Hacker News Reader

Comment by gary17the | Hacker News Reader

I don't know about you, but I just decided to switch from an iPhone back to a Nokia feature phone (where is mobile Linux when you need it?) and start backing out of Apple's ecosystem. I'm quite positive I can live without apps, just as I used to before Y2K. And, in case you're wondering, no: I have nothing to do with illegal adult imagery. [Edit #1] This article gets (at least) one thing right: when it comes to certain kinds of crime, an accusation is ALL it takes to destroy your life. [Edit #2] I used to laugh at all the "we have your password, send Bitcoin or..." spam. The first "you have a picture of a gray cat on your phone, send Bitcoin or..." message would give me a friggin' heart attack.

View on HN

I switched to an iphone about a year and half ago and I’m feeling it too. My current plan is to switch to a lineageOS device. Apple has completely run off the rails in the past year, from aggressive politicking to now complete abandonment of their core values.

I didn’t even realize apple had the ability to do something like this? Can someone explain how this is even possible for them to do? This wasn’t an update was it? Just a flipped switch?

They write the OS that runs on your iPhone, so of course they have the ability to do this or anything else.

But without an update to the os or even an app on the os, how are they able to make this change? I’m not in this space but id love to understand the technicals here, especially the ramifications for, ‘what else are they capable of doing without my permission?’

Ah, thanks for clarifying the question, and it's a really good one, and I haven't seen the answer to that. I'm guessing it would have been part of one recent update to the OS, and the feature then gets enabled on a certain date or remotely or something like that.

And your final question "What else are they capable of doing without my permission?" --- the answer is anything they want. Concretely, what are the capabilities installed NOW that they can take advantage of, who knows exactly?

As an example, I do remember a looong time ago Google remotely removed apps from Android phones, pretty sure Apple could or might even have done so as well.

Apple has the ability to do so[0]. I believe they have used it against malware in the past, but finding articles is proving to be complex.

Another solution for apple is to simply revoke the codesigning certificate that is used to sign the app, which will render the application un-runnable.

[0]: https://www.macrumors.com/2008/08/06/apples-ability-to-deact...

The change is scheduled to ship with an OS update (iOS 15): https://www.macrumors.com/2021/08/05/apple-new-child-safety-...

Nothing technical prevents them from putting something in ring zero which does silent updates without announcing them, but that's not what's happening here.

They can force update your phone, so pretty much anything they want.

This means they can intercept even e2e encrypted messages such as signal, if they wanted.

When you control kernel, you can do anything, to anything running on that system.

That's the issue - apple devices run an opaque blob signed by the entity developing it which is also is in possession of the source code which it does not share with anyone, so users can't inspect it to see what it actually does.

For comparison in a Linux distro:

- everything is built from source on distro infrastructure, users can inspect any an all source code of everything running on their machine - software updates are transparent and not enforced, user can read changelog or compare source code of the updates - software updates of individual packages don't usually go directly from upstream open source software developers but via a package maintainer in the distro, for each distro - if an upstream project introduced fishy stuff like Apple is doing would almost certainly be noticed by either one of the package maintainers or users due to changes in the source or in software behavior, alerting others to do source code analysis and stop the attempt from affecting users

Privacy was never a "core value" at Apple. Have people forgot about Prism? During that, Apple bent over backward to give data to the nsa. Other companies like yahoo sued to try preventing it. Privacy is a marketing tactic at apple they used when they realized it could be used against their competitors like Google who have business models based on knowing as much as possible about their consumers.

A Linux phone would be good, but not sufficient.

Once things like Apple is doing become normalized, the next step becomes making it illegal to distribute or use software that doesn't do it. So running your Linux phone will be illegal, and why would you want to do that anyway, except to look at child pornography?

Similarly, non-sanctionable digital currencies like Bitcoin will be made illegal.

Avoiding modern tech is a workaround, but will be get increasingly hard as the world becomes increasingly reliant on it. (Cash, also, will have to go away.)

Same. I’ve been using Apple products for years. The trade-offs they made were acceptable to me. That’s now over.

I’ve been looking at trying something like a Pixel but with Calyx as a first step while waiting for the PinePhone and the Libre M to mature further.

In case you hadn't heard this story, all PinePhones in a recent batch of shipments were redirected to NewZealand, regardless of their final destination [1]. Some people were suggesting that this could mean they were possibly tampered with.

[1]https://news.ycombinator.com/item?id=28002447

I wonder if it was the cheapest Five-Eyes country to ship them all through.

