Sailfish OS – Independent Mobile OS | Hacker News Reader

Sailfish OS – Independent Mobile OS

sailfishos.org

126 points0x4542100 comments

As other are saying, it's not open source. Ultimately, this means you're not in control. I can tolerate having some binary blobs, since it seems unavoidable in the current mobile landscape. But why would I go with Sailfish OS instead of Android? Why are "partners" the ones that get the "freedom to customize"? That's a big fuck you to users.

Furthermore, the parent company Jolla, did a horrible job with their tablet fundraiser and subsequent crash. This bred a lot of badwill in many like me. For me the biggest issue wasn't even the loss of money, since I understood the risks involved with a hardware fundraiser. It's that they were not transparent or open with the community; infrequent and opaque updates were the norm. Then all of a sudden they ran out of money and we're told maybe if we're lucky we'll get a refund eventually? They'll have to do a lot better to gain my trust.

For comparison, I also funded the Pyra [0], an ultra portable mini computer which runs Debian. Despite having paid more, and having already waited much longer, I have no big complaints. The team posts very detailed updates every 1 or 2 weeks. When anything goes wrong or things get delayed, they include it in the update.

[0] https://pyra-handheld.com/boards/pages/pyra/

I'm not really that sure of Sailfish's open source status. It seems the launcher, lock-screen, and system apps are closed source, personally I don't mind about those too much, but I do mind if the UI library is closed. Does anyone know the status of that?

Edit: It seems the UI library, Silica, is sort of half open, half closed: https://github.com/dm8tbr/sailfishsilica-qt5. Really think Jolla should look at that.

That Pyra device looks fantastic. A netbook in the format of that old Motorola V Box or something

Looks nice, but also horrible to type on.

The device is obsolete at this point. They will never realease it just like new OpenMoko and Neo900 in my opinion.

I've not been at GamesCom, but EvilDragon said he would have a stall there showing the last prototype devices before production ( https://pyra-handheld.com/boards/threads/open-and-close-and-... ). The CPU board is designed to be cheaply replaceable, so you'll probably be able to buy one with a new SoC / RAM / internal storage in one or two years …

Another truly open alternative in crowdfunding stage (I really wish it will reach its funding goal): https://puri.sm/shop/librem-5/

https://news.ycombinator.com/item?id=15090156

Wow. On the one hand, this is really cool. On the other hand, it's 600 USD for a phone that might be delivered in a year and a half and will not be able to run Signal.

It will run debian though, which is way cooler!

Plus, you might just be able to use anbox to run signal anyways. https://anbox.io/

Not running Signal seems like a security feature to me. The official Signal servers, and their stance on requiring a phone number and forbidding 3rd party clients is absurd.

What's the alternative? iOS has a poor story for jabber support, and the network effects for jabber are poor; the gradual network onboarding of signal made it easy to capture new users, but made it federation hostile.

At the moment, I think Matrix is a solid contender. It's easy enough to use a public servers like matrix.org, or riot.im, or run your own.

It's far from a perfect solution, but I feel like it comes closer to the mark than Signal.

The GPD Pocket is shipping for 500 USD, https://liliputing.com/2017/06/gpd-pocket-7-inch-windows-lap...

https://www.reddit.com/r/GPDPocket/comments/6idnia/linux_on_...

As far as I can tell, that doesn't have a SIM card slot, so it's not quite comparable to a mobile phone. I don't care that much about making calls, but mobile Internet access does matter in discussions about smartphones.

I have one. You're correct; it does not have a sim slot.

> 600 USD

Oh, nevermind, they take Bitcoin, which means other people paid for my new phone :-)

Eh https://hackerfall.com/story/the-truth-about-purism-why-libr... http://www.pcworld.com/article/2960524/laptop-computers/why-...

> The [Pyra] team posts very detailed updates every 1 or 2 weeks. When anything goes wrong or things get delayed, they include it in the update.

