Hacker News Reader

Comment by z3t4 | Hacker News Reader

Nokia had Linux on their smartphone until Microsoft bought them and stopped everything, they even shut down the app store. The OS was called MeeGo. Part of the Nokia team however started their own company called Jolla and still produce smartphones running Linux, they call their OS Sailfish. (ignoring the fact that Android also uses the Linux kernel).

The problem with alternative phone OS:es is that in the country I live you must have either an iPhone or and Android phone because the ID monopoly and Payment monopoly refuse to support other operating systems...

View on HN

Just a datapoint: UK banking apps work perfectly on my Sailfish phone.

Jolla's Android emulation is unreasonably excellent, one of their technological gems. If other Linux devices ever lift off, this will be one of the killer features that Jolla can license out. (And why not? I'm absolutely in favor of vendors selling Linux software.)

As for Sailfish - it still offers the best, most consistent, simplest UI/UX of any currently available mobile device.

Edit: and I don't have to root my phone. I can SSH into it (or use the included terminal emulator with my Bluetooth keyboard) and I have access to the full Linux filesystem. For app development, there are no hoops to jump through (like Apple's developer license).

Mobile Linux is already here, and it works!

Indeed, one of the amazing things would be if Android apps could be individually sandboxed on a Jolla (or other Linux) phone. Like each app would "think" it's running on a clean phone with absolutely nothing else on it.

So they could be completely blocked from accessing hardware I don't want them to (e.g. location) and communicating with other apps. Right now Android is way too open, every app can see what other app is on my device if I so much as need to share 1 photo.

Anbox and Waydroid

Adding to the banking data points: I have an Xperia 10 II running Sailfish. MobileBankID and Swish (Sweden) as well as the ING Banking app (Germany) work on it.

I was pleasantly surprised by that. I upgraded from an Xperia X, where Sailfish had the old Android 4.4-compatible runtime and nothing worked. I kept an Android phone around, just for these three apps. As that one was also getting old in terms of OS (Android 7) and security updates, I'm very happy to no longer need it.

I have however come across Android Apps that don't work: - Betala P (Parking app for Stockholm, no clue why this doesn't work) - OI.Share (for remote-controlling OM-D cameras. I assume it has to do with it trying to control the WiFi on the phone)

what phone do you use?

Sony Xperia XA2

good to know it's friendly to sailfish

More info (and more devices) here: https://shop.jolla.com/

Just a warning with that one - if you unlock it, it will never receive another Sony OTA, and there's no re-locking. Probably less of a problem now that it's out of support. Sailfish was also really rough on it.

It's long out of support from Sony but still runs the very latest LineageOS, Sailfish etc. And it was one of the very few officially supported sailfish phones, sailfish is just a bit rough itself :)

It's pretty decent hardware, mine still lasts 2 weeks on standby. Granted, I don't do much with it, I just use it to test out new lineage updates. No SIM in it. But it does receive some push messages through MicroG. I'm surprised how well it aged.

Not a fan of its hardware design though, with its overcomplicated ridges, seams and edges.

"the ID monopoly and Payment monopoly refuse to support other operating systems"

This is my issue. I am commonly hearing people ask "What are you, iOS or Android?" - IE as if it is inherent to the person themselves and there are only two choices.

This is scary. I love the idea of having an alternative to iOS and Android. But I also need to function within society. This shouldn't be a choice.

Even a non-popular Android isn't a choice for govmt e-id.

I use a hardened Android distro (GrapheneOS) on my phone. Even with a locked bootloader and no root my countries (austria) e-government app and my banking app blocks me due to a "integrity check" failing.

I would guess it is because GrapheneOS does not pass the Google "SafteyNet" check. The Android distros that are more well known do not pass by default due to Google coming after them if they do. LineageOS has not passed it for the last few years.

There are pretty simple patches you can apply though to get it passing, assuming nothing else about the phone triggers it.

I don't even have the Google Services installed on my phone because I consider them a security and privacy risk.

For now I can use my computer, because they fortunately also have a website, but I could see in the near-future that you have to have this app installed.

Well that is the failure. If you don't give data to Google ( or Apple, or MS etc) you are considered by them as "a security and privacy risk.". Their privacy and security is at risk.