> while waiting for the PinePhone and the Libre M to mature further.

This can't happen fast enough... though I can't get behind Purism/LibreM it's just too fucking expensive, basic privacy and ownership of your device shouldn't be a privilege.

Librem 5 you mean.

What if you send a photo to an iPhone user that is gets false-positived, aren't you also at risk?

Basically, is it with interacting with Apple users if you are worried about that problem?

Don't forget hosted email providers scanning attachments. Best to stick to voice and snail mail.

Actually voicemail and calls can (and are) scanned for content as well. Best to stick with in-person conversations only, not around any technology that has a microphone.

I’m in the same boat. I loved Apple’s stand on privacy. That seems to have now been thrown out the window. I despise child abuse but this isn’t how you protect children. What are my options on Android? Any smaller phones? Everything I see there is enormous. I loved my original iPhone SE. :(

Any Android One phone is clean (aside from Google ofc). Sadly the program will probably be cancelled because many manufacturers want their own spyware installed on phones. I think Android will at some point fail.

There is librem and pinephones and they don't look bad, but don't expect many apps and interoperability. Some people regard that as a plus.

Pixel 5 is pretty good - not too big, good battery, fingerprint scanner and 90hz screen.

Pixel 4a?

5.8 inch screen. :(

I’d like something like my 4 inch iPhone SE but I know that is impossible. How about 4.7 inch range like the new iPhone SE?

Edit: If anyone is ever reading this and looking, I went with a Pixel 2, has a 5 inch screen and a good camera. I'll see how it goes. Will be nice to not be locked into Apple anymore.

Pixel 4a and Pixel 2 are almost the same size.

https://www.phonearena.com/phones/size/Google-Pixel-4a,Googl...

Keep in mind that bezels have gotten much smaller over time.

Oh I see. Thank you, I didn’t think about that.

Yep, I'm gonna go into a dumb phone if those changes go in. Privacy was the whole reason I was in Apple's ecosystem. If they're gonna spy on me, even if it's a good reason, then there's no privacy anymore. Basically: fuck them.

Sailfish OS is mobile Linux and can run on smartphones. I didn't personally use it but the website claims it to run on the Sony Xperia 10 II from 2020.

It costs $50, though.

https://jolla.com

Purchasing Sailfish has some geographical restrictions.

"Sailfish X is currently available in the countries of the European Union, Norway and Switzerland ("Authorized Countries") and the use of our website and services to purchase Sailfish X outside of the Authorized Countries is prohibited."[0]

https://shop.jolla.com

This is effectively just (understandable) CYA on Jollas part, likely due to the some countries respecting the insanity that are software patents.

In practice only the act of buying the actual Sailfish OS license in https://shop.jolla.com needs to be done from the the EU/supported countries. That can be done via a EU VPN and none of the Jolla provided services (RPM repositories needed for system updates, etc.) are geoblocked. I went to Japan with Sailfish OS phone twice with no issues at all.

For reference:

- getting SFOS from outside of EU:

https://together.jolla.com/question/184861/ask-purchase-sail...

https://forum.sailfishos.org/t/has-jolla-abandoned-sailors-i...

- stats from the community Sailfish OS software repository showing a lot of traffic from countries outside of the officially supported area

https://openrepos.net/statistics/global

Yes, this is the main problem with SFOS.

I think it is because of the USA's allowance of trivial patents which act like a trade block.

I have been using Sailfish OS since its launch in 2013 and it works fine, even for regular users (if you install it for them).

I have recently installed it on the Xperia 10 II you mention as well use a couple Xperia X devices in the family. Use the Jolla 1 & Jolla C before back when Jolla still manufactured their own devices.

Frankly, before some of the PinePhone distro mature, this is the only really usable Linux distro based independent mobile OS. And it has been available for years, yet people don't seem to be aware of it or seem to ignore it for some reason.

And if you have any questions about Sailfish OS, fire away! :)

> Frankly, before some of the PinePhone distro mature, this is the only really usable Linux distro based independent mobile OS.

Did you take PureOS into account ? It is the Linux OS installed on the Librem 5 phone. https://puri.sm/products/librem-5/

I know about it, but it still seems much less mature & available only on limited hardware. Still hopefully this will get addressed over time.

I've been aware of it but the fact that there's proprietary parts makes it a non-starter for me. Why leave one closed-source ecosystem to go join another? I'll get a phone I can flash with postmarketOS/Plasma Mobile/Ubuntu Touch instead.

