8 ms·

AOSP has way better security and therefore privacy than desktop linux.

arxari 2mo ago
This is something that no Linux phone enthusiast seems to understand. Also if we use atomic distros with flatpaks and whatnot that mimic Android security the end user basically ends up having to essentially use Termux (but busybox or something similar) on their Linux phone as well
- grapheneos 2mo ago
  Atomic distributions don't provide the security of verified boot or the far better mandatory app sandbox and permission model on Android. Flatpak is catching up to Android from 15 years ago, but it isn't mandatory. Android continues making backwards incompatible privacy and security improvements via new target SDK versions on a yearly basis with apps forced to adopt it within around a year. It continues moving towards a more private and secure model for apps. GrapheneOS makes our own major improvements to the permission model, but we cannot enforce apps adopting it and need to design it all to be backwards compatible. We do that for Contact Scopes, Storage Scopes, our Sensors toggle and other features but not everything can be done that way. For our exploit protections, we have toggles to work around apps with memory corruption bugs or bad practices such as dynamic code loading. Android can enforce apps improving in a way we can't do. We're starting from a platform with a mandatory app sandbox and relatively modern exploit protections though. Android also does support using hardware memory tagging or HWASan to test apps even though many developers aren't using those to clean up their memory corruption bugs.
  - armadyl 2mo ago
    Thank you for actively commenting in this thread with detailed responses
drnick1 2mo ago
[flagged]
- Gander5739 2mo ago
  > AOSP is only more "secure" because, on some devices like Pixels, it exploits hardware features typically not found on general purpose computers. You don't think, say, isolating apps has anything to do with it?
  - tfrancisl 2mo ago
    Why are we acting like isolating software is impossible on Linux? It isnt even difficult, there are about a dozen different models to choose from.
    - Gander5739 2mo ago
      It's not impossible, no, but it's not the default, and the different models tend to have various different issues.
      - broadside1296 2mo ago
        I think the disagreement mainly lies between whether one should be able to use their devices as they wish, like a desktop/laptop, or whether all devices should be restricted so as to have a good baseline level of security. As far as I understand, the Linux phone enthusiast's POV is that we should start seeing the phone as another general purpose computer that can be set as per one's needs and can be suitably hardened as and when the need arises. I wonder what environment the GrapheneOS devs use for development and other general computing needs, and if such an environment could be emulated on a phone (that is assuming, of course, that their development environment is way more hardened than current desktop Linux).
        Gander5739 2mo ago
        I suppose they could be using something like Qubes OS. I myself use a rooted phone, which does admittedly have security drawbacks but is useful in various ways.
Eueudhsbsj32 2mo ago
On my Linux laptop, I use bubblewrap sandboxes with their own encrypted filesystems and granular permissions for each of my projects. Very easy and secure with NixOS, surely better than what I could do with an Android device.
- grapheneos 2mo ago
  No, it doesn't come anywhere close to the privacy or security provided by AOSP. You could be dividing up your projects into highly sandboxed environments on Android too. It has support for running multiple hardware accelerated virtual machines running desktop Linux and it wouldn't be that hard to support creating those with NixOS and other distributions instead of only the standard the Debian images provided by Android. That will happen as it gets more mature. See the explanation at https://news.ycombinator.com/item?id=49364220 https://news.ycombinator.com/item?id=49364220 for why desktop Linux is nowhere close to AOSP for privacy and security. If you want more details, there's a lot of deeper coverage.
  - Eueudhsbsj32 2mo ago
    Yes, it does, at least for my threat model. AOSP (with Google Play Services, which are needed to do much useful) mean that a whole lot of closed source system binaries are running with full access to all my data and constantly phoning home to Google.
    - akimbostrawman 2mo ago
      >at least for my threat model That is fine but obviously we are talking about threat model in comparison to each other. >Google Play Services, which are needed They are "needed" if you want to use other closed source apps that rely on play service feature. If you don't want/use closed source apps there is no reason to use Google play services at all, that's why they are optional. >running with full access to all my data GrapheneOS sandboxes play services specifically to run with user permission instead of system and can be used in a completely different isolated profile for your other private user data. NixOS by itself does nothing to increase security outside of the supply chain. There is for example no default application sandboxing, Mandatory access control or hardened memory allocation (software or hardware). Just to name the most basic security feature. https://grapheneos.org/features https://grapheneos.org/features

