4 ms·

The only solution is to move to a phone OS that is 100%, completely, open. I.e. Not even apps developers are allowed to ship blobs - its All-Source-Code, All-T

The only solution is to move to a phone OS that is 100%, completely, open. I.e. Not even apps developers are allowed to ship blobs - its All-Source-Code, All-The-Time. I know, its a highly unlikely scenario, but I can't help but feel in the midst of this human rights disaster, Open Source can come to the rescue.

falcolas 13y ago
Not just the OS, but the entire phone, chipset -> firmware -> os (including wireless sub-OSes) -> app. Of course, if your open source apps request any data related to your activities (such as detailed map data about your current location, even without your exact location, or routing information for TCP packets), you're leaking data about yourself again.
joosters 13y ago
That's not enough. Take the Google maps example, for instance. I bet the NSA could grab the same data from an open-source map app that used OpenStreetMap data. They can infer your location based upon the set of map tile URLs that your phone is loading over the network. No need for any code weaknesses in the app. Open source is not your saviour here!
- pgeorgi 13y ago
  many OSM apps provide offline vector data. works without data connection and also leaks less information - the most you can infer from those downloads is that people are interested in mapping data of a certain area.
jonknee 13y ago
The baseband is the problem. It leaves even a 100% open source OS quite vulnerable.
6d0debc071 13y ago
If people don't read and understand the code, ideally before running it since part of the code might be to make some low level change to its environment and then erase itself, then it doesn't matter whether it's there or not. And reviewing significant code bases is not something one person can do on their own, even in the unlikely event they've all the specialities to understand it all. It would require non-trivial organisations to be directed towards auditing the applications/system to ensure security. Which isn't to say that I don't think open source is a necessary condition for security. But I don't see that sort of audit getting done for everything that your average user is going to run on their phone.
CamperBob2 13y ago
And never use it to call anyone else or connect to anything else. Don't forget that when you're designing your NSA-proof phone.

falcolas 13y ago

Not just the OS, but the entire phone, chipset -> firmware -> os (including wireless sub-OSes) -> app. Of course, if your open source apps request any data related to your activities (such as detailed map data about your current location, even without your exact location, or routing information for TCP packets), you're leaking data about yourself again.

joosters 13y ago

That's not enough. Take the Google maps example, for instance. I bet the NSA could grab the same data from an open-source map app that used OpenStreetMap data. They can infer your location based upon the set of map tile URLs that your phone is loading over the network. No need for any code weaknesses in the app. Open source is not your saviour here!

pgeorgi 13y ago
many OSM apps provide offline vector data. works without data connection and also leaks less information - the most you can infer from those downloads is that people are interested in mapping data of a certain area.

jonknee 13y ago

The baseband is the problem. It leaves even a 100% open source OS quite vulnerable.

6d0debc071 13y ago

If people don't read and understand the code, ideally before running it since part of the code might be to make some low level change to its environment and then erase itself, then it doesn't matter whether it's there or not. And reviewing significant code bases is not something one person can do on their own, even in the unlikely event they've all the specialities to understand it all. It would require non-trivial organisations to be directed towards auditing the applications/system to ensure security. Which isn't to say that I don't think open source is a necessary condition for security. But I don't see that sort of audit getting done for everything that your average user is going to run on their phone.

CamperBob2 13y ago

And never use it to call anyone else or connect to anything else. Don't forget that when you're designing your NSA-proof phone.