Because Sailfish OS works now and is mikes better in both openness and privacy violations than both iOS and Android ?

And while I agree that the closed source parts are stupid I still think Sailfish OS is a good stepping stone to full open distros and hardware once they reach sufficient maturity.

How's the Anbox support on it? I'd like to keep using the large F-Droid app ecosystem until native alternatives are as good.

Also have they resolved the kernel updating issue? All phones which ship with Android 11 or lower are unable to have their kernel updated because each device uses a modified kernel[1]. Phones which ship with Android 12 like the Pixel 6 all use the same Android Common Kernel, so it's enabled Google to guarantee the Pixel 6 will have at least 5 years of kernel and OS updates for the first time in Android's history.

[1] https://lwn.net/Articles/830979/

The 50€ for a Sailfish OS license also pays for a (proprietary) Android emulation layer (called Alien Dalvik, originally by the Miriad Group) that works really well. More here:

https://jolla.zendesk.com/hc/en-us/articles/201440787-What-A...

You can even install microg or full blown Google apps if you really want & are fine with the implications (still less problematic having Google stuff in the emulator than on a native device IMHO).

There have been actually also some attempts to get Anbox running on Sailfish OS as the community ports dont get the Android emulation layer, only officially supported devices.

As for major version kernel update issues - they did not, but I am not really sure it's that problematic in the end.

So basically they base their port on the best kernel version + blob bundle from the Sony open device program at the time, then stick with it. Apparently the way updates of these low level things work on devices originally shipping with Android are too stupid and fragile to make supportable over the air updates possible for Sailfish OS.

They could port the adaptation to newer bundle from the open device program and either mandate re-flashing or support two versions based on different kernels on a single device. Both not very good options imho.

Still, not updating the major kernel version does not mean the Don support the devices or newer rebuild the kernel. All the Xperia devices in the program are still getting OS updates, including security fixes for the kernel. They actually only recently dropped support for their Jolla 1 handset released in 2013.

It's just when you really need the latest kernel features or the most advanced Android emulation layer you might need to get the most recently supported device.

Thanks for the info! The limited supported hardware and kernel updates has me hesitant still but I'll give it another look, it's been years since I did last.

While not as fast (+ I think keeping parts of it closed is stupid and never gave them any benefit) as I would like there is definitely continuous progress being made in Sailfish OS, not to mention a very nice community of users, app developers, translators, device porters and contributors to the open parts of Sailfish OS.

Thats what kept me there for all those years. :)

One of the reasons I want the Xperia 10 II is because of the TOF sensor and the camera array. Does the Sailfish OS offer software which utilises those?

For some reason the default camera only uses the "normal" camera but the Advanced Camera application from the community repos (Open Repos) can use all three without issues.

No idea about the ToF sensor - I woukd guess it could be used unless it nerds some weird Android blobs to function.

The only thing I'd struggle to lose is a map (Google Maps/Apple Maps). For me, it's essential if I'm going somewhere unfamiliar.

Doesn't good old https://maps.google.com or https://osm.org work on phones without apps?

I don't know, would it? It requires fairly modern browser features that I don't remember the old school phones' browsers having.

The mobile web interface of Google Maps is hideous and unusable. I had to use it from time to time, when OSM didn't have the data I needed, and I regretted every second of it.

It's by design so you use the app

Most online banking sites in Germany require a phone nowadays, some even one that passes Google safety net for Android phones.

AFAICS, no, they don't. If you don't install the bank's app, you are usually offered to use a stand-alone hardware TAN generator. I currently have 4 TAN generators for different bank accounts (because everybody seeems to use a different protocol).

On the positive side, a stand-alone air-gapped TAN generator feels much saver than using a (possibly back-doored) smart-phone to do on-line banking.

For people outside Germany, here's what a TAN generator looks like: https://www.pcdirekt.de/hardware/tan-generator/

Obviously I can't speak for every country and every bank, but at least in two countries and with two banks they are trying really hard to get me off the hardware tokens and onto mobile phones.

They have done all kinds of dark patterns, for example they update the website (which eventually becomes a mandatory update), but that requires relinquishing the hardware token, or they update their mobile app, and if you even try to log-in into the new app they automatically cancel your token, etc.

