Comment by oneplane | Hacker News Reader

Comment by oneplane | Hacker News Reader

Parent Full thread

There is almost no point in buying an ecosystem-dependant device and then trying to cut off the ecosystem dependency. This goes for iOS and Android alike.

In some ways, even cellular connectivity itself is problematic or any baseband system that requires some form of out-of-band processing to function (even if it doesn't "call home").

Most people won't know (or care) about any of this anyway, and the disruption trade for some invisible gains that are supposed to come out of unplugging like this isn't likely to attract any reasonable mass of users to do it. It would probably be mostly destructive anyway considering the information flow of civilisation depends on so much of this integration now.

Technically we could do without all of this, but practically it would be luddite's errand to try and do any this.

I wonder what we could do instead, but considering the min-maxing for profit sets the stage today, I doubt someone can come up with an alternative that yields the same (perceived) benefit from using Google's or Apple's technologies.

Considering most new people from the past few years are primarily mobile users and a lot of those never even had access to (or a need for) a desktop-like type computing, there is very little mindshare about what else might be possible in the digital realm.

> There is almost no point in buying an ecosystem-dependant device and then trying to cut off the ecosystem dependency

Android works fine without the Google bits. Make sure to get a device which is supported by an AOSP-derived distribution like LineageOS and you're almost there. Install the alternative distribution, do not install any Google services (i.e. skip the 'gapps' or Google apps), install F-droid or Aurora Droid, done - you'll end up with a device running free software (apart from the radio firmware and any driver blobs used in building the distribution). If you need software from the play store there is Aurora Store, an alternative front-end which can be used without a Google account. If some of that software needs access to the Google Services Framework (indicated in the listing as 'gsf-dependent' or something along those lines) you can install microG, an in-progress but remarkably functional free software implementation of such.

I've been doing this for about 10 years now and never had the impression I missed out on anything by not using a stock distribution with a Google account - the opposite is true. Batteries last longer since there is less background activity, devices have a far longer useable life span by virtue of the distribution being kept up to date.

I bought a Pixel 2 XL brand new from Amazon for $140 two weeks ago and installed LineageOS 18.1 (Android 11) and using F-Droid and Aurora Store. I ended up reflashing to LineageOS with MicroG to get one stubborn app to function properly but it is a fast, functional, and a significantly more private experience for a budget price and about an hour or two of work.

Did the same with my old Pixel 2, just put CalxyOS on it. Personally, while ecosystems are quite convenient, I am really fed up with what they became. All I want is an OS that gets critical updates, but other wise just runs without any strings attached on hardware I own. Give my good mobile websites and a privacy-oriented browser for everything else. I guess big-tech just won't be able to make a living in such a world...

According to the article, you can also reduce the vast majority of Google communication by disabling all Google apps and services. You need a phone that allows that (I have a Fairphone 2). Not as watertight as LineageOS, but easier for most people, at least for me. Then indeed use F-Droid and the occasional app from sources you trust via Aurora Store. Very usable as a main phone.

Yes. This is the best story now for a somewhat feature packed privacy respecting phone. The other options like Purism's Librem are not there yet.

Want to go one step further: use a laptop which you connect to the internet over burner phone's tethered internet connection, using a self-hosted VPN or Tor.

> There is almost no point in buying an ecosystem-dependant device and then trying to cut off the ecosystem dependency.

I mean, your work could be dependent on an embedded appliance from an enterprise vendor, where that 'appliance' just consists of an app running on an iPad in kiosk mode sealed into an ugly case, with its lightning port hard-wired to a particular accessory.

If you're an IT admin of an organization and you have to support an appliance like this within your Intranet, it's in your best interests to lock it down from doing anything other than "its job as an appliance." For the same reason you wouldn't leave any ports open on a machine/VM other than the ones it needs to perform its function.

Apple MDM almost certainly requires some connection to 17/8 (or 2620:149::/32 ) to function, even with a 3p mdm server, at least for the CRL download.

So what?

$appliance does not require mdm

So how are you locking it down? Are you going to sit there and put the iPad in supervised mode by hand? Maybe sideload your specialised kiosk software onto it by hand? Periodically check in on it to make sure it’s up to date and all of its configuration is as you left it?

This is a solution that doesn’t scale, and any IT admin supporting more than a handful of Apple devices in their network should look at MDM.

