Hacker News Reader

Comment by rjzzleep | Hacker News Reader

When people buy a cheap Android phone, I always recommend that you take a look at the xda-developers form [1] to see if there is a custom rom available.

For some cheap phones even without the backdoor the some system components are unstable leading to a subpar experience.

[1] https://forum.xda-developers.com

View on HN

Did anybody have a look at those custom ROMs, with sources from random repositories, modified by anonymous people, build on public build servers, distributed on random file hosting services?

Are they trustworthy?

The community is not stupid, it only takes one person to find out and tell everyone, and then the one doing it gets quickly ostracised.

The centralised (corporatocracy) version of "trust" that is prevalent today one of the biggest obstructions to freedom IMHO.

This is what I like about LineageOS. I may not have the time or inclination to build it myself, but it's "open enough" to meet my standards, especially compared to the closed ROM supplied by my phone's manufacturer (OnePlus, FWIW).

I'm not implying they are, my question was honest. I once tried to see where the binary ROM actually came from, and met an astonishing lack of information. Granted, it's a model that isn't really supported.

But it felt that the community is far away from having plausible sources and builds.

I can understand that ultimately this begins with kernel sources that are already just a ZIP archive on some website.

> Are they trustworthy?

Most are, yes, and the community is pretty good at pointing out the ones that aren't.

But the real question is are they any less trustworthy than Google itself and the phone manufacturers? From what I've observed, they are more trustworthy that that crowd.

Note that a custom rom will only get you "don't tell my roommate" levels of safe and secure, not "please don't inform foreign governments" safe. Backdoors can (and probably do) exist in bootloaders, recovery firmware, drivers and so on.

A lot of roms require you to use TWRP as a recovery. So that's where you get your recovery.

Most ROMs are based off of either AOSP or lineage. The list of unofficially supported devices is huge. Since, most devices share the same SOC's they're usually just forked off of each other with gradual tweaks. The Sony open device project is semi supported by sony but doesn't share any code with the stock images.

So, that really just leaves the bootloader. How much attack surface does the boot rom actually provide? I feel like most vendors would probably just assume a backdoored system or boot partition. Your boot rom would have to accommodate for all kinds of potential Android versions. It sounds like a lot of effort for a corner case so not really worth the effort.

Just to clarify, not many ROMs require a specific recovery, they simply expect certain functionality for updates. You can use many other forks of TWRP, which include backwards compatibility, without issue.

RedWolf [0] and OrangeFox [1] are both forked from TWRP and provide more features than upstream. Cyanogen and Lineage recovery are based on AOSP, again, with more features than upstream.

[0] https://redwolfrecovery.github.io/

[1] https://orangefox.tech/

How's the device support with those recoveries you linked?

It's very limited, definitely. Usually limited to a few devices that people specifically build for.

Don't forget all the binary blobs you need to get full functionality, the monstrous size of the codebase (and corresponding attack surface), the baseband processor, etc.

Also, don't get me started on the terrible security hygeine of the actual ROM distribution practices.

Reply on news.ycombinator.com