When my token's battery died, they didn't want to give me a new one. They said they don't offer the service anymore. Only after escalating N times and explaining that I need a hardware token because their SMS-based 2FA didn't work internationally they gave me a new token. Suddenly it wasn't discontinued anymore. Now they moved off SMS-based 2FA to some mobile app, so I suspect next time I need a token I won't be able to get it.

Make no mistake, enjoy your TAN generator while you can, because you will not be able to enjoy it for long.

In the country I live in right now, the only way to get a proof for your COVID-19 vaccination is if you "voluntarily" enroll into some phone-based authentication scheme with your government that requires a modern, non-jailbroken iOS or Android device.

Yes, exactly. Maybe you can protect yourself (a bit) by having two phones. One for browsing and communication and one to get official (banking/vaccination/etc) stuff done.

In germany (and I'd assume standardized throughout europe) COVID vaccination digital certificate is just that: a digitally signed certificate (encoding your name+vaccination meta-info) passed around via QR code. While you can use an App to read and present it, just having a paper-copy of the QR code (plus some ID document proving that the name on the certificate matches your person) should be enough to prove your vaccination status.

There is nowhere to get a paper copy from in my country. At least not without going through insurmountable hoops. I tried.

You have to log-in to a government website, and you do it either through a mobile phone registered with the government, or with a smartcard and a proprietary Java application. Pick your poison. (And they don't want to issue new smartcards either.)

I'm not in Germany, but I am currently moving banks because the only way to do online banking is to have an Android or Apple phone, either for 2FA or for mobile banking. They don't have hardware generators. I currently have an old Windows phone (unsupported) and a Pinephone (unsupported), so no online banking for me.

This is so weird to me. I'm over here in the US using a website with a regular old password, no 2FA or anything. Same thing at multiple institutions.

I've run into a few that require 2FA - either SMS or email, your choice.

There is a new EU regulation that requires certain security considerations. Sadly, all banks decided that the best way to implement those was to develop a proprietary solution for themselves and completely avoid anything even close to being standardized.

What bothers me is they all had 2FA in the form of certificates or SMS auth, and most of them moved off of that to some other solution (current bank has 3rd party login which I can do with a cert, the old bank only has an app). What's wrong with cert auth? It can't be less secure than an android app.

Some banks offer it (usually those with higher fees), but unless you count every separate Sparkasse and VR as their own Bank (for non-Germans: It’s similar-ish to a franchising system), I wouldn’t say "usually".

You mean a phone to receive a text for MFA? "Most" can't be more than that.

However there are a couple of new "Fintech" banks in the UK that are mobile app only. No website and I assume very difficult to get anyone on the phone. That seems crazy to me. Access to your bank is at the mercy of Google/Apple.

They probably require something like SmartID, which means that you need to have a smartphone that's not rooted. Ie can't even use LineageOS.

Rooted is unrelated, some apps require it, others don’t. But several require their proprietary app to access the online banking website from your computer.

Rooted is related in that some apps will refuse to work, or will disable features if they detect that the phone is rooted.

Until SafetyNet is improved you can still hide you're rooted via MagiskHide.

I wrote that, yes. But my comment was about the broader situation and not just about the apps requiring root.

Mine has it as an option, but it also supports this[1] external tan generator. I use it since I do not understand how a single device that could hold all the data needed for online banking can be considered 2 factor, when its 1 factor at best.

[1]https://www.mediamarkt.de/de/product/_reinersct-tanjack%C2%A...

Some banks in Germany support chipTAN which doesn't require a phone. You can find a list of banks supporting chipTAN here: https://www.kostenloser-girokonto-vergleich.de/diese-banken-...

That list is outdated. I was doubtful DKB (which you can’t even use with rooted Android devices, I had to cancel my account via customer support because they decided to cut me off with a minor update) allows chipTAN, and the latest comment is that they stopped supporting it.

I'm regularly using chipTAN with a stand-alone TAN generator (similar to [1], based on optical flicker-code) for a DKB account. No problems so far.

Deutsche bank uses PhotoTAN, which supports hardware TAN generators [2].

Some banks use different but similar TAN generators (e.g. SecurePlus [3]), and I also witnessed Postbank accounts operated with USB-based TAN generators [4] called "BestSign".

[1] https://www.voelkner.de/products/476429/REINER-SCT-tanJack-o...

[2] https://genostore.de/db/phototan-lesegeraet/92/phototan-lese...

[3] https://cb.kobilshop.com/secureplus-generator/1/secureplus-g... securePlus Generator

[4] https://www.seal-one.com/devices.en#DiVc3100KLink BestSign

You are right and I stand corrected

I just picked up a tom-tom on ebay for $30.00, I forgot how awesome having a dedicated GPS can be. No hot phone, no worries about data connection.