You can run google services in a sandbox on grapheneos for only select programs.

I would like to get a Pixel with GrapheneOS for my next phone but this is holding me back. Even if some of my banking apps are currently reported to work, there is no guarantee they won't break in future. It's too risky for me unfortunately, which is annoying.

I would love grapheneOS on some better hardware - I didn’t want to sacrifice on that, so I went with an iphone which have a similarly good security-story.

Fortunately, we don't have the government handing out free handset so opting out is still a legal right and a practically realistic option. My concern is that if few enough people do so, this will no longer be the case for long.

Is it though? Not long ago many European countries required some form of digital COVID pass for travel.

Likewise for doing taxes e.g. here in Sweden BankID and Kivra are practically required unless you want to be waiting weeks for letters and queueing at the office.

>Not long ago many European countries required some form of digital COVID pass for travel.

no they didn't? you could just access the platform on your computer and print the QR code the old fashioned way. Hell, you could do that without even having any electronics, you could just go to the library and print it there.

>unless you want to be waiting weeks for letters and queueing at the office.

this reads to me as "if you don't use these digital systems you have to do things like they were before digital systems"

> "if you don't use these digital systems you have to do things like they were before digital systems"

There's also the expectation from society. Even getting that covid shot was hard without an app, to the point of an extra long queue where nothing worked and in the end a lady told me sternly that I shouldn't be there and to get with the times and that I am young enough to be able to use a smartphone. As if that was the problem ...

That was just covid. Doing (non-trivial) taxes on paper involves some calculation, and I am liable if I get it wrong, whereas I know the web page does all calculations the right way.

Then there's school reports, public transportation, public libraries, calling in sick to work, taking out pension, the list is long and every single step of it is an inconvenience constantly reminding me to just stick with the non-free, mainstream, controlled by a private company, way.

> this reads to me as "if you don't use these digital systems you have to do things like they were before digital systems"

You missed the part where they might actually prefer to use digital systems but would only be able to so by delegating their identity to a trusted and locked down iOS or Android+SafetyNet device. Other comments seem to indicate that this is not a strict requirement for filing your taxes digitally where GP is at, but that's beside the point of your comment.

True, I printed mine on credit card format and laminated it, it was in my card wallet. Much faster than opening an app every time and zero tracking, at least on my side.

Glad we're rid of that though.

I am quite confident that this wouldn't be allowed if there wasn't so many seniors without smartphones though

Last time I tried (granted, years ago), BankID was still relatively straight-forward to set up and use on a PC. Not all sites support the flow, though.

Authorities should also still accept alternatives like Freja (if there's anything they won't close the door on it's making it straightforward to pay your taxes, I guess).

I'm far from happy wit the situation and would prefer that authorities take an open standards-approach compatible with FLOSS. But it's also not as terrible as it may seem at first.

But is it straight-forward to set up on any PC, or just those locked down with proprietary single vendor controlled software?

In the latter case, it is not in any way better than a proprietary phone. In practice probably worse, since it is easier and cheaper to keep an extra phone around.

Was running it fine on Linux IIRC (maybe look it up if you're actually interested?), but again, long time ago so things may have changed.

EDIT: Things seem to have deteriorated quite a bit and no major improvement in sight. Maybe not a surprise.

https://www.monperrus.net/martin/bankid-linux

https://www.sweclockers.com/forum/trad/1592956-bankid-pa-lin...

You could've gotten the QR-Code on a piece of paper, without a phone (which still is ridiculous that they forced people to use some random QR-Code and ignored the internationally accepted vaccination card of the WHO)

The crazy thing was during COVID everyone seemed to launch an app - iOS or Android.

What happened to websites? Did they suddenly become impossible to secure or communicate with?

Don't remind me. I tried to fight it for a decade. I was mad. MAD.

We are being actively PUSHED into this shit and almost everyone seems to be totally fine with it. They are herding us into complete obedience. A phone is more secure because when you install their apps, they can monitor everything you do. Banking? Mobile. Document signing? Mobile. Toilet paper? Mobile.

I am making a bet here: buy the end of the decade, every EU citizen will be directly required to go either Android or Apple. Two platforms under complete European control.

