses or just repairability.
- lucb1e 3mo ago
  > giving out root willy-nilly is not more freedom. It's more like letting your child play on the 5th floor of a half-constructed building that's about to be exploded I take it you don't use desktop OSes anymore of any kind and call child support whenever you see a parent letting their kid use one? Better protect them from themselves in case they can't handle sudo / UAC prompts and give access (xkcd.com/1200) to the wrong process This sort of logic really boggles my mind to see on hacker news
Cider9986 3mo ago
How can you be free when you're not private or secure? Grapheneos is fully open source and comes with 0 Google services. >so called "security" Grapheneos is widely recognized as one of the most secure operating systems.
- d3Xt3r 3mo ago
  > How can you be free when you're not private or secure? Are you serious? Have you even seen the state of modern operating systems compared to the operating systems of the 80s and 90s? I've had way more fun and learnt lot more about computers messing around with OSes that let you did whatever the hell you wanted to. Modern OSes have sacrificed a lot in that name of security. As for privacy, that's a completely separate topic. You can have privacy on a OS which offers freedom, depends on what "privacy" you're taking about.
  - Cider9986 3mo ago
    You can't have privacy without security.
    - d3Xt3r 3mo ago
      That is a vague, meaningless statement. What sort of privacy are we taking about? What sort of security? What's the target? What's the attack vector? What's the environment? What's your threat model? Without all of those details, your statement is meaningless.
    - lucb1e 3mo ago
      Privacy is when nobody is looking, whether that's because they cannot look or because there's nobody that looks. Security is the former: actively denying someone or something the ability to look in a situation where they are trying. GrapheneOS does that by encouraging a locked bootloader (preventing physical attacks) and letting you deny sensor access (preventing malicious apps from accessing unnecessary info), for example. I think we agree so far? But you can also have privacy by just not installing apps that violate your privacy. Such a device could be as open as any Linux laptop where you log in with root:root. It lets you do whatever you want and access whatever you want. It's yours through and through. That's freedom without security, which may or may not have privacy depending on who you let look: if you leave it unattended at a hacker conference or have sshd with password login enabled, yeah that won't stay private for very long. But that's your choice right? You can just not invite anyone in or, in this example, bring it to someone who would do something malicious An official GrapheneOS release has a lot of features baked in against actively malicious actors (be it apps or people at border checks), but users need to work within the boundaries and limitations of the sandpit that's provided to them. They're not granted much freedom, and that limits what privacy measures you can enact. Making a backup of /data, modifying firewall or traffic routing rules, signature spoofing to substitute an untrusted app with a trusted implementation, intercepting and faking Android API responses... a lot of things are off-limits: you don't have the freedom to shape the environment to suit your needs, for example to create privacy or security The axes (privacy, freedom, security) all influence each other, but they are still separate enough that you can have one or two without the other. I can see what you mean if you say that your threat actors are skilled exploit developers and you can't have privacy without also thwarting these constant attempts. (Paranoid as that may sound, I'm sure it's true for some people.) Most people would gain more privacy from doing something about the pervasive adtech than about exploit developers they're not likely to run into. For them, LineageOS could be more private and provide more freedom while being less secure in some ways (e.g. they need to watch out which processes they grant access, for example something claiming to be backup software that turns out to be ransomware) and more secure in others (e.g. data availability by getting to make backups)