Are these updates available to the public or only pre-orderers? I'd be interested in following if the content is available. Is it the "Pyra News" section of the forum?

Yes it is. (Link for the lazy: https://pyra-handheld.com/boards/forums/pyra-news.250/ )

The "true independent mobile OS" so "private and secure" that even basic things like the calendar and the lock screen are proprietary and closed source.

This brings no advantages over AOSP. And in before people pull the argument of Google Apps, Android is perfectably usable without any of the Google proprietary software.

Yes sadly it never became open source. I guess for those like me using it, it's time to move to fairphone with Android

It's true: "The base layer source code is usually proprietary, and thus is generally not available for public access".

https://sailfishos.org/wiki/SailfishOS_Source

"Android is perfectably usable without any of the Google proprietary software."

In a virtual machine maybe, surely not on any phone where most device drivers are closed blobs. H4x0r5 may hide backdoors into compromised play store apps, but governments do it in device drivers, with 100% success rate because a closed source device driver is something 100% of the user base has installed, keeps running 24/7 at maximum privileges and has 0 chances to audit or examine.

Today closed device drivers, binary blobs etc. are places to look for malware; until a device is completely open it cannot call itself safe or secure.

The binary blobs are not part of Android at all. And Sailfish OS doesn't solve the problem of binary blobs as well.

Closed device drivers aren't part of Android, but are part of any working installation of Android. Name one device which can run Android and can call itself 100% open.

Of course Sailfish doesn't solve that problem, neither does Linux, BSD or whatever. I wasn't making a pissing contest between operating system (which is likely what trigger happy downvoters got) but simply stating a sad fact: closed device drivers are the best place to put spyware on and get 100% success, period. They can't be audited, they can't be uninstalled, they always run and they have maximum privileges.

If I'm wrong (and trust me, I hope so) I want facts proving it.

Yes the AOSP apps are usable, but the way Google has withdrawn development of them so that the proprietary versions available on the Play Store have progressed far ahead of them was not really in line with the whole Android-being-open-source mentality.

And yes they are entitled to keep whatever they like proprietary, as long as they stop trying to pretend they are interested in promoting an open source mobile OS, out side of the AOSP internals. If I'm wrong and they have contributed significantly to the AOSP apps then I take that back.

It's true that the AOSP version of the email app, for example, hasn't been in actual development. But as long as you can replace it with a good solution, like K9-Mail, does it really matter?

K-9 Mail has gone years without significant updates. Last I checked it doesn't work on newer Exchange servers and requires you enable "less secure login" to work with Gmail.

"Less secure login" is just a scare tactic anyway. You're still using a device-specific, highly-random password that's being sent over TLS to their servers. It's at least as secure as any other IMAP/SMTP server on the internet.

But it's not device-specific, which is exactly what makes it less secure. If anybody is able to sniff your password (e.g. due to initially trying to connect without TLS accidentally) or MITM your connection or get privileged access to your device (either locally or remotely), then they get access to your email, even from their machines.

Any mail client in the wild today will support STARTTLS and won't submit any credentials to Gmail until a TLS connection has been established. If your connection is MITM'd and you accept the bad certificate error or your laptop is totally pwnd, you're screwed regardless of how you're authenticating. In those situations an attacker could still hijack sessions, exfil data, act on your behalf, etc regardless of whether you went through their browser auth flow with MFA.

Yes it does really matter. It wouldn't cost them much but would prove they are committed to the ideals of open source.

Wasn't open source coined as a way to remove ideals from the discussion? This is why (as annoying as it gets sometimes) it's important to make the distinction between open source and free software. Free software has ideals.

I thought it was primarily to remove the implicit assumption that free software was necessarily non-commercial. Ultimately both terms are problematic, because free software will always have the confusion with "free as in beer" and open source software implies that access to the source is important, when it's more about what the user is allowed to do with the source.

> I thought it was primarily to remove the implicit assumption that free software was necessarily non-commercial.

