March Update: Status Report
pine64.org
pine64.org
'Quoting the words of a factory head we work with: “I haven’t seen anything like this in the 15 years that I’ve been in the business.”'
When will we get back to a status quo, or is "2+ years unless you're a multi-billion-dollar company" the new status quo for sourcing things now?
The problem is that fabrication plants are hella expensive to tool. That's why there are so few companies worldwide that can participate.
I don't know if it is a good business though. It's is hard to be sure if demand is high enough to support a factory or if you get a dozen orders and then demand is met.
However, though the hardware seems to be progressing well, I worry about the software side, both developing for the phone and using the phone enough to produce good bug reports. Is it just me, or is there much less community activity around the PinePhone than there was around the Nokia N900?
Like everything these days, the active community seems to be more scattered, while PINE64 has a forum, this not really the central place Maemo.org seemed to be (I could not afford a N900 at the time). There are multiple subreddits, Twitter, the fediverse, chat rooms (and all the distributions have their own channels) – all this makes it hard to make sure to not miss out.
The reason for asking is that goog/aapl have had generations of highly paid talent trudging through a security nightmare and are presumably generations ahead of what is even feasible for non-big tech interests.
Without HW mods, there's nothing some malware can do to persist itself in the device and prevent you from running exactly what you want and nothing else. You can just insert a known good uSD card, and the SoC will boot from it.
So you can conceivably use an OS from uSD card as an outside root of trust for verifying/reflashing the changeable parts of the phone.
Normally the trust is rooted in some fused keys and hopefully properly implemented bootloader, which seems inherently less trustworthy and much more complex.
primarily, i am interested to learn what pine or other offering does outside of the obvious benefits of it being open. specifically, what security measures on their own merit, hardware and/or software, does pine offer, either uniquely or in an effort to "catch up" (e.g. secure enclave)
For the open device, (with one glaring hole: they don't support full device encryption i.e. the bootloader etc... yet) you can encrypt your data such that if you lose the key, it is effectively unrecoverable. There is no communication with any 3rd parties that you don't specifically allow/enable. That is a killer security feature of the device: there's no 3rd party between you and your data.
On the Apple side, you're crediting them with 'secretive and innovative' when the reality is they only provide users as much security as their business model requires. All Apple really offers is security from casual hackers and when it suits their purposes, from the user/purchaser of the device. The fact that Apple is in a position to respond to a government demand with anything other than a blob of encrypted data tells you all you need to know about how secure your data really is with them. (I'd love to be corrected if it's realistic these days to use an i-device without their cloud services enabled... I left their ecosystem years ago so I am speculating that it's not)
There's no magic when it comes to security: either you provide the foundation to allow for a secure environment (which Pine appears to be working toward) or you don't (Apple likely never will as they appear to not want to piss off various governments).
I don't know enough about Pine, but aapl/goog have had hackers battle testing their platforms for a while. I don't see how an open platform can leapfrog ahead unless aapl/goog truly are sabotaging security for "big bro"
yes, cloud is a big hole, but are we hiding from the law? aapl only responds to warrant requests -- supposedly.
(on a side note, afaik, aapl is building their own baseband proc, which presumably will be a good thing for security)
What you said makes a ton of sense, but curious to see in practice how the security of such a device will hold up. you'd have to expect that the platform will have holes, being so new -- and that there wont be enough eyes on, not without adoption. paradox.
yes, open device means far greater flexibility on security posture but this presumes a mature, battle tested tool set. (and may or may not be built on a better foundation than corporate closed phone tech -- hence inquiry)
contrarily and back to my original inquiry -- i still wonder if there are fundamental design choices inherent to Pine that separate it from (or bring it on par with) commercial offerings. (besides those elucidated by you and another commenter -- thanks). for instance, physical boundaries such as a secure enclave, etc
i challenge the notion about aapl and casual hackers. every non-trivial platform has bugs, whether open or closed. there isn't a way to casually own an up to date iOS device, for instance -- if one had such an exploit it would be worth a lot of money to aapl or a broker
sorry for free form reply
I bet your soldering iron is fine for everything you want it to do. I also be it won't let you work with tiny SMD components or reattach micro usb connectors out at the drone field where you damaged it in a crash...
Not everyone needs those features. If you do or want them, the moment you add even the simplest logic, you are better off getting a microcontroller already. No reason to bother with discrete logic chips anymore.
I have used for many years a standard soldering iron (not even a soldering station) with zero logic whatsoever. It worked, but nowadays I prefer to be able to set the exact temperature I want, to the degree. And to be able to monitor if the iron is able to handle the thermal mass I'm trying to solder.
For quick soldering jobs it's faster to just use pinecil, instead of setting up soldering station on the table.
I don't care much for electronic control. Apparently it has a bunch of features, but I don't use any of those.
Desktop soldering irons have had sleep features for years -- the temperature relaxes when you put it in the holder (or after it's been in the holder for a while) to reduce tip oxidation, but keep it warm-ish so it'll be back to soldering temperature very quickly when you pick it back up. These are based on a processor, you just don't have access to it as a user, so the timeout and temperature are set by the factory and that's it.
There are plenty of soldering irons with a digital display, which allows you to calibrate the temperature response using a simple two-point process, rather than back-and-forth twiddling of the gains of a couple of opamps on the old analog stations. Those were such a pain to calibrate, few folks bothered, and the temperature setpoint on the dial grew increasingly fictional with age. The digital ones are based on a processor, but often the UI is so terrible (two buttons, three digits of 7-segment display) there could be more features back there but nobody would use them.
When OLED displays got cheap, that changed things. You can now have high-res text without a huge screen, and finally give someone all the knobs they'd want. Timeouts extend tip life. Calibration is really good and easy. Momentary boost mode for large joints without having to change the setpoint. It's the features you'd find in a thousand-dollar Pace station, in a sub-hundred-dollar portable iron, because all the complexity is in software.
And, bonus, since it runs off random DC, you can use any laptop brick you have sitting around, or batteries. They're extremely popular with RC hobbyists for field repairs as a result, and when running from battery you need another feature -- low-input shutdown, so you don't accidentally overdischarge the battery, which can damage it. Yet another feature that costs $0 once the hardware is there.