> Maybe sideload your specialised kiosk software onto it by hand?

In this case I was suggesting that you have a vendor upstream of you doing this, where you then take receipt of a system (e.g. a POS system) of which an "embedded" iPad is a one component, and is a black box, perhaps even epoxied into an enclosure.

In such a case, you literally cannot do anything to the iPad. It's locked down into its kiosk application, and getting admin access to it would require taking the system it's a part of apart to a degree that would void your warranty with the vendor.

Instead, the only thing you can alter, is the network the iPad connects to.

> There is almost no point in buying an ecosystem-dependant device and then trying to cut off the ecosystem dependency.

...the only alternative right now is throwing cash at a librem5 and there's still plenty of work until it's feasible for a linux phone as a daily driver.

There's also Jolla Sailfish (descendant of Nokia Maemo/Meego, funded by Russia) which works on Sony Xperia 10 II. The free version doesn't support Android apps. The paid version does, but is technically only sold to EU customers.

Looking further ahead, Pinephone development is active.

To clarify you should say: Nowadays funded by Russia, it hasn't been always like that.

The question of course is whether they do anything equally bad as either Google/Apple or the NSA. It looks obvious to me that Russia funds this because they don't want the former inside their devices.

Trying to run their own mass surveillance using Sailfish wou be pretty much a waste of resources. There are no masses that use it and the Russian opposition could easily avoid touching such device. However, in typical Stalin/KGB/Putin-style paranoia you would want to eavesdrop your friends to make sure they don't work against you. So that is somewhat worrying.

Disclaimer: Typed on a Sailfish device.

> There is almost no point in buying an ecosystem-dependant device and then trying to cut off the ecosystem dependency.

The point of using an "ecosystem" is positive network effects, in the case of iOS it means a pool of shared-risk protection against common attacks, and a business model which yielded a huge app ecosystem, a.k.a front-end clients for web services. The greater those positive effects, the greater the incentive to mitigate the negative effects. Some are provided by Apple's obscure combinations of on-device Settings, device policy that is only configurable with Apple Configurator, or enterprise MDM policy.

It is unnecessary that such mitigations be employed by "most people", they only need to pass a cost-benefit analysis for those who use them. E.g. many iOS remote attacks can be mitigated by disabling Javascript, yet there has not been an option for per-site whitelisting of JS in Safari. Brave on iOS (reskin of Safari) provides this policy with one-click per site and now Apple allows Brave to be the system-wide default, possibly due to antitrust/EU/legal pressure. iOS 15 has added web extensions, which are already transforming the web experience.

It could be argued that if more people used "surveillance escape valves", there could be pressure to close them. The bigger the ecosystem, the more incentives there are to jump through hoops to gain benefits and mitigate risks. It's an ongoing negotiation, not blind surrender, even if the balance of power begins with asymmetry. E.g. people may start using Brave on iOS because it blocks Youtube interstitial video ads, allowing free access to the network effects of the YT ecosystem without paying a monthly fee. But once they are using Brave, JS security protections are one click away. The pendulum swings back and forth.

From 2012, https://www.zdnet.com/article/president-obamas-top-secret-ip...

> The president is getting his daily intelligence briefing on an iPad. Ten years ago we wouldn't have done that, but that's what the president wants, so that's what he gets. Now, that iPad is neutered-it has no connectivity. It gets plugged into a docking station. We can do that for the president, but can we can't scale that. So the question is, can we use commercial products that are secure?" said Levine.

> It is unnecessary that such mitigations be employed by "most people", they only need to pass a cost-benefit analysis for those who use them.

This can be said for pretty much any technology/software/hardware/mitigation that some people dismiss out of hand…

> It could be argued that if more people used "surveillance escape valves", there could be pressure to close them.

I would even go one step further and argue that our devices should actively send spoofed data (not necessarily random) and poison the data wells these companies like to drink from to amass their power they wield asymmetrically at scale against individuals.

Open bootloaders and proper open-source projects.

I think GrapheneOS provides a maximally usable experience with maximal control over your device.

Unfortunately linux phones are nowhere near the polish of Android forks, and let’s be honest - hardware-wise a 3-4 years old phone mid-level android hardware is a minimum.

Reply on news.ycombinator.com