I've heard Bruce Perens talk about it a few times, and even on the OSI website (https://opensource.org/history) they state...

"The conferees believed the pragmatic, business-case grounds that had motivated Netscape to release their code illustrated a valuable way to engage with potential software users and developers, and convince them to create and improve source code by participating in an engaged community. The conferees also believed that it would be useful to have a single label that identified this approach and distinguished it from the philosophically- and politically-focused label "free software." Brainstorming for this new label eventually converged on the term "open source", originally suggested by Christine Peterson."

You could be right though and some may have seen the non-commercial aspects of the word free as a tertiary benefit, but the primary stated goal was to distance itself from the ideals and politics of free software.

I agree with you though on the last part. Even as someone who uses the term free software, I often use the term open source while using search engines because searching free software brings up sites with freeware/adware/shareware and stuff I don't want. I also think using loan words like "libre" are a stretch for your general public. At work I tend to use "Free and Open Source Software".

This isn't fully open-source in contrast to something like Replicant: https://www.replicant.us/

LineageOS is also better, but includes proprietary drivers: https://lineageos.org/

Sailfish has proprietary drivers AND many of the GUI components are proprietary. I don't know if this list is still up-to-date: https://wiki.merproject.org/wiki/SailfishOSS

Check out https://www.postmarketos.org/

I’ve used Sailfish OS on the original Jolla for a little more than two years from April 2015 through July 2017. Last month, I was finally fed up enough with the horribly slow and limited hardware (couldn’t play music and open OsmAND at the same time) and got a OnePlus 3T with LineageOS.

Tidbits of my personal opinion:

- SailfishOS is much more unixy - getting a shell, setting up a SSH server and syncing files with rsync was no problem at all. I have not yet understood the directory structure of LineageOS

- The permission of apps was a problem, but not more so than on my laptop. Ideally one could solve this by only installing trusted apps, but this was unfortunately not an option (Whatsapp)

- The native e-mail client actually knew about e-mail. On LineageOS, I had to install K9mail to get such simple things as proper treatment of signatures delimited by '-- '

- The user interface on Sailfish was much more usable, in particular the swipe gestures to quickly close apps as well as the tiled view from which you can directly interact with open and running apps. Feels more like a proper computer instead of a single-threaded/single-application-at-a-time thing.

- I actually trusted the team at Jolla with providing decent updates etc. With LineageOS, I am using some unofficial ROM provided by a random guy on a largely random forum which may or may not work with over-the-air updates (it’s claimed to work but I haven’t tried it yet). I definitely trust my phone less now than I did before.

- The hardware is of course much better on the OnePlus -- had Jolla/Sailfish sold something equally good or even only slightly worse, I would have bought that again.

The default Android client for mail isn't great. Google have developed various clients available on Play but I prefer the Outlook client. K9 is probably the best FOSS client from f-droid that I tried.

I'd recommend Termux, which gives you a shell and apt. Termux is available from F-Droid, the free and open source app store.

No need for random forums. You should have been able to download an official LineageOS build from https://download.lineageos.org

Thanks, I’ll look into Termux!

> No need for random forums. You should have been able to download an official LineageOS build from https://download.lineageos.org

But even if this worked (from what I have read, others had problems), there still would be nothing to make me trust "LineageOS", as I said in the reply to your sibling - there is no real name associated to the project, no GPG key embedded in the web of trust anywhere that I can find and not even on the download page are actually signed binaries I can verify myself to be trustworthy. Not even the Wikipedia page of the project lists a single individual involved!

Surprisingly, the .zip files themselves contain an embedded TLS signature. There's a link in the footer of the download page which explains it.

But you're right, it's not GPG, and hence no web of trust behind LineageOS.

The OnePlus 3T seems to be officially supported by LineageOS[1].

I'd actually trust my phone more (using the official LineageOS build) as basic system components are FOSS (although there are some firmware blobs).

[1] https://wiki.lineageos.org/devices/oneplus3

> The OnePlus 3T seems to be officially supported by LineageOS[1].