This is something that no Linux phone enthusiast seems to understand. Also if we use atomic distros with flatpaks and whatnot that mimic Android security the end user basically ends up having to essentially use Termux (but busybox or something similar) on their Linux phone as well

grapheneos 2mo ago
Atomic distributions don't provide the security of verified boot or the far better mandatory app sandbox and permission model on Android. Flatpak is catching up to Android from 15 years ago, but it isn't mandatory. Android continues making backwards incompatible privacy and security improvements via new target SDK versions on a yearly basis with apps forced to adopt it within around a year. It continues moving towards a more private and secure model for apps. GrapheneOS makes our own major improvements to the permission model, but we cannot enforce apps adopting it and need to design it all to be backwards compatible. We do that for Contact Scopes, Storage Scopes, our Sensors toggle and other features but not everything can be done that way. For our exploit protections, we have toggles to work around apps with memory corruption bugs or bad practices such as dynamic code loading. Android can enforce apps improving in a way we can't do. We're starting from a platform with a mandatory app sandbox and relatively modern exploit protections though. Android also does support using hardware memory tagging or HWASan to test apps even though many developers aren't using those to clean up their memory corruption bugs.
- armadyl 2mo ago
  Thank you for actively commenting in this thread with detailed responses

drnick1 2mo ago

[flagged]

Gander5739 2mo ago
> AOSP is only more "secure" because, on some devices like Pixels, it exploits hardware features typically not found on general purpose computers. You don't think, say, isolating apps has anything to do with it?
- tfrancisl 2mo ago
  Why are we acting like isolating software is impossible on Linux? It isnt even difficult, there are about a dozen different models to choose from.
  - Gander5739 2mo ago
    It's not impossible, no, but it's not the default, and the different models tend to have various different issues.
    - broadside1296 2mo ago
      I think the disagreement mainly lies between whether one should be able to use their devices as they wish, like a desktop/laptop, or whether all devices should be restricted so as to have a good baseline level of security. As far as I understand, the Linux phone enthusiast's POV is that we should start seeing the phone as another general purpose computer that can be set as per one's needs and can be suitably hardened as and when the need arises. I wonder what environment the GrapheneOS devs use for development and other general computing needs, and if such an environment could be emulated on a phone (that is assuming, of course, that their development environment is way more hardened than current desktop Linux).
      - Gander5739 2mo ago
        I suppose they could be using something like Qubes OS. I myself use a rooted phone, which does admittedly have security drawbacks but is useful in various ways.

Eueudhsbsj32 2mo ago

On my Linux laptop, I use bubblewrap sandboxes with their own encrypted filesystems and granular permissions for each of my projects. Very easy and secure with NixOS, surely better than what I could do with an Android device.

grapheneos 2mo ago
No, it doesn't come anywhere close to the privacy or security provided by AOSP. You could be dividing up your projects into highly sandboxed environments on Android too. It has support for running multiple hardware accelerated virtual machines running desktop Linux and it wouldn't be that hard to support creating those with NixOS and other distributions instead of only the standard the Debian images provided by Android. That will happen as it gets more mature. See the explanation at https://news.ycombinator.com/item?id=49364220 https://news.ycombinator.com/item?id=49364220 for why desktop Linux is nowhere close to AOSP for privacy and security. If you want more details, there's a lot of deeper coverage.
- Eueudhsbsj32 2mo ago
  Yes, it does, at least for my threat model. AOSP (with Google Play Services, which are needed to do much useful) mean that a whole lot of closed source system binaries are running with full access to all my data and constantly phoning home to Google.
  - akimbostrawman 2mo ago
    >at least for my threat model That is fine but obviously we are talking about threat model in comparison to each other. >Google Play Services, which are needed They are "needed" if you want to use other closed source apps that rely on play service feature. If you don't want/use closed source apps there is no reason to use Google play services at all, that's why they are optional. >running with full access to all my data GrapheneOS sandboxes play services specifically to run with user permission instead of system and can be used in a completely different isolated profile for your other private user data. NixOS by itself does nothing to increase security outside of the supply chain. There is for example no default application sandboxing, Mandatory access control or hardened memory allocation (software or hardware). Just to name the most basic security feature. https://grapheneos.org/features https://grapheneos.org/features