Hacker News Reader

Comment by Qwertious | Hacker News Reader

>but I don't think most people who buy a Linux phone actually want a Linux phone. They want an open-source phone.

Both of those are missing the point IMO. What people really want, is a phone that is on their side. iOS doesn't support open standards like Vulkan mainly because it's not in Apple's interest to support them. Not because it's in the user's interest, necessarily.

What people really want is a phone that they can trust to be on their side implicitly. The nugget of brilliance in Free Software is saying "if you do all this stuff, then the power will be so tilted towards you that you will be able to trust your software to be on your side".

People want something that's both polished, and won't [forego polish in one particular area for the sake of the company's interests/$$$].

View on HN

> What people really want, is a phone that is on their side.

This. No matter how convenient and useful current smartphones are in daily life, there's always the nagging discomfort by knowing you are carrying a half-nefarious spying device. One where even the so-called reputable vendors can't be trusted to not put in malicious adware, planned obsolecense, and do everything in their power to ensure you don't really own the thing.

Yes exactly.

About a year ago I switched from Windows to Linux for my home media PC, and it's such a relaxing experience. My computer just does what I tell it to do, and nothing changes unless I want it to.

By contrast, whenever I do have to boot into Windows to run some specific application, it's like I've invited a corporate representative from Microsoft into my home. Things are changed for me on updates. The OS suggests things to me I have no interest in. When I want to use Microsoft software, I have to log into accounts for some reason, which often means a round trip through email to reset the password. Once Windows even changed firmware settings without asking me which broke things in Linux.

The best things about Linux are not what it does, but what it doesn't do. I want this for my phone as well.

Counter example. I switched from Linux to Windows because I find its desktop-experience to be superior. In my mind software and hardware is evolving at a rate that makes it impractical to support the notion that I could usefully modify it myself so it mostly comes down to trust. Do I trust Microsoft more to protect my long-term interest than some unknown group of open source maintainers? Looking at being able to access old data and run old programs I feel MS have been doing a great job. Now if they come up with a way for me to make sure that my data is in some standardized format AND protected in such a way that I could reasonably expect nobody (not even MS) to read it (but still be able to offload it elsewhere) I’d be entirely happy.

> Do I trust Microsoft more to protect my long-term interest than some unknown group of open source maintainers?

Do you? I don't. Microsoft is exclusively profit-oriented, they'll sell all your information in a heartbeat if they believe to have a legal way to do it and that it won't kill them in the next 5 years.

A group of open source maintainers (the more radical the better) will not. They will (usually) not polish the product as well, and they might be difficult to deal with if you found an issue (but you _can_ talk to them, unlike Microsoft).

I definitely trust open source people more, because they do their thing for ideological reasons and based on principles, not to maximize engagement and ad-spend and their yearly bonus.

Your concerns are the same that I had up until about 3 years ago when Microsoft and Google changed everything because at least at Google they do not care about your actual data because they can aggregate and anonymize it and a level that nobody else in the entire world can.

This is why it's way more dangerous to give data to even open source apps that are encrypted and secure because if they ever do change your privacy policy and you don't pay attention to it, they could say they start selling your data and you continue to agree to it.

The Stockholm Syndrome is strong with this one. The fact they pitch their skills at anonymizing and aggregating data doesn't change the fact you can't trust Google to not utilize data exfiltration techniques in the first place. Your argument about open source license changes applies just as much, if not moreso to Google as well.

Have you really thought through that all the way?

That's why I like using a system which gives me control over which updates I want to receive. I'm not forced to take updates on an operating system which can also change the privacy policy on me and has done so in the past.

Literally the only significant amount of data I've ever lost in my life, either on a personal or professional context, were: 1. half a decade of emails dropped by Microsoft from my old Hotmail account with no reason or warning; 2. all my highlights on a 3000-page book series lost due to a iOS update breaking compatibility with the app I was using for it.

Good post.

Google has actually went even further in making it transparent where they show every bit of data they have on you. You can delete it all review it all have it auto delete, they don't need any of it

I literally and honestly feel like the only difference here is that vast majority of linux distributions don't have auto updates enabled and windows does. I'm literally afraid of running apt-get upgrade in Ubuntu because always, inevitably, things change and move about , which I hate with passion.

This is literally the opposite to me. Running apt update/upgrade never breaks anything except a long time ago when I ran out of disk space during an update. This could have been handled better, but it isn't a usual scenario for me.

The problem isn't automatic updates, it's the philosophy behind those updates. On Ubuntu (last time I used it some 5 years ago), an update fixed bugs in software and that's it. Occasionally you'd get a new feature here and there, but rarely in the shell and existing features always stayed in their places. On Windows 10, updates ship breaking changes basically every time and there is no regard for consistency. Whether the updates are manual or automatic is an implementation detail - eventually, you'll update either way. The big difference is between a rolling release with no promise of compatibility and a versioned release with LTS.

Strange, my experience is also the exact opposite. I really wonder why that is?

I'm running about 10 windows 10 machines, various builds, auto updates enabled. Some in a domain, some in a workgroup. The last time an update bricked a system, or even broke a feature, must be over a year ago.

Now on Ubuntu, I have the same experience as some other posters. I'm reasonably confident that I can update if I do it semi regularly. But the number of times I've experienced breakage that lead to hours of bugfixing during $DAYJOB, is way too high. Now everything is in its own tightly controller docker, no more random breakage (unless docker breaks, or a key expires...).

A debian 9 apt upgrade actually managed to render my install inoperable once. But that might be semi-unfair as it had to do with graphics drivers.

Are you running windows systems on semi-recent hardware? Or is it all decades old thinkpad laptops with shitty thirdparty drivers?