Frankly, I blame the masses for falling for it. It's always the masses. Once the cabal swoops in the vast majority, the rest is taken care of by society itself.

Indeed, it's becoming hard to avoid it.

Here in Spain we have the problem of this interpersonal payment system called "Bizum". It's like a local paypal but owned by the banks. So many people use it that it can't be avoided.

But my bank (and others too) only offer this functionality in their mobile app, not on their website. So if you need to use it you're really forced to use the mobile app.

In my case I have an old iPod Touch which I use only for this, nothing else. It works ok. But I wish I could just use it from the website from whatever device I want.

I have a dumb phone (Nokia 8110 4G) that I wouldn't trade with the latest iOS/Android model, and during Covid restrictions I downloaded and printed the pass at home with no problems. I also pay a small fee to my bank so I can keep using SMSs for transaction confirmations instead of surrendering to their app. Also using SMSs with PayPal and a few other online services. The day they force me to use smartphones which, privacy aside, to me are next to unusable crap, to do things I can easily do on a PC, is the day I'm retiring to a technology-free place for the rest of my life.

EU regulations now forbid SMS-based authentication. I tried explaining to the bank clerk several times how I am not using the Google Play Store but it was only when I held my Nokia "dumb phone" in their face that they gave me a hardware token generator (for free actually!).

For context, I use a Nokia 8110 and a LineageOS device.

The sales pitch is that you get to "own" the customer, in the sense that you have more control over the user experience. Fewer ad blockers, notifications to keep the user "engaged" etc. With more control over the device there is also the potential of easier support. There are plenty metrics collected so there is data to show that all these are true.

But all this is now inherent to the market. The few agencies who didn't offer apps went mostly out of business. So nobody needs to know why they want it anymore, it's just what is being offered and the world moves on.

The open web may prove to be a historical curiosity. Just like personal universal turing machines. The jury is still out, hopefully there will be a movement back in our lifetimes.

Curiously, most of these apps are web-based anyway, just wrapped inside an app.

This is a case where I want to mention Austria as a positive example: The vaccination certificate app is open source on Github, so you can compile it yourself and not need to use the Play Store.

Well, in a way it is inherent. There is simply no place for a third competitor, as developing for even just 2 platforms is already the max a company would be willing to do.

That’s why even Microsoft would a ridiculously huge budget failed, the market is simply saturated. The only way a new competitor could stand up is 100% compatibility with one of the platform’s app selection or a non-profit, open-source model.

So linux phones with android comp may indeed have a future, but I think they should pretty much just ditch most of the existing linux desktop user space as it is fundamentally flawed (mostly security-wise), but then we are back to android and it begs the question, why reinvent the wheel instead of just fixing the few shortcomings of android, like too close coupling with google?

If anything, we need better hardware, not software — grapheneOS is pretty much ideal as a linux/android OS.

Even if you use Android, using a custom ROM locks you out of your SIM based electronic signature, which is a showstopper for my case.

> "What are you, iOS or Android?" - IE as if it is inherent to the person themselves and there are only two choices.

in practice there are only two choices, it's called a duopoly and most people know it.

The bit that scares me is the practice also becoming the theory too.

iOS or Android is a false dichotomy.

I run a b2b tech company from Silicon Valley and do not have a phone at all. I carry cash, plastic ID, a paper vaccine card, etc.

Restaurants push QR codes in my face and I explain I do not own a phone, and they never fail to produce a paper menu somehow. Restaurants that default to paper menus are generally classier and get more of my business anyway.

I arrange to meet people at places and show up on time. I navigate by writing down directions and paying attention to my surroundings.

A couple times I have had trouble with concerts not wanting to let me in without some nonsense ticket app. I go to the will call booth, explain I do not have a phone. They find a way to print me passes every time.

I function in society just fine.

Do not let people discriminate against you for what software you wish to use, or not use. Nothing in our constitution mandates you accept the terms of service of Apple or Google.

I took a real interest in 6 or 7 years ago, when it was first coming out. I was excited in part by how much it (as a downstream project of MeeGo) resembled Real Linux™ internally: systemd, RPM/zypper, Wayland.

