Hacker News Reader

Comment by DanWritesCode | Hacker News Reader

One of the things I really didn't expect to be Googling in 2021 is 'Best dumb phone 2021'.

After advocating to all my friends that Apple is a beacon of how privacy should be done, I just can't understand how they've made such a hash of this.

View on HN

Why a dumb phone if you have a verifiable FLOSS GNU/Linux phone in 2021, Librem 5 or Pinephone?

Have any wireless providers verified that Firmware/OS/App updates can't be pushed via OTA to those devices? Asking because to my knowledge no such verification has been attempted. Background: I used to push firmware updates to phones in the 90's on a GSM network. The only reason we didn't do this globally was risk of customer support issues.

Both phones have their modems separated from the OS with USB/M.2 interfaces. Also, they have kill switches. Pinephone's modem even runs Linux: https://linuxsmartphones.com/hackers-develop-open-source-fir....

I understand what you are saying, but in my opinion that doesn't really answer the question. For a phone to attach to a network, there is some level of bidirectional trust and those kill-switches aren't going to just arbitrarily activate. Has anyone at a wireless provider tested pushing OTA updates to those phones? Has the vendor explicitly stated that the phones will explicitly block by default any attempts at OTA updates or that the phones explicitly do not have the capability?

I don't think any vendor confirmed that. But is this possible to update software on my device without permission by its OS via a well-defined external interface? These phones are desktop computers running GNU/Linux. If they can be updated this way, then my laptop can as well be updated by a WiFi card, can't it? (I don't think so)

Upd: I am not an expert, but maybe the schematics could help you here: https://source.puri.sm/Librem5/l5-schematic and https://wiki.pine64.org/index.php/PinePhone#PinePhone_board_....

I suppose it depends on what standards each of these Linux phone implementations have followed. Android also runs Linux, but they modified it to give the wireless providers and Google full control, hence people wanting to root their phones. Just running Linux is not enough to give me confidence that the phone is truly isolated from network management. So I suppose it comes down to what kernel modules, libraries and trust these phones are giving to the provider and what standards they are following. A good start would be independent kernel hackers digging into the hardware and OS to see what they can make the phone do and what they see the phone doing under normal operations when attaching to the network and how the phone responds to OTA update attempts and what the firmware on the phone is doing. If I control the firmware and you control the OS, I control what your OS can read and write to. So I suppose my unanswered questions are:

- Who writes and maintains the firmware the OS is running on.

- Who writes and maintains the modem firmware and who can update it.

- Who can update that firmware for the board the OS is running on. This could be a different answer than who initially creates it for the retail distribution of the phone.

- What level of trust has been inserted into the OS by kernel modules and who maintains those kernel modules.

- What control is given to the end user to see what those modules are doing and limit what they can do.

I suspect more questions could arise as kernel hackers audited the phone. The dilemma I see is that such kernel hackers won't be interested until those phones are wildly popular. The only other way to get their interest is with money.

> Who writes and maintains the firmware the OS is running on

Both Librem 5 and Pinephone run FLOSS operating systems with software maintained by Purism and community. The latter smartphone has two firmware blobs in kernel for WiFi/Bluetooth AFAIK: https://www.pine64.org/2020/01/24/setting-the-record-straigh....

> Who writes and maintains the modem firmware and who can update it.

See my link above concerning the Pinephone modem. It's software can be updated by the OS. AFAIK it's the same for Librem 5.

> Who can update that firmware for the board the OS is running on.

See the first answer. Librem 5 is going to get FSF certification "Respects Your Freedom". Proprietary software only runs on the modem and WiFi card. See also: https://puri.sm/posts/librem5-solving-the-first-fsf-ryf-hurd....

> What level of trust has been inserted into the OS by kernel modules and who maintains those kernel modules.

I am not knowledgeable enough to answer that. Maybe the schematics linked above could help you.

> What control is given to the end user to see what those modules are doing and limit what they can do.

User has full control. This is a selling point of Purism the company: https://source.puri.sm/Librem5/community-wiki/-/wikis/Freque...

Starting to suspect that a trillion dollar corporation is more interested in profits than fighting for the little guy?

Reply on news.ycombinator.com