Hacker News Reader

Comment by pedroaraujo | Hacker News Reader

The "true independent mobile OS" so "private and secure" that even basic things like the calendar and the lock screen are proprietary and closed source.

This brings no advantages over AOSP. And in before people pull the argument of Google Apps, Android is perfectably usable without any of the Google proprietary software.

View on HN

Yes sadly it never became open source. I guess for those like me using it, it's time to move to fairphone with Android

Yes the AOSP apps are usable, but the way Google has withdrawn development of them so that the proprietary versions available on the Play Store have progressed far ahead of them was not really in line with the whole Android-being-open-source mentality.

And yes they are entitled to keep whatever they like proprietary, as long as they stop trying to pretend they are interested in promoting an open source mobile OS, out side of the AOSP internals. If I'm wrong and they have contributed significantly to the AOSP apps then I take that back.

It's true that the AOSP version of the email app, for example, hasn't been in actual development. But as long as you can replace it with a good solution, like K9-Mail, does it really matter?

K-9 Mail has gone years without significant updates. Last I checked it doesn't work on newer Exchange servers and requires you enable "less secure login" to work with Gmail.

"Less secure login" is just a scare tactic anyway. You're still using a device-specific, highly-random password that's being sent over TLS to their servers. It's at least as secure as any other IMAP/SMTP server on the internet.

But it's not device-specific, which is exactly what makes it less secure. If anybody is able to sniff your password (e.g. due to initially trying to connect without TLS accidentally) or MITM your connection or get privileged access to your device (either locally or remotely), then they get access to your email, even from their machines.

Any mail client in the wild today will support STARTTLS and won't submit any credentials to Gmail until a TLS connection has been established. If your connection is MITM'd and you accept the bad certificate error or your laptop is totally pwnd, you're screwed regardless of how you're authenticating. In those situations an attacker could still hijack sessions, exfil data, act on your behalf, etc regardless of whether you went through their browser auth flow with MFA.

Yes it does really matter. It wouldn't cost them much but would prove they are committed to the ideals of open source.

Wasn't open source coined as a way to remove ideals from the discussion? This is why (as annoying as it gets sometimes) it's important to make the distinction between open source and free software. Free software has ideals.

I thought it was primarily to remove the implicit assumption that free software was necessarily non-commercial. Ultimately both terms are problematic, because free software will always have the confusion with "free as in beer" and open source software implies that access to the source is important, when it's more about what the user is allowed to do with the source.

> I thought it was primarily to remove the implicit assumption that free software was necessarily non-commercial.

I've heard Bruce Perens talk about it a few times, and even on the OSI website (https://opensource.org/history) they state...

"The conferees believed the pragmatic, business-case grounds that had motivated Netscape to release their code illustrated a valuable way to engage with potential software users and developers, and convince them to create and improve source code by participating in an engaged community. The conferees also believed that it would be useful to have a single label that identified this approach and distinguished it from the philosophically- and politically-focused label "free software." Brainstorming for this new label eventually converged on the term "open source", originally suggested by Christine Peterson."

You could be right though and some may have seen the non-commercial aspects of the word free as a tertiary benefit, but the primary stated goal was to distance itself from the ideals and politics of free software.

I agree with you though on the last part. Even as someone who uses the term free software, I often use the term open source while using search engines because searching free software brings up sites with freeware/adware/shareware and stuff I don't want. I also think using loan words like "libre" are a stretch for your general public. At work I tend to use "Free and Open Source Software".

It's true: "The base layer source code is usually proprietary, and thus is generally not available for public access".

https://sailfishos.org/wiki/SailfishOS_Source

"Android is perfectably usable without any of the Google proprietary software."

In a virtual machine maybe, surely not on any phone where most device drivers are closed blobs. H4x0r5 may hide backdoors into compromised play store apps, but governments do it in device drivers, with 100% success rate because a closed source device driver is something 100% of the user base has installed, keeps running 24/7 at maximum privileges and has 0 chances to audit or examine.

Today closed device drivers, binary blobs etc. are places to look for malware; until a device is completely open it cannot call itself safe or secure.

The binary blobs are not part of Android at all. And Sailfish OS doesn't solve the problem of binary blobs as well.

Closed device drivers aren't part of Android, but are part of any working installation of Android. Name one device which can run Android and can call itself 100% open.

Of course Sailfish doesn't solve that problem, neither does Linux, BSD or whatever. I wasn't making a pissing contest between operating system (which is likely what trigger happy downvoters got) but simply stating a sad fact: closed device drivers are the best place to put spyware on and get 100% success, period. They can't be audited, they can't be uninstalled, they always run and they have maximum privileges.

If I'm wrong (and trust me, I hope so) I want facts proving it.

Reply on news.ycombinator.com