Yes, but everything I have read, anybody who tried only the official ROM had various problems, e.g. with the camera. Hence I settled on an unofficial ROM.

But even if I used the official ROM, there is absolutely nothing on the LineageOS website that makes me trust them. No real names, no GPG keys, nothing. Just "The LineageOS project", a bunch of pseudonyms in the blog entries and apparently some LLC. Even their "Legal" sub-page does not contain anything at all.

> - The hardware is of course much better on the OnePlus -- had Jolla/Sailfish sold something equally good or even only slightly worse, I would have bought that again

They'll be releasing official SailfishOS images for Xperia X somewhere next month iirc, see https://sailfishos.org/community6/ (scroll down). It'll not be free however, the price they revealed is 50€, and iirc it's yearly.

A OS not knowing anything about permissions and which lets apps do everything they want by default.. bold statement to say its secure. They do a decent job of patching 3rd party / CVE's though. Open source? Well not anymore than stock Android id say.

Note: I used Sailfish OS for 2 years

> Well not anymore than stock Android id say.

It's even less open-source than AOSP.

To be fair, the permission model of SailfishOS is the same you use on your Linux desktop. Every application has full access to your home directory. Although access to some data needs special privileges by standard UNIX permissions on files like the contacts database.

At least Jolla claims to test and verify behavior of applications offered in their store, but it is up to you to trust any third-party applications you run.

Well you are comparing apples with oranges here ;)

True, good point about the testing!

To all geeks - SailfishOS has true multitasking. The supercomputer in your pocket is no longer limited to run a 70s-style time-sharing OS ;-)

What about apps?

I've used a Lumia and it was pretty much worthless because I couldn't find any of the apps I normally use...

It comes with an Android compatibility layer, which I imagine is similar to running Android without Play Services.

I've tried that in the past, and it worked quite well. There are a lot of good apps on F-Droid, then you can get access to others through APKMirror, or methods of downloading from the Play Store. Of those, I'd say about half work without complaint (including Whatsapp), a quarter complain and still work, and a quarter don't work. I also used (and still use) a few web apps for things like weather.

Ha, that's really smart.

At this point all they'd need to do to make this whole thing make sense is to open source it...

We need alternatives to Android and iOS; just to have assurance we can exercise free speech in the future ("the right to read"). SailfishOS, even if not fully open sourced, might be a good hedge against big corp overreach and dystopian tendencies (together with Librem).

Why do I need an alternative to Android? I can always fork an older version if it starts to restrict free speech.

This is closer to an existing nexus of expertise in FOSS, because it is a Linux distribution, whereas Android is something different, and has only ever been maintained by Google, more or less behind closed doors. A fork of Android would be much more likely to die a death than a functional mobile Linux OS.

> A fork of Android would be much more likely to die a death than a functional mobile Linux OS.

Why wouldn't a fork of Android be a functional mobile Linux OS?

Android is running on top of a Java VM, with completely independent UI components. It's a long way from a traditional Linux userland.

That's true, but I won't go so far and call it non-functional.

Most of Sailfish's UI components are proprietary, which is a more severe issue IMHO.

Ah, I was trying to distinguish it from Android on the basis of 'Linux', rather than on the basis of 'functional'. Functional was meant to contrast with the existing state of Linux on mobile, i.e. if we could get a full Linux userspace working well on mobile, that would be better than relying on Android.

Let's see what the Librem 5 comes up with ;)

Yes, I'm looking at supporting that. It's a bit of a pity they seem to be downplaying Android app support. I think they will need that to be functional in the short/medium term. From a user's perspective, it would be good to commit to Anbox support, but perhaps they're already biting off enough for them to chew!

It won't help the people buying actual devices.

Neither does Sailfish though.

Because it's slow, bloated and tied to google.

