Hacker News Reader

Comment by SlowRobotAhead | Hacker News Reader

>When the revenue stream of the creator of Android fundamentally depends on being able to tie devices to identity and behaviour, it's highly unlikely this is going to happen.

Well put. I’ve tried to explain to people that I prefer Apple’s upfrontness that they are there to sell me a device and it’s software for money. Unlike Android systems where I feel the lead is intentionally buried by telling me how “free” the software is.

View on HN

Nitpick: I believe that's "lede" as in "burying the lede".

iOS apps have similar issues, actually. On the Android side, you can at least use free and auditable apps from the F-Droid repository, and buy your device from an OEM vendor which will let you unlock it and install google-free LineageOS.

(More speculatively, the community is now working on replacing AOSP altogether with the usual Linux desktop stack, via PostmarketOS. Not usable right now, but it's progressing rather quickly, and may well be practically useful later in 2019.)

> iOS apps have similar issues, actually.

Which issues specifically?

Being non-free and non-auditable, including proprietary SDKs that can gather tracking info/IDs, connecting to Facebook (even when the app is something other than a FB client)... Stuff that's quite comparable to what the video is talking about.

Indeed. I don't have a Facebook account and yet various apps on my iOS devices still attempt to connect to graph.facebook.com (amongst other servers I'd rather they didn't, e.g. flurry).

I think you need to be a bit more specific

> More speculatively, the community is now working on replacing AOSP altogether with the usual Linux desktop stack, via PostmarketOS

So you're telling me that 2019 is the year of the Linux desktop... on mobile?

>On the Android side, you can at least use free and auditable apps from the F-Droid repository, and buy your device from an OEM vendor which will let you unlock it and install google-free LineageOS.

Do you go audit every line of source code in the apps and OS you install? Do you then verify that the binary blobs you're installing were built from the same source? Do you somehow audit the source for the firmware on your device and verify that that is the firmware installed on your device? What about the hardware, do you audit it?

I trust the community (including the security community) to do a better job at this than a handful of proprietary hardware and software vendors. Yes, it would be nice to have more openness on the hardware side too (and the Librem 5 phone is a worthwhile answer to that) but let's focus on the lowest-hanging fruit first.

How did that work out for HeartBleed bug that was in open source code for over two years?

Even worse, this 11 year old bug in the Linux kernel?

https://www.theregister.co.uk/2017/02/23/linux_kernel_gets_p...

Heartbleed was found and fixed, and diagnostic tools quickly followed. OSS isn’t a panacea, but it’s something, no?

After two years? How is that better than closed source?

Try 15 years. https://www.v3.co.uk/v3-uk/news/3023669/happy-new-year-heres...

LineageOS allows fine grained permission revocation that cuts most of the bullshit.

Filtering apps by license is a great filter for intent. There are many reasons people write FLOSS licensed software for, but the fewest include wanting to get your data. For economically thinking professional data collectors who e.g. put some dancing pigs game out to get your contact data, the gaining access to a small population aren't worth the effort of open sourcing. F-Droid also has the concept of antifeatures, which upfront informs users about potentially unwanted behaviour like tracking.

Reply on news.ycombinator.com