The feature phones do have google maps, but from what I've read they all take some time to acquire a lock (could be a software issue?)

Probably hardware. GPS either requires a bootstrap starting point or it has to completely solve the equations to calculate the location (slow!).

Expensive phones triangulate via towers (fast!) and use that to bootstrap the GPS unit. Some GPS units don’t support that bootstrapping and are, thus, slower.

My 10 year old Garmin still works and I can get updated maps on it if I ever need it.

Just take a mobile device and avoid matching it to any identity, if - like many - you have needed pocket computing power since forever and since forever you have been a private individual.

That's not really possible. iPhones require an iCloud account which even if not directly linked to you, serves as a pool of information that Apple can gather about you and work out your identity from. The second you switch on your phone, it connects to several cell towers and enables your position to be triangulated. As you move around between work, home, the shops, it's constantly informing the providers of your location. Even if you switch SIMs regularly, your device's IMSI number is static and serves as a unique fingerprint. Conveniently, spoofing IMSI numbers is illegal. Guess why.

Theoretically it might be possible to combat cell tower triangulation by having the modem only respond to one tower at a time and insert artificial latency to make it harder to work out your distance. But, another convenient fact: cell modems are all closed source, proprietary black boxes. They also have DMA (Direct Memory Access) to your phone.

Perhaps I should be wearing a tinfoil hat but these don't seem like coincidences to me. They seem like intentional measures to weaponise a tool in our everyday lives.

> iPhones require an iCloud account

Nope. I have several dev devices. None of which have an iCloud account setup.

Didn’t do anything special; just skipped it at setup.

I think a good balance between usability and privacy is to use LineageOS with MicroG (an open implementation of GApps APIs) or something like Sailfish OS.

If Spyware Engine is allowed to be installed by some idiot with company in his hands to amplify his idiocy, what prevents another idiot with company in his hands to do the same?

And how about specially crafted 'normal' pictures sent to individual to trigger the system? Special mind would have a perfect tool to get some one down / put into the troubles.

> (where is mobile Linux when you need it?)

Here it is: https://puri.sm/products/librem-5 and https://www.pine64.org/pinephone/.

It's not (only) about the hardware, both PureOS and Plasma Mobile platforms are nowhere near production-grade software, likely cannot be even considered beta-quality by an end-user.

What is not “production-grade” about PureOS? It’s the same OS they install on their laptops and the mobile options are baked into GTK. Do you use PureOS? As far as I understand it’s just Debian, with some changes to Gnome and both of those run in production in lots of places.

The HN audience can have those phones as daily drivers (some do). I am not suggesting that they are as good as iPhones.

I see your point. There's also postmarketOS; PINE64 PinePhone is listed as one of its primary supported devices[1].

[1] https://wiki.postmarketos.org/wiki/Devices

postmarketOS mostly only supports well very old devices, and the Pinephone which is also based on completely outdated hardware. I wish there was something a little more recent with Linux support.

http://wiki.postmarketos.org/wiki/Devices

It also supports the Librem 5, but also the Oneplus 6 and 6T

I had a look at OnePlus and checked wikipedia to know which country it comes from, and... wow :

* benchmark results faked by software

* personal data collection

* backdoor

All of these do not appear on the English page so there's a link to the French one : https://fr.wikipedia.org/wiki/OnePlus#Controverses

Yep..... I'm not endorsing them per se, I'm just saying work is going on to get them to work on pmOS (and Mobian).

Which is why I hope that steam deck success. It'll open many more option for linux portable, and hopefully linux mobile based on steamos will follow through.

Steam Deck is nothing like a phone, size wise.

It's more like a small tablet, I presume. That's fine as long as more apps appears on steam os natively, and that it can also run on the mobile device.

Which model did you choose?

I'm looking at doing the same and I noticed Nokia has published the source code for the 8110 (I believe kaios runs ontop of Linux)

I'll get a small folder with decent battery life - anything that's dumb as a fencepost and fits inside my pocket. I was getting tired of carrying a large holster on my belt, anyway.

Mobile Linux is here : https://puri.sm/products/librem-5/

> where is mobile Linux when you need it?)

There's the Pinephone these days, but it's not ready for general consumption.

As my iPhone battery fades I'll be looking more and more at Pinephone.

Reply on news.ycombinator.com