I've got a super computer in my pocket, there's no excuse to be so slow and jittery, it's been 20 years now, it's time to give up on the "java will be as fast as c one day" dream. Most apps are glorified list views yet they still take several seconds to start.

There's a tonne of google crapware that comes with every phone that can't be removed. Google has been promising to split this out of the OS for a quite few years now yet I don't see any progress. This is the only issue that forking would solve (while creating others).

The development story is the worst I've ever encountered. Untestable God-classes that every activity has to inherit from. Awful convoluted build tools that require and IDE to use (they aren't documented). A hideous xml based UI library that pretends it's as simple as HTML but makes things more complicated. The list goes on.

No one does security updates. Even googles flagship phones will only get 3 years of security updates at best. If you buy a mid-range phone you can expect a year if you're lucky.

I refuse to believe this is the best we can do.

> No one does security updates. Even googles flagship phones will only get 3 years of security updates at best. If you buy a mid-range phone you can expect a year if you're lucky.

I agree, but I don't see how Sailfish fixes these points. For example I can't buy any phones with Sailfish pre-installed and 3 years of security updates guaranteed.

The best thing to fix the update problem would be open-source drivers IMHO. And Sailfish isn't about that, it uses the same proprietary drivers as Android.

> The development story is the worst I've ever encountered. Untestable God-classes that every activity has to inherit from. [...] A hideous xml based UI library that pretends it's as simple as HTML but makes things more complicated. The list goes on.

I have developed an Android app and agree! It definitely is awful. But due to the large community you could achieve quite a lot, without having tested it I would assume that developing feature-rich apps for Sailfish is harder right now.

> Awful convoluted build tools that require and IDE to use (they aren't documented).

AFAIK Sailfish uses Qmake and QtCreator which are even worse IMHO. Regarding the documentation Android has lots of StackOverflow answers going for it.

Would be interesting to know the opinion of someone who has developed an app for both systems though.

> For example I can't buy any phones with Sailfish pre-installed and 3 years of security updates guaranteed.

Jolla has been releasing Sailfish OS updates every few months for the last three and a half years. I imagine that they would keep doing that as long as they stay alive. But my imagination is no guarantee. Especially since I can also imagine their hardware vendor partners not wanting to have to work on regularly updating their modifications to changing versions of the base system.

Can I still buy the Jolla phone somewhere?

IIRC for Sony devices you get 1 year of Sailfish updates for 50 €.

Really? It's almost like they want it to fail.

As far as I know, Jolla has completely stopped selling their hardware. I don't know if you would be able to buy a used one. A quick eBay search didn't bring up anything.

Android won't even let me use my SD card as I wish and Google disabled ad-hoc WiFi... it's getting pretty bad already...

We had an alternative. It was Maemo (spiritual predecessor to Sailfish) and was on a pretty good first device, the Nokia N900.

This very same "we" engineering community chose to give all its mindshare and attention to Android at the time so this is basically the scenario we deserve.

Had not recently checked up on what Jolla is doing, but it looks like they dropped future plans for devices and concentrating solely on the OS.

Reminds me of when I tried to buy a Jolla phone after my N9 and that thing was nearly impossible to get in the US.

They are releasing Sailfish OS for the Single-SIM version of the Sony Xperia X in September: https://blog.jolla.com/sailfishx/

> They are releasing Sailfish OS for the Single-SIM version of the Sony Xperia X in September

They've announced it will be available in September. That doesn't necessarily mean it will be released when they claim.

They have a history of releasing overly optimistic press releases and then failing to deliver on time or at all. [0]

[0] Jolla tablet backer here, still waiting for my refund 3 years later

Partnering is probably better than trying to crowdfund another device - at least one can easily flash the phone back to Android if Jolla can no longer support it.

Sorry, but what's the latest on this? They got new website?

Latest is they're just about to roll out official support for installation on Xperia X devices. The current hardware is not so modern.

