Hacker News Reader

Comment by ghgr | Hacker News Reader

Wouldn't a solution be to install Lineage OS [1] or similar custom ROM and have the advantages of a cheap phone and the privacy of a high-end one?

[1] https://wiki.lineageos.org/devices/

View on HN

This is not practical for many phones and many people (even those who frequent this site) because you need to unlock the bootloader, which may be impossible, and then port LineageOS, which is probably not too hard in the best case, but is not a trivial undertaking.

I tried building LOS from source recently for my OnePlus 7 Pro, which is mainlined into LOS. Installing build prerequisites was easy for me because I use an OS with a package manager and a large catalog of packages. Then, it started downloading the LOS git repos. After a few hours all 58 GB of the free space on my disk was used. I cancelled it and will just stick with the provided LOS builds. Time is worth something too.

> and then port LineageOS

All the privacy aware people should actually do is to check the list of officially supported phones on the LineageOS site before buying, then spend 15 minutes to read the installation instruction and follow it.

You can download prebuilt images for supported devices. Installation is not always a smooth ride, but once you spend 30 minutes you generally forget about it.

Plus you get updates.

The post I replied to was talking about installing LOS on cheap phones. But LOS mostly doesn't exist on cheap phones, unless you want to do the work of porting it yourself. My post showed that for many people just building LOS from scratch may be a big challenge - I gave up even though my phone is already ported and has official builds available.

There are some supported sub-100$ ones.

Since the change - from Cyanogenmod to LineageOS - the amount of supported devices shrinked and nowadays I can't even find old LineageOS builds any more for devices they used to support, but not any more. I've lost faith in LineageOS.

due to problems with bootloader unlocking most devs prefer pixel or oneplus or poco phones. you can lose faith in lineageos - but it is not a company - just group of devs - trying to help each other in their time.

That still doesn't explain why old builds are removed from the site, eg. Samsung Galaxy S IV.

Well, space is not infinity and you need to remember that this is mostly voluntary work. If they're a company I would understand your claims, however they're not and there is no need for then to keep builds for your ancient device.

Also these builds will be based on old Android versions that are full of known security holes by this point. It would be irresponsible of them to knowingly distribute insecure software.

As far as companies go... Will Microsoft sell you a copy of one of their old unsupported OSs? Of course not.

The number of phones with unlockable bootloaders is also shrinking at the same time. This is an uphill battle.

Take a look at https://e.foundation/

It's a LineageOS fork which bundles MicroG and several apps to make a more usable out-of-the-box OS.

They have also re-added frequent builds for many of the phones that Lineage had dropped - including the OnePlus X which I have.

/e/ has quite a few security issues that haven't been addressed.

Infosec Handbook did a rundown when they first came about: https://infosec-handbook.eu/blog/e-foundation-first-look/

Then they did it again, more recently: https://infosec-handbook.eu/blog/e-foundation-second-look/

There's also this site: https://ewwlo.xyz/evil.html

There are also MicroG builds, they just add MicroG and the F-Droid Privileged Extension, which allows F-Droid to install and update apps without the need of user interaction or the unsafe "Unknown sources" option.

https://lineage.microg.org/#faq

This is likely because LineageOS has adopted a Charter, which includes fairly rigorous Device Support Requirements [0] before a device can get Official status. Maintainers and device maintenance have more stringent requirements also.

I think this is a step in the right direction.

As for old builds being removed, this is completely asinine. and their rationale really doesn't hold any water. You can likely find an archived version for your device, or continue building from source, 14.1 still gets Android Security Bulletin patches, for the time being.

0. https://github.com/LineageOS/charter/blob/master/device-supp...

Unless the phone has an un-unlockable bootloader -- https://news.ycombinator.com/item?id=21178430 -- but still has spyware apps.

That’s the solution for a specific phone. A solution for the problem of having malware on phones period is to stop buying phones with malware.

It's not easy to check whether a phone has malware. It's easy to check whether a phone supported by LineageOS. Just like home routers and OpenWRT.

It's easy to boycott a manufacturer though. I was a lifetime ThinkPad user up until Lenovo's malware debacle, for example.

Reply on news.ycombinator.com