I can attest to this anxiety. There is always this question of what will happen if the update is botched and it bricks my system. This is why I consciously stay slim on the host OS (I have used Fedora in the past, and am now using Arch), and run almost all of my applications via Docker from a local container repository. The /home/username directory is backed up rigorously in the internal network so as to cover my ass if an update bricks my computer. As paranoid as I am to go through this, I am yet to need that backup because of a botched update ;-) The only times I reached out to backup were "I deleted this, but I shouldn't have..." scenarios.

The same paranoia applies to my MacBook Pro as well that was provided by work. All user generated content gets backed up regularly to aid recovery if things go north.

It's more than that isn't it? On Ubuntu I never candy crush come pre-installed, and I never have random popups on the bottom right corner of the screen for all types of reasons

I totally get your point regarding Windows, but does Android do this, too? The only thing mine does is auto-update apps, and only because I told it to. I didn't have to turn on auto updating. OS updates are still only suggested, never applied automatically.

But it spies on you. And transmits data about you to Google. And has pre-installed apps you cannot fully uninstall. And it changes your privacy settings without you knowing when new features are added.

Google spying on you is the least of your worries, they are the most transparent of all the big tech companies if you ever manage to dig into your Google profile these days.

If anything Google is so far ahead they are advocating more privacy and less data being sent if you choose, because they don't sell it directly to people like a local grocery store with its own app or Amazon does.

Federated learning AI is basically making it where Google can continue to have all the benefits of massive data mining without any personal information ever having to leak out

> OS updates are still only suggested, never applied automatically.

The parts involved with spying on you will update regardless of what you want or say. Unless of course you're not using the play store (or any other google services).

my android phone has a nagging "security update" popup that I cannot delete. I don't update so it stays with my phone all the time (it takes a huge amount in the pause screen), i have to deny the updates each time i restart my phone (which doesn't happen often). Nonetheless, it's true I can still use my phone (and the appstore)... huh, now that I take a closer look at this annoying update it appears to be from samsung not from google.

Why would you not update your phone security updates? Do you even read anything about Android updates. It's extremely important for vital security flaws if you use any sort of modern apps.

It's a huge advocate of keeping all my data private but now knowing how useful it is to anonymize, encrypt and use it all on my device with things like Google Pay, I strongly advocate if you're using Google or Samsung services to update.

Plus these updates usually are Android level and not related to Samsung or Google

Most of those updates only apply to the latest. So it isn't just Android it is all the other parts too. For a few months you can only get security, but eventually they decide the only version they support is the one with whatever changed google made to the core not related to security as well.

> About a year ago I switched from Windows to Linux for my home media PC, and it's such a relaxing experience. My computer just does what I tell it to do, and nothing changes unless I want it to.

My experience with Linux on the Desktop is that it wants to install updates. It doesn't force me to install updates, which I appreciate. However, eventually I also want to install updates. Unfortunately, on numerous occasions these updates have rendered the system unbootable. This is not a worthwhile tradeoff.

This has never happened to me with Windows. I'm aware that it does happen to some users, but I have trouble believing that I'm just really unlucky with Ubuntu/Debian/PopOS and Fedora.

I never had a problem with LTS versions of Ubuntu MATE.

If you want modern-looking LTS, try KDE Neon.

https://neon.kde.org/

I had Ubuntu 20.04 LTS on a Dell Inspiron 3137. I ran apt-get update and it crashed and would not boot. I was preparing to lend the laptop out to family so I had to put Windows back on it. It happens. Your personal experience is not everyone's experience.

I would be intrigued to know what happened with this one.

Across well over a decade of using Apt on Debian, Ubuntu & Mint, the amount of times I have seen Apt crash, is never. By contrast I have seen Apt tasks fail leaving packages partially installed. If relevant, it may seem a trivial, semantic difference, but I think it is a little more important than that.

Following the typical Microsoft paradigm of 'just reboot and hope for the best' will rarely result in the desired outcome, and in the case of something like grub could well end up with a system that will not boot.

For me a key difference in this case, is I have never encountered an unbootable Linux system (outside of hardware issues), that I could not fix with some basic tools. I can't say the same of Microsoft products (Personally, I don't consider a fresh install a fix :) ).

I also would love to know more about this. The thing I do is wait for LTS version 20.04.1 or 20.04.2 before installing so all the kinks will be ironed out.

However, eventually I also want to install updates. Unfortunately, on numerous occasions these updates have rendered the system unbootable. This is not a worthwhile tradeoff.

Are these "updates" or "upgrades"? If the problems are with updates, I would say that your experience is not typical of most Linux users.

Its a shame that you are having problems because the modern Linux experience is pretty slick.

They were updates. I have attempted an upgrade once, it broke the system. Now I just do clean installs in favor of upgrades.

I had the same experience with ubuntu upgrades. Something was always broken.

I don't think you can blame linux, it's just a specific distro trying to do a task which is too hard and fail.

Not sure if it's still the case with ubuntu, I just run Arch which is a rolling release distro; I decide when to upgrade and what it implies + their info on breaking updates is always punctual.

> I don't think you can blame linux

No, of course you can't but that's also the problem. It's always someone else's fault.

If you try to upgrade Ubuntu you're told to RTFM. If you try to upgrade Raspbian, you're told you should have just installed a new image.

Linux distros routinely offer up options and features that do not work and there's no responsibility to be had.

With Windows, it's Microsoft's fault and they fix it (eventually).

Kind of changing the goalposts of MS...windows fails too

I see nothing has changed in 10 years.

I've been running Debian testing for a long time, where I kind of expect things to break now and again; and I'm pretty surprised by your experience. The only breakage I've experienced were minor inconveniences, maybe it's familiarity with the OS? Modern Linux DE experience is quite good now a days.

I've never once ran into an issue with Fedora.

> I've never once ran into an issue with Fedora.

