Hacker News Reader

Comment by dingaling | Hacker News Reader

That has been a * value-added feature* for years. Since at least 2014 when I started buying 'Chinese' Android phones. Many sellers advertise it as an advantage over their competition.

Not of interest to me since I install LineageOS over the top, but useful to very many people and not at all 'scary' to them. Why is it any scarier than trusting the OEM's build? In fact the seller has more reputation to lose if he does something nefarious. The OEM can just shrug and issue a press release if they get caught installing dodgy stuff; a seller might go out of business.

View on HN

> a seller might go out of business.

Hah! And by that you mean they might change their name slightly and simply re-list all of the same stuff on AliExpress or Amazon?

Those types of sellers couldn't care less about reputation. Their customers don't come to them for reputation, but rather their low prices.

Here's the rule-of-thumb, these small time sellers are interested in sales, not pwning you. They may counterfeit but they aren't going to bother installing backdoors nor are they sophisticated enough to do so. They may inadvertently do so out of incompetence but that was not their goal.

People who really do want to pwn you wear suits and sit in large offices and they will get you to do it voluntarily by signing a EULA.

Seems like a market opportunity: if you're working on thin margins, why not take some NSA cash?

Good luck doing that in China. It is provably the best and quickest way to end up in an unmarked grave or a secret prison and doom your family at the same time.

The manufacturers may be based in China, but the importers, distributors, and sellers here discussed are not necessarily so. And I suspect you could happily replace NSA in the parent comment with any private or government intelligence agency of your choice. I wouldn't expect an unscrupulous distributor to suddenly grow scruples about precisely where the cash comes from.

People so often rationalize away a plausible scenario of government surveillance by showing how it would require someone to be an irrational actor -- under a simplified, incomplete set of assumptions about the world. I do not understand why, after Snowden. Humans are not rational, and you cannot exhaustively list all the possible forces that might affect someone's decision.

You don't need NSA cash, you just need a place that will pay your X dollars to put in their advertising / monitoring malware on the device. The reincarnation of the browser bar.

That, however, is something your users will notice and complain about (maybe).

How do you install LineageOS on a random Chinese android device? How do you find the builds? I guess LineageOS only supports a handful of devices. Just curious about the process. I might as well start doing the same.

Going to the list of supported devices and doing a stupid count (-> document.querySelectorAll("table.device tr") - I didn't see a count after a few seconds, so..), I'd say it's a bit more than a handful. :) 237 unless I messed up.

1: https://wiki.lineageos.org/devices/

But compare the length of the lists for e.g. Samsung and LG with those for Huawei or Xiaomi. You're much less likely to find a ROM for a random Chinese device than for the large brand phones that are somewhat common in the US. It might be because Chinese manufacturers are even less concerned about the GPL (I once tried to look for kernel sources for my Huawei device and only found dead links) or maybe Chinese developers are less involved in the LineageOS community, but it's more likely than not that there won't be any LineageOS build available.

See comment above

Which comment are you referring to? A link would be helpful.

You can normally buy the complete source code together with CAD models for all the plastic parts, circuit board designs and datasheets for all the chips for $50 on those super dodgy chinese source code exchange websites.

The only problem then is typically getting it all to compile will be many person-months of work. There will typically be hundreds of toolchains, many missing, lots of build scripts missing or wrong, etc.

It's still nowhere as near as Ubuntu on a desktop, my Android device isn't in the list and who knows how many weeks of debugging I would need to make it work...

Surely that's something I would do always. But imagine getting a non branded Chinese phone with decent specs and being able to put ROM of your choice! That would be fun!

Well anyone who was using Linux in the late 90s is probably used to ignoring OEM brochures and instead picking hardware based on compatibility.

I've had good success with Zuk and Snapdragon-based and Elephone Mediatek-based phones

You don't buy a 'random' phone, you start your shopping process from the list of devices supported by LineageOS.

Not really! The thing is from a broader perspective it seems the popular Chinese brands have relatively cheap smartphones but if you are from any of the South Asian countries, these phones are still pretty expensive for us. There are lots of small local companies that sell re-branded phones imported from China and those are even cheaper.

Sprint OEM Android phones had Carrier IQ installed which logged everything. That was years ago too.

Reply on news.ycombinator.com