It was awesome. The way it all fit together felt thoughtful and sane. The terminal environment was like a real desktop Linux userland. And the Sailfish UI was really outstanding. It was simple, uniform, and thoroughly gesture-based. That stuff felt decidedly ahead of Android and iOS at the time.

But it's basically been impossible since then to get it on flagship or even just relatively recent hardware, and getting it distributed with the unfortunate but crucial Android app runtime has been very hard to do since it's only available on commercial distributions.

It's never felt like a real option for me, at least in the US. Since I followed it more closely, I don't know where the project stands. Last I heard, they were pivoting to other markets (developing economies, business/enterprise use) that made it seem unlikely I'd ever get to have a decent Sailfish experience.

I've been running Sailfish OS since they launched. Currently I do it on a Sony Xperia 10 III. It does all the things expected of a phone.

I also got the first Jolla phone, but I had a different experience. I found it somewhat unintuitive to use (lots of misswipes, and unclear what you could swipe and when), but my main gripe was the UI style. It was a disappointment after the absolutely gorgeous Meego UI in N9.

I used it for two weeks, switched to Android, and started learning Android development.

I probably started with unrealistic expectations, and I obviously don't want to belittle their work, but I think there are good reasons it flopped even in it's native market in Finland after the early excitement.

In any case it was a small miracle that such a small company managed to create and ship an independent Linux smartphone with their completely own UI to general public, with a full set of basic requirements from a browser and app store to a calculator and email app. An amazing feat.

Interesting, to this day I remember the Jolla as the only phone I ever had that I actively enjoyed using

Sailfish could have been great, but Jolla apparently tried to overextend themselves making hardware and software for their products and almost died trying. It's a shame because the Jolla phone had a swappable back part and could have things like a slideout keyboard that looked really sweet. Now they're on the enterprise and government contracting grind and market their OS on their site with all the bs enterprisey jargon, with Sailfish as a community/open-source driven project being mostly an afterthought. They also have a very limited number of devices that can run android compatibility, and you need to pay for a license.

It's a shame because their UI is the only decent thing in the world of Linux phones that isn't an utter travesty that just tries to bend the Linux desktop into being a "mobile OS" that runs like absolute shit and feels really awkward to use. But the UI on Sailfish is of course the proprietary parts aside from the android emulation.

You can still buy a supported Sony Open Devices phone ( https://static.developer.sony.com/develop/open-devices/get-s... ) and a Jolla license ( https://shop.jolla.com/ ) to install the OS on it just like we do with desktop / laptop computers.

Gnome 3 on a phone is actually quite nice.

Do you mean phosh? As far as I know it is written from scratch, not based on gnome, only in design.

>Nokia had Linux on their smartphone until Microsoft bought them and stopped everything, they even shut down the app store. The OS was called MeeGo.

There is a fork called Maemo Leste [0][1] that is actually still around and updated. I have it running on a droid 4, and it works pretty well. The UI is still the same Hildon UI. Definitely a fun OS and device to play around with, and interesting in that it's the only mobile OS I'm aware of that is running Devaun.

[0] https://maemo-leste.github.io/

[1] Technically a fork of Maemo, the predecessor to MeeGo.

Even just unlocking an Android device causes most to stop working. I can't even log into PayPal app, which I assume is mostly just a WebView, because my phone is unlocked. At the same time it is apparently fineI do the same thing from the browser on my phone?

I used an Android phone with CalyxOS and microG for a year and never had this problem. There were a few apps I had a hard time getting APKs for without the Play Store, but even those I found I could side load from other devices that had the Play Store.

Or just use Aurora store!

You dont have this problem because CalyxOS has a workaround for SafetyNet, i hear its pretty hacky, but it works.

The workaround is from microG. You can get it on lineage-microg too.

It has a bad name but really all that they do is replace Google's signing certificate with their own and change the OS to accept it. It's not that "hacky" IMO, you're just trusting a different party. It's just like when you install Ubuntu, you trust Canonical to sign your packages, not debian. They use the same thing to replace play services. And if you trusted Google you wouldn't be using microG anyways, you'd just use play services.

The reason it gets a bad rap is because of the risk MicroG's signing key gets stolen. This is obviously higher than the risk of this happening for Google which is definitely in some highly protected HSM vault somewhere. True. Personally if I were a MicroG developer I'd keep it on