Fedora (at around version 20 iirc) was the absolute worst in my experience. I haven't used it since.

I've been running linux on the desktop for 3 years now and have never had an update break anything. If you stick to the more stable debian derivatives and forgo some of the bleeding edge features in a rolling distro like Arch (btw I do not use Arch), the update process should be pretty seamless.

This is another popular trope. "You're doing it wrong, if you did it right it would work"

I never said they were doing it wrong. I said the distribution matters. If, for example, you are running Arch Nightly and constantly pulling in the latest and greatest features, you're likely to see some stability issues. If you're using something like Ubuntu LTS, you'll miss out on a few new bells and whistles, but you'll get a very stable OS.

Saying "linux" has a poor update process or stability issues is meaningless.

You just said it again...

> If, for example, you are running Arch Nightly and constantly pulling in the latest and greatest features, you're likely to see some stability issues. If you're using something like Ubuntu LTS, you'll miss out on a few new bells and whistles, but you'll get a very stable OS.

"You're doing it wrong, if you did it right it would work"

Not "doing it wrong", making a tradeoff.

That's true of software in general. You can use (often older) more stable tech and lose access to some newer features, or you can used the latest and greatest and get a few more features and accept a reduction in stability in exchange.

Is that not the point here? Labeling something a "trope" isn't a self-contained argument. The reliability of Linux systems is terrible for certain contexts: modern gaming[1], universal hardware compatibility, taking advantage of bleeding-edge software updates (the analogue to which doesn't exist on Windows), etc.

IME, there's a lot of talking past each other when it comes to OSes. The vastly superior experience that Linux fans describe requires a couple of one-time boxes to be ticked, like constraining yourself to known compatible hardware platforms and stable software versions. There are plenty of people who don't realize this dynamic exists and trip over it, and it's not dodging the question to make them aware of these limitations and let them decide whether the cost/benefit fits their situation. Eg, in my case, I like Thinkpads, don't game, and need a stable, reliable, and performant system that I can be productive on. The pitfalls of Linux don't affect me personally, and I obviously can't meet the needs I describe with a Windows system (or to a lesser extent, OS X).

[1] I hear this is getting much better with things like Valve's Proton, but I assume that Linux is still far worse than Windows for a dedicated PC gamer that wants to play new games.

I think you make an excellent point. Many of the posts admonishing Windows speak to the loss of freedom but, as you pointed out, you have to willingly give up a great deal of freedom if you want stable Linux.

I'm not trying to bash on Linux, merely point out that for everything it does right there's just as much it does wrong. The same is true of Windows and MacOS.

No arguments there! It's a pretty good rule of thumb that the no-exceptions maximalist view is wrong, on almost any topic over which there's meaningful disagreement.

I've had Ubuntu/Debian/PopOS and Fedora break on me, all of them stable releases. Fedora was the worst.

Linux Mint has addressed this specifically. They enabled auto-updates in 20.1 only after they launched and tested Timeshift, which is a backup tool that enables you to boot into a past snapshot of the system much like FreeBSD's snapshots. It's geared mainly towards btrfs however, as ext4 doesn't support snapshots.

And to be fair, updates broke my Windows systems multiple times in the past as well. This isn't really a problem by itself since errors and mistakes happen, the problem is that the state of recovery tools in both systems is somewhat lacking. Linux can be repaired from Live USB and has Timeshift, but it doesn't have an easily accessible built-in rescue environment that's actually useful. Windows has DaRT, but all decent Live USB's for it are third-party and it's very hard to repair its internals if the existing tools don't work. FreeBSD is probably the closest to being bulletproof, but it has its own problems.

> I'm aware that it does happen to some users, but I have trouble believing that I'm just really unlucky with Ubuntu/Debian/PopOS and Fedora.

"Unlucky" is probably the wrong word, since I doubt all those failures were independent, but you're presumably in some niche with a high probability of update failure (just as the users failing their Windows updates are). For a counter anecdote, I've used Linux laptops/workstations (primarily Debian/Ubuntu, but dabbled in others) exclusively for 15 years and have never had an update break _anything_.

If I had to guess, I'd say that it's a hardware compatibility issue? Linux can still be a _terrible_ experience relative to Windows if you have strong opinions about the hardware you want to use. IME, all the people who talk about Linux being a vastly superior user experience to OS X/Windows are those whose hardware preferences line up with good Linux support.

> This has never happened to me with Windows.

Lucky you! When this happened to me with Windows last time, I had no idea what to do and how to diagnose it even though I spent a lot of time on it and had the knowledge of all of the Internet available. I had to reinstall and painstakingly redo my whole setup.

When it happened to me with GNU/Linux, it gave me enough rope to actually debug what happened, so I could fix it and get back to where I was before. And I went through several Ubuntu and Debian dist-upgrades, and now I'm even using Arch which is a rolling distro that's somewhat expected to break from time to time.

So sure, it does happen more often than it did on Windows - but I don't think I actually waste more time with that than I did when using Windows.

Summed up in the following:

Its time to upgrade your PC. Now. We don't care you're running a presentation. yeah We'll let you delay it... for now.

Its time to dim your screen. We don't care if you're reading a recipe while you cook. No we won't put a widget to allow this temporarily. We think its better buried in the settings. And you'll have to set it back later.

Its time for feature X to not work or not exist anywhere. We don't care that it worked in the old version. We don't like it.

So in other words you haven't found and used the "Settings" app yet?

The thing mentioned in this bit?

> We think its better buried in the settings. And you'll have to set it back later.

The settings app is useless. Even win 3.0 had better settings than settings app in win 10.

You haven't used it in a while. Microsoft is slowly re-implementing or dropping all of the Windows 3.x/9x era Control Panel settings.

A criticism of the Settings App as it stands today based on your usage of it a year ago is very unfair as it's continuously improving and evolving.

