Hacker News Reader

Comment by zozbot123 | Hacker News Reader

iOS apps have similar issues, actually. On the Android side, you can at least use free and auditable apps from the F-Droid repository, and buy your device from an OEM vendor which will let you unlock it and install google-free LineageOS.

(More speculatively, the community is now working on replacing AOSP altogether with the usual Linux desktop stack, via PostmarketOS. Not usable right now, but it's progressing rather quickly, and may well be practically useful later in 2019.)

View on HN

> More speculatively, the community is now working on replacing AOSP altogether with the usual Linux desktop stack, via PostmarketOS

So you're telling me that 2019 is the year of the Linux desktop... on mobile?

>On the Android side, you can at least use free and auditable apps from the F-Droid repository, and buy your device from an OEM vendor which will let you unlock it and install google-free LineageOS.

Do you go audit every line of source code in the apps and OS you install? Do you then verify that the binary blobs you're installing were built from the same source? Do you somehow audit the source for the firmware on your device and verify that that is the firmware installed on your device? What about the hardware, do you audit it?

LineageOS allows fine grained permission revocation that cuts most of the bullshit.

Filtering apps by license is a great filter for intent. There are many reasons people write FLOSS licensed software for, but the fewest include wanting to get your data. For economically thinking professional data collectors who e.g. put some dancing pigs game out to get your contact data, the gaining access to a small population aren't worth the effort of open sourcing. F-Droid also has the concept of antifeatures, which upfront informs users about potentially unwanted behaviour like tracking.

I trust the community (including the security community) to do a better job at this than a handful of proprietary hardware and software vendors. Yes, it would be nice to have more openness on the hardware side too (and the Librem 5 phone is a worthwhile answer to that) but let's focus on the lowest-hanging fruit first.

How did that work out for HeartBleed bug that was in open source code for over two years?

Even worse, this 11 year old bug in the Linux kernel?

https://www.theregister.co.uk/2017/02/23/linux_kernel_gets_p...

Heartbleed was found and fixed, and diagnostic tools quickly followed. OSS isn’t a panacea, but it’s something, no?

After two years? How is that better than closed source?

Try 15 years. https://www.v3.co.uk/v3-uk/news/3023669/happy-new-year-heres...

> iOS apps have similar issues, actually.

Which issues specifically?

Being non-free and non-auditable, including proprietary SDKs that can gather tracking info/IDs, connecting to Facebook (even when the app is something other than a FB client)... Stuff that's quite comparable to what the video is talking about.

Indeed. I don't have a Facebook account and yet various apps on my iOS devices still attempt to connect to graph.facebook.com (amongst other servers I'd rather they didn't, e.g. flurry).

I think you need to be a bit more specific

Reply on news.ycombinator.com