There is also Copperhead OS in that space. It's pretty easy to install and it's supposed to be super secure: https://copperhead.co/android/docs/install

I've been using for past couple of months, and I can't say I miss anything from Google play services. I highly recommend if you happen to have one of the (few) supported devices.

ELI5: Why would a team of developers and investors work on something with such a small chance of becoming a viable market?

Honest question. Not intending to be snarky. Reminds me of the many Chrome knock-offs that focused on a particular aspect of browsing. Any advancement/advantage would be quickly adopted by the mainstream market leaders.

There are a bunch of native Sailfish OS apps. As far as I can tell, people work on them for fun, not for the expectation of making money off of them. For users, the result is not necessarily bad: Unlike many free Android apps, there are no annoying ads. And there are actual OpenStreetMap apps that simply use the online map data, unlike OsmAnd, which makes you pay for access to maps they didn't create.

An enormous amount of open source development on Linux is not driven by a "market" in the sense of making money either. This doesn't answer your question directly, but maybe the question is ill-posed. Do we want or need a "viable market" that looks like crappy ad-infested Android bloatware?

(Just to be clear, no, I am not saying that all Android apps are alike.)

While I'm very interested in mobile operating systems, I'm not a big fan of gesture-based interfaces. They just never work well for me; I often accidentally rotate and zoom and do other weird stuff when I enable them (on the touchpad on my laptop).

Looks like they've dropped Android compatibility from the list of advertised features. Last time I checked, the latest supported version was still Jelly Bean 4.1 -- mostly because Alien Dalvik from Myriad doesn't support anything newer.

> Moreover, Sailfish OS can be enhanced with full Android application compatibility – but only if you choose so.

On the bottom of the homepage.

> full Android application compatibility

Quite disingenuous if only Android 4.4 and below is supported.

The Jolla tablet, the Intex Aqua Fish, and Jolla C have compatibility with Android 4.4. Although that is also quite out of date, it is still supported by app developers.

Oh, and note that Android support is a commercial feature. You will not get it with any third-party device.

> Android 4.4. Although that is also quite out of date, it is still supported by app developers.

For the time being. I'd wager many/most new applications start with minimum 5.0 unless they have an explicit reason to choose otherwise.

Could the Firefox OS become a viable true open source alternative? I know Mozilla abandoned the project two years ago etc, but some fork can continue the work. I simply do not see how it can be done

Control-F "baseband"

> no results found

I don't understand what you want to say.

Baseband processor is the magical chip that lives on its own, even if you "switch off" your phone and you are not allowed to tamper with it by most developed countries legislation (i.e. you can only take what is offered to you, sanctioned by government but will be punished if you make any modifications to it). See Neo 900 developers talking about it. So separating it off should allow better sleep to all paranoid users that might think they are being monitored.

And what did you hope to read about the baseband processor's relationship to the OS?

You're replying to someone other than me.

However any mobile OS advertising itself as 'private and secure' is just lying if it is installed on a handset that hasn't dealt with the baseband issue - and none of them have or likely will.

Are we talking about binary blobs for the baseband processor?

Baseband processor on most phones can access RAM/storage/IO at will even if the phone is "turned off".

Funny you should mention that. I just watched Brian Lunduke's latest show talking about the Librem 5, which will include a hardware switch for the separate baseband chip which will be physically isolated from the rest of the system. Not here yet but it's good to see the awareness building: https://www.youtube.com/watch?v=4SwE9W8JasA

Why not use Raspberry pi with Sleepy Pi 2 hardware addon, powerbank and a 3g modem? You need a smartphone for the internet, right? I always carry a dumbphone with 2 month battery life for calls + smartphone for Internet.

Like this

https://s26.postimg.org/n71r8vlex/20170719_191716.jpg

Why do I need two months of battery life? I got to sleep every night with 60% battery remaining and place my phone on a dock to charge it.

That device is huge, I'd much rather carry around a smartphone in my pocket that is a fraction of the size and weight.

i have one device, recently bought and never going using it. regret buying it.

Reply on news.ycombinator.com