> A criticism of the Settings App as it stands today based on your usage of it a year ago

How do you know his/her opinion is based on year-old usage?

I don't, but MS ships an annual update that for the past couple years has included expansion of the Settings App and remove of Control Panel widgets. The original Settings App that shipped with Windows 10 was, as the op said, useless.

As MS has slowly whittled down and removed features from the Control Panel, they have simultaneously added analogs where appropriate in the Settings App. The Settings App in 20H2 is very different and far from useless when compared to what shipped a year ago, or when Windows 10 launched.

The main criticism of Windows settings is the silent reversion of settings which is tantamount to ignoring them. If Microsoft improved the clarity of the settings menu then that's nice, but ultimately irrelevant.

You shouldn't need a third-party utility for re-disabling settings after updates, and it's pretty clear at this point that Microsoft just doesn't give a damn about respecting the user's choices.

I'm cranky about the settings app as it stands right now

That's a lot of words to say "I didn't read what you wrote but I still want to feel superior."

It's fewer words actually.

Huh, guess he was just trying to be succinct then.

Both are 13 words (or if you count contractions as two words, both are 14 words).

The "settings app" is a convoluted mess which is made worse by the fact that it wholeheartedly embraced the weird "everything is an app, except for some things" philosophy.

There are settings that only apply to some "apps", there are "app wide settings", there are important settings hidden 4 layers deep under some category where one would never suspect them to be.

Then there's the fact that MS has the tendency to just silently revert settings, often privacy and telemetry related, after updates. On that end, Windows 10 very much feels like it's actively working against the user, it feels like you are only a tolerated guest on your own system.

> MS has the tendency to just silently revert settings

This is so user-hostile it's not even funny. Imagine if you had someone in your life who silently went back on agreements when you weren't looking. You would work to remove them from your life as soon as possible.

> Summed up in the following: > Its time to upgrade your PC. Now. We don't care you're running a presentation. yeah We'll let you delay it... for now.

My roommate in college refused the Windows update request enough times that it just took the decision out of his hands and _told_ him it was rebooting...in the middle of a LAN Starcraft game we were having. (Hilariously, Starcraft also ran perfectly on my Wine/Ubuntu and had all sort of weird bugs and visual artifacts on his Vista/7)

I truly can't imagine how anyone can consider a system that reboots without your consent, no matter whether you're playing Starcraft or giving a presentation or launching nuclear warheads, to be appropriate for serious work. It seems like one of the very basic jobs of an OS to _not turn off while you might be doing something important_. Perhaps the answer is as simple as "there's a setting buried somewhere that all technically-literate Windows users change", but the default behavior is beyond insane.

> Perhaps the answer is as simple as "there's a setting buried somewhere that all technically-literate Windows users change"

With all the editions and versions of Windows 10, there doesn't appear to be a single definitive answer to that.

I for one settled on https://github.com/marcosbozzani/Win10ActiveHours , which prevents reboots by scheduling a task to update Windows' own "Active Hours" twice a day.

I heard RMS once say "proprietary software subjugates people" and at the time I thought it was over-the-top, sort of out-of-place like "the people's front of judea" opinionating in the middle of a software meeting.

But wow, phones and computers nowadays are like a giant steamroller, squashing users common sense, interests and privacy.

This is simply not true, unfortunately. I run a Fedora system for more than ten years, and during this period updates shoved into my system tons of unwanted stuff. I still prefer the system to the alternatives, but let me tell you, there is simply no way I would install flatpak into my system, and if it wasn't for the terrible log spam it filled my log with, I probably wouldn't even know it arrived. But it would still be calling home and look for new packages that I will never want to use.

Maybe, even probably, no one have any nefarious motives behind the latest changes, but someone decided that if I want to upgrade my system now I have to start using systemd-resolve, and while I can and probably will alter it so it won't bother me, I wouldn't be installing it on my own.

Also, Firefox is the king of unwanted changes with little to no warnings, and while technically it isn't Linux, one day an innocent yum or dnf update install just killed my customized setup, flagged all my beloved addons as unsupported, and left them in disabled state.

>My computer just does what I tell it to do, and nothing changes unless I want it to.

>whenever I do have to boot into Windows to run some specific application, it's like I've invited a corporate representative from Microsoft into my home. Things are changed for me on updates

Yeah, it is really nice to have a consistent interface. But there is a flip side. Sometimes, people have to change in light of new security problems, and these sometimes need to be done quickly. The most obnoxious of these updates are interface changes (both UI and API). I think Windows does this too much and maybe for non-security related issues. The only real example I can think of is how OpenSSL uses envelope functions because ppl would abuse the primitives [Source: Alexandra Boldyreva, Christopher Patton, Thomas Shrimpton: Hedging Public-Key Encryption in the Real World].

You have summed my feelings about it excellently. The other day I installed an app in Linux that logs my activities, such as documents opened and programs used, and indexes it into a searchable database ("I can't remember that pdf I was reading last weekend, let me get it"). The most jarring feeling about that was... that for once I wasn't not thinking how privacy invasive all that data collection was! I'm used to seeing programs and websites attempting to collect all sorts of nefarious data and trying my best to stop that collection (including not using the product at all). I was stunned how useful it was once I realised it was all local and serving my interests, not those of its manufacturer.

> The other day I installed an app in Linux that logs my activities

May I inquire about the name of this app? Is it desktop-environment specific?

What app is that? It sounds very useful.

Definitely a refreshing feeling compared to the use of a million cloud services.

> What people really want, is a phone that is on their side.

This will never happen. Personal radio communication is innocuous compared to what a modern cell phone is, yet personal radio communication is heavily restricted since decades.

Maybe we will eventually see an open source radio stack and truly open source apps. This will only happen once surveillance and kill switches have been moved to another layer.

A cell phone will never be on our side, it is far to dangerous.

I’m not sure how you’re measuring the differences between cell phones and “personal radio communication” here. Cell phones are personal devices built around 3-5 different kinds of radios.

If you’re contrasting it with the HAM/Shortwave community, there’s an obvious difference in transmission power. The Electromagnetic Spectrum is a public resource we have to share intelligently. All the core tech in a cell phone is about how to use spectrum efficiently, delivering high speeds with minimal interference. Shortwave is much less sophisticated and operates at much higher power. There are real costs to amateur radio enthusiasts blasting transmissions with incorrectly configured equipment.

There exist cellular and wireless cards for PCs too, and still a Linux PC is on our side. But if that's somehow not enough:

You could use proof-carrying code or reproducible artifacts to keep the radio stack out of the users' control while still making it obvious what it is that radio stack does.

The BIOS analog would then only accept radio code that behaves in a particular way, but it would be clear from the (open) source that the radio code is not spying on you.

Frequency locking, max transmit power, and other typically mandated things, are doable in hardware.

Radio firmwares can be open source. It's a red herring.

>half-nefarious

You nerd-sniped me there. I'm now trying to come up with some consistent metric of the nefariousness fraction of a product/service...

> by knowing you are carrying a half-nefarious spying device

What I feel when using Android.

Yes, this is the point. For example, I want a phone where I can send faked GPS data to apps that request GPS permissions (and so on).

As a developer I don’t want people sending my app spoofed data.

As a user I want a way to bypass your overly intrusive data collection on me.

Agreed, but as a user I do want this option and so the parent post point stands - the device should be on the owners side, not the app developers.

I am the one paying for the phone so I should get to pick what information it will tell you.

As a user you're not entitled to the GPS Data of my phone and i'm allowed to send any data that I want to.

It's not your app anymore. The user has bought it remember?

Well then, you should make sure that you're providing a useful service with that data, or allow data collection to be turned off.

Think of it like this: if I'm actively using an app that's giving me turn-by-turn directions, then of course I'm not going to want to spoof GPS, since it would make the app useless to me. But if your app demands GPS data just for ad analytics, then yes, I would absolutely and without any remorse spoof GPS data for that app. In that latter case, I don't care that a developer might be unhappy with it, because as a user I'm unhappy that the developer is slurping up data they don't need!

What about games like say Pokemon Go where accurate location data is part of the game and spoofing is a problem that can impact other user's?

Good question. I still think that its up to user to decide what data he shares with app. If its crucial for app to know that gps position is not faked, app could do some heuristic. Check if user is not moving faster than some limit, does not stop moving for extended periods of time etc. Basically anticheat engine. Only area where this whould be relevant i think is online multiplayer games. Otherwise, if user is faking gps he is messing up his own experience.

>Only area where this whould be relevant i think is online multiplayer games.

That's the issue with augmented reality games like Pokemon Go.

i argue it's not an issue. If the user decides to spoof to cheat in the game, there are other ways to detect it (such as speed limiting - which, as i understand, pokemon go already does).

If the app wants to force a user to not modify their phone just so they have a secure enclave for which they can implement DRM, then i can't agree to it. This includes things like spoofing, but also things like memory edits or hacking save files, or anything else client side. If the app needs secure storage that's unchangeable, they can save it on their servers.

Spoofing is an issue even if you limit yourself to a reasonable speed. You don't have to spoof yourself everywhere all at once.

2 different permissions: Possible faked GPS data, and Not faked GPS data. An app would really need to explain why it can't accept possibly faked GPS data.

https://developer.android.com/guide/topics/sensors/gnss on android now apps can access the raw gps data, which is much harder to fake

I like that idea, although to me that is kinda the status quo and I'm not sure the folks who want to be able to fake anything at will would be ok with that.

I don't play Pokémon go, but with my understanding of the game I'm not sure how spoofing the GPS would impact other users in a negative way.

Considering that most of the world has some form of travel restrictions over the past year, and I believe that being able to interact with friends in the game requires you be be in very close proximity. Can you explain how spoofing GPS data so that people are allowed to play together even though they are not close is bad?

In games like Pokemon Go (and similar augmented reality games) players go to real world locations in order to gather resources, and battle the pokemon of another user who currently holds that position.

If you can just spoof, the whole nature of augmented reality falls apart and someone could simply spoof themselves anywhere and take those positions. It was a big problem before the android os made it harder to spoof.

There's no point/ fun in playing augmented reality games if enough people simply cheat and the real world limitations aren't a factor.

I played pokemon go seriously for a few years (both at the beginning and recently) and honestly spoofers are an issue only because imho Niantic is incompetent and doesn't care.[1]

not to say how it you are anywhere not in a medium size city you need either spoofers or endless grind to unlock significant parts of the game

[1] to be fair I left before the pandemic, so I cannot comment on how they handled that

I think spoofing early on was an issue because it was so easy.

It really stopped being a large scale issue after Android started making it harder to spoof.

>I'm not sure how spoofing the GPS would impact other users in a negative way.

You could attack a pokemon gym at your convenience (from your couch, whatever time of the day). This negatively impacts other players because a legit, non-cheating spoofer will have to expend far more effort to do the same thing.

>Can you explain how spoofing GPS data so that people are allowed to play together even though they are not close is bad?

Friend interaction or just interaction in the game has to do with raiding and trading. You can already league battle (pvp) over any distance.

Niantic has made some changes along these lines - main one is the remote raid pass. One person close enough to a gym can invite friends to raid, no spoofing needed. They also upped the trade distance, how close you need to be to interact with a gym/pokestop, etc.

So the answer to your question is the game itself has made changes to address actual in-game scenarios. That leaves spoofing GPS as a way to asymmetrically cheat against gyms, or perhaps trivialize collecting pokemon (some are region locked and so on).

As a user I don't really care about what you want or need. You're not supposed to get any data at all unless it's strictly necessary. You're also supposed to delete any data that you do get after you're done using it in a way that benefits me and me alone.

too bad!

Why not? As a developer, I can't think of any downsides.

As a user I say "too bad, I paid for the app, I do what I want with it"

I'm a developer too, but no, sorry, the user comes first. They're paying the bills and your salary.

If your app needs to get info that benefits the user (as the mapping app GPS example), nobody will deny it because it makes sense.

If your app wants to get info that benefits you but not the user, it only makes sense for that data to be denied (preferably) or faked (as a backup plan). You have no right to it.

> They're paying the bills and your salary

That's the whole issue - it's not the case anymorez now it's the ads that pay

Android had plenty tools in the past to allow that. Xprivacy even used to allow you to select which Contacts you want to allow for which app. So you could use WhatsApp but only allow a handful of contacts to be read.

One of the frustrations people have with Google is that they're making it increasingly closed and problematic to make modifications. Given that nowadays some banks for example are mobile only and everyone is waiting for Google to completely shut down modified boot systems(probably in response to Qualcomm TrustZone being untrustworthy), people are re evaluating whether it makes sense to invest in the Android ecosystem.

EDIT: google could have capitalized on this and made it a part of their offering.

That's because you're trying to use apps that use the services of Google. Pixel phones are still the best to use to wipe and put other operating systems on

Apps can detect when you're mocking GPS on Android.

That is because of Androids stupid permissions-system where you have to give all requested permissions to an app before being able to install it.

On iOS the app installs and works and THEN it might ask you for GPS permission and you can deny that and the app keeps working, just without the feature that needs GPS.

I just installed Mi Home, a chinese app which requested every permission there is. I just denied all of them, could still use the app and am 0 afraid that the app somehow accessed my data.

Just to clarify, Android has had the ability to request permissions ad hoc in the user journey since Android 6.0.

But it is true that Android won't reject apps that refuse to work without a permission while iOS mandates that basic functionalities of an app work even when permission is denied.

> you can deny that and the app keeps working, just without the feature that needs GPS

A phone that would truly value the user would allow the user to provide a fake GPS location. Then you could use features that need GPS and not give up your privacy. But Apple doesn't allow that since it would make the phone less useful for companies who want to use phones for tracking.

A phone that truly valued the user would allow users to install multiple copies of an app, and allow the user to log in with different accounts. But Apple doesn't allow that, because they don't want people to share devices.

Yeah, your GPS example doesn’t hold up. How is denying an app location info consistent with your position that Apple wanting to enable companies to track users?

So you, I suspect, don’t want to “avoid tracking” so much as you want to avoid geo-gating of apps and content.

Content distributors rely on such features to satisfy legal obligations about what content they can show where. If the OS started adding features like “pretend I’m in location X” or “download movie regardless of app restrictions” (as an example of another feature that could be argued is pro-user) then at some point you’ll have a platform that isn’t commercially supported or viable.

Honestly, Apple is by far the most pro-user company in this field and there are countless examples of this.

But a very small minority chafe against the restrictions that are actually in most users interests (eg not allowing side loading of apps, which for most people would simply be an attack vector).

> Yeah, your GPS example doesn’t hold up. How is denying an app location info consistent with your position that Apple wanting to enable companies to track users?

Many apps require location data for access to features. If you can't provide a fake location, your only choice is to either accept tracking, or not use the service.

Lots of companies use phone apps for tracking (eg. for tracking location of agents). The company will immediately realise when you turn off GPS access. If you had a way to spoof a location (eg. tell the phone to pretend you stayed in the current location), you could go to the toilet without your employers knowledge and without leaving your phone behind.

Abusers often use phone apps to track their victims. If you are in an abusive relationship, you may be too scared to turn off Find My Friends. If the phone was actually on your side, you would be able to enter a fake location, and your abuser wouldn't have to know that you visited your parents on your way home from work.

Apple wants location data from iOS users to be hard to fake, because it is more valuable this way. Apple's most important asset is the value of their ecosystem. It's why they can charge companies 30% to access it. The user's needs are secondary.

Yeah, I don't buy it, frankly these all seems like minority use cases. I imagine if you were to poll all i-phone owners this would all be bottom of the list in terms of wants. I think a lot of people here conflate "What I as a tech and privacy enthusiast want" and "What everyone wants" very often. The feature you suggest would be used by a very small percentage.

That's not to say I wouldn't want it either but I'm pretty privacy conscious, and a tech enthusiast. I just don't think you can say Apple is putting user's needs second, I don't imagine most users need this.

Yeah I’m going to need examples of what features get locked by not providing location. I’m just not buying this is anything other than wanting to avoid geo restrictions on content. I mean I understand the desire for this but I also understand the desire not to pay for content, so this is a thin one when it comes to “freedom”.

Oh and as for tracking, at least for the company they can already track you by what towers you’re connected to. So there’s no technical limitation on this being provided to apps regardless of what you might spoof.

> Yeah I’m going to need examples of what features get locked by not providing location.

Strava refuses to let you track your ride if you don't allow always-on background tracking. (They changed this about a year ago. Previously "while using the app" was sufficient)

A lunch menu app that I used before Covid allowed you to show nearby restaurants based on location. But there was no way to manually enter a location (without GPS it was just a huge unsorted list).

These are two examples that come to my mind (I'm not a person who uses a lot of different apps, I'm sure there's more out there. Try rejecting location access for a few apps and see what happens)

Edit: I'm also not sure why you are so hung up on geo restrictions. I don't really care about geo restrictions, and even if, you could avoid them trivially with VPNs that are widely available. That just has nothing to do with keeping my GPS coordinates private.

> Abusers often use phone apps to track their victims. If you are in an abusive relationship, you may be too scared to turn off Find My Friends. If the phone was actually on your side, you would be able to enter a fake location, and your abuser wouldn't have to know that you visited your parents on your way home from work.

This exact same feature you are asking for would be useful for people abducting children, who could make it look like the child was still at school while they took them away.

This is far more likely to be why Apple hasn’t implemented it.

> since it would make the phone less useful for companies who want to use phones for tracking.

Are you an Apple employer with access to confidential memos or meetings?

I can’t see how you would know this otherwise.

2015 called, said Marshmallow was released.

And meanwhile, 6 years later an app can be submitted to the play store that ignores that and just blanket asks for permissions and refuses to run without them.

Android does that too. The elephant in the room is denying internet permission. Nobody implements it because it'll hurt their bottom line.

This is why apps like netguard are a must. Is there an equivalent for iOS?

I like how Miui (Xiaomi skin on Android) allows you to do this.

"But given its importance and that i0S 14 already has a similar feature, it's more likely to ship than not. What could make Google's implementation better than Apple's is how easy it is to access more information requires you to head to the settings to see exactly what's going"

https://www.androidpolice.com/2021/03/22/android-12-isnt-sim...

On Android phones, if you enable "developer" in settings, the app "fake GPS settings" can do that.

Caveat: It's been almost 4 or 5 years since I used it. I used to prank colleagues on Facebook by posting from a local prison or other weird places. Have had no use for it since I deleted my fb account. So I don't know if it can still do what you want.

You are unable to do it for specific apps, it is a global setting.

Also I think the apps can check for this. It's also been several years for me but I remember using an external Bluetooth GPS receiver needed this setting to allow an app to read the BT data and feed it into Android & some Apps just refused to work.

I like this phrasing a lot. It’s easy to feel that iOS isn’t on your side when you can’t use a non-WebKit browser and can’t use an adblocker.

Not that this fundamentally changes your claim, but it's probably worth pointing out to someone reading that you can use an ad blocker on iOS.

There exist adblockers but as far as I’m aware they all work at a network level and not at a script level, which means that 1. They suck and 2. You can’t use a VPN and an adblocker at the same time.

(Am I misinformed?)

It’s the other way round actually. On iOS you can install an adblock ruleset provider that Safari can use natively. On Android it’s only VPN or an adblock-enabled browser (that is usually yet another set of issues) because Chrome is adblock’s enemy. At least that’s my experience after long research while using both OS (recently, mid '20-21).

You can do DNS based adblocking on Android as well using the built in "private DNS" support in combination with something like NextDNS. Doesnt need a VPN or special browser.

Properly configured, you can get much better adblocking capabilities on an Android phone than you can on iOS.

There's a weird situation with mobile phones where for most people who aren't going to go out of their way to make their devices private, Apple's ecosystem is the right choice; it has better defaults and better sandboxing. But once you do decide to go out of your way to make your device private, Apple's ecosystem stops being the right choice.

On a rooted Android phone I have network-level adblocking on my device that directly works with the firewall. I also run Ublock Origin in my phone browser, which blows every single Safari adblocker out of the water. I can also cut off Internet access to specific apps and games, not just to domains. I also have access to a litany of Open Source apps that wouldn't be allowed on app stores like NewPipe that improve my privacy by replacing services. And LineageOS imposes additional sandboxing on top of Android's built-in features.

But if a friend buys a phone, they're not going to do any of that. They can't get NewPipe because they're not using F-Droid. They're probably going to stick with Chrome, which has next to no adblocking or extra privacy controls. An iPhone will be more private and more secure for them in almost every way.

So it's a weird situation where which device is more private depends a lot on who you are. For most average consumers, it's likely iOS. But it's not quite so simple to say that iOS has the best privacy overall.

For network level blocking on Android there's no need to root or go down any rabbit holes. Just set your DNS to a adblocking service like nextdns. It's natively available since Android 9 and there are workarounds for older versions (usually by using an app that pretends to be a VPN).

I don't know about Chrome adblocking because I'm using Firefox on all my Android devices. I installed uBlock Origin and I'm using it to block elements with CSS rules (lots of annoying sticky headers and useless navigation bars.) Sometimes I use it to block scripts. My primary adblocker is Blockada which is a local VPN and blocks all ads in all apps. This means that usually no ads make their way to Firefox and I remove their empty spaces from pages with uBlock.

The shortcoming of using Blockada is that I can't use another VPN. I don't really need it yet, but if I would that could be a big problem.

I don't know why Google doesn't allow chaining VPNs. Maybe the UX would be too difficult on a phone, maybe it's a real edge case not worth spending money on, maybe it would be used only to block ads.

If you want both: a blokada-like adblocker and a VPN, setting one up with Algo and WireGuard is quite easy. I've been using it for ages and it just works without me needing to interfere.

https://github.com/trailofbits/algo

They kind of suck because of the reasons you mention but you can absolutely use them with a VPN and I do think they've gotten better over the past six years or so that I've used them.

Yeah - content blocking has been supported by safari for several years now.

https://developer.apple.com/documentation/safariservices/cre...

> (Am I misinformed?)

Quick appreciation regarding the intellectual humility required to add this to the end of your comment. In my humble opinion, this kind of attitude and approach represents some of the best of the HN community.

It's true that Safari content blocking is rules-based, but its not on a network level, the logic is implemented in the WebKit renderer. So in addition to blocking URL patterns, it is also possible to make rules to hide specific elements by CSS selector.

And the architecture of it guarantees that the content blocker doesn’t turn rogue on you and start siphoning your browsing data overnight.

Plus it applies to Safari View Controller for in-app browsing.

https://www.imore.com/ios-9-content-blocking-extensions-expl...

> It’s easy to feel that iOS isn’t on your side when you can’t use a non-WebKit browser and can’t use an adblocker.

Not only does Safari allow for 3rd-party adblock extensions that are pretty good, there are iOS browsers available, like iCab Mobile[0] for instance, that allow for extremely fine-grained, granular and tweakable ad-blocking, filtering, domain-blocking, and CSS and javascript rules - all of which can be user-edited and refined to fit exactly the user's own requirements.

There are always so many comments like the above in these threads: often characterized by people banging on iOS because it "can't be customized the way I want it after I paid so much for my iPhone". But these seem to be just standard consumer-mindset complaining from users that don't even have the intellectual curiosity to investigate whether there's actually anything already available that solves their imagined problem, or even try to fix it themselves - just as the article says.

[0] https://apps.apple.com/us/app/icab-mobile-web-browser/id3081...

The 3rd-party adblock extensions only work within Safari.

> The 3rd-party adblock extensions only work within Safari.

Did you read my entire comment?

Can you see that there are entire browser apps that implement really granular and user-controllable ad-blocking.

In other words exactly the thing the poster I was responding to is complaining about.

You still can't use a non webkit browser though. It's Internet Explorer levels of non-competition. I would love to be able to say to my users, when they experience an issue with Safari - "you can try a different browser". But I can't because the same issue will be present in Chrome.

But that's what you a developer want, not necessarily the users. I'm extremely happy that you can't tell me to use another browser and have to fix your code for Safari instead. I think that you have a right to decide which browser I can use, even if I'm your costumer. I knew the rules when I bought my iPhone and had to accept them, even if it means only using webkit. Being forced to switch to Chrome when using a specific website just because the developer didn't feel like making it work in Safari is very annoying on the Mac and would make me go nut on the phone.

It's not "fix my code" when Safari doesn't even support the feature or it's simply broken - or most annoyingly, it works one day and breaks with an update. (See: webrtc stuff) You might have known the rules, but most users don't. Plenty will come to me saying they've tried both Safari and Chrome and that it won't work in either, indicating they have no knowledge of webkit.

Android also randomly breaks things now and then, but I can at least direct users to Firefox, which never seems to have any problems.

Please understand redirecting users to another browser is only ever a last resort. If I can fix the code I will, but sometimes something just stops working and I can't even reproduce it.

...and I have a teacher who is relying on my app for their classes this week and "try firefox" could save them...

This hits the nail in the head. For a phone, open source doesn't matter and Linux doesn't matter.

It's all about for who's benefit the product is built. I like the phrasing of having a phone "on my side".

In a recent thread here on obsolete hardware I was commenting how up to the fairly recent past products were built with the idea of competing on features the user wanted (or at least presumably wanted).

But no longer - in the last ten years that has shifted in too many industries to be all about features that the company wants (spyware, tracking, DRM, cloud lock-in, and on and on). The phone duopoly is a poster child of this evil trend. Neither platform puts the user first and into the drivers seat.

So no, I don't want an open source phone nor a Linux phone, specifically. (Not saying I'd mind if one or both are true, that'd be cool, but not a deciding factor.) I want a phone where I the customer are in full control of what it does. I must be able to override anything the OS wants to do and to override anything any app wants to do.

Phone makers are still competing on features their customers want. You need to understand their customers are the carriers, not you the consumer.

Wouldn't other non-Google ROMS such as LineageOS be more popular than they are?

> What people really want, is a phone that is on their side. iOS doesn't support open standards like Vulkan mainly because it's not in Apple's interest to support them. Not because it's in the user's interest, necessarily.

I couldn't agree with "people want a phone that is on their side" more.

I also agree that Linux matters as much as iOS's BSD heart—that is, it doesn't. But this is also why the Vulkan example doesn't serve your point. As with Linux, technical implementation details aren't why people are using iPhones.

Most people use iPhones because of the complete experience. For the few who care whether the iPhone is "on their side", it is clear that Apple's business model is generally aligned with their interests. This is either unknown or untrue for alternatives.

This is where open source phone vendors will fail. Trust is not simply a technology problem.

Honestly Vulkan was just a lazy example, but it's hard to give a good one when I don't use Apple products in the first place.

A better example might be places where it's hard to switch away from Apple's systems, or perhaps how they only support hardware that doesn't last very long and are notoriously hostile to attempts to repair your device.

Except the iPhone is really not on the users side. I do tend to think the iPhone isn't going to spy on me, or at least if it is, it's going to be doing so to a much lesser extent than Android.

But it's also not going to, for example, let me install a web browser which is anything other than a Safari reskin.

There are other factors to 'being on the users side' than just privacy.

> a phone that is on their side

> What people really want is a phone that they can trust to be on their side implicitly.

Absolutely! These days our computers only do things that align with big company interests. I want a phone that will obey me even if it means ruin for its maker.

> What people really want, is a phone that is on their side

100% this.

Why is it so difficult to copy files to/from my phone?

Why is it so difficult to list all the files in a folder?

Why is it so difficult to get a list of what's running?

_Why is it so difficult to know that my phone is working for me_?

> Why is it so difficult to copy files to/from my phone?

Because they want you to have no choice but use their cloud storage

> Why is it so difficult to list all the files in a folder?

Because they don't want you to know what is a folder, just to type everything in their cloud storage search engine so you are even more locked in

I KNOW what the answer is :-P

All the relevant game engines already support Metal, the user doesn't care, their favourite games keep running.

> iOS doesn't support open standards like Vulkan mainly because it's not in Apple's interest to support them.

Or maybe because Vulkan was a standard so long and late in the making that Apple released their own graphical stack a year before the Vulkan was even announced?

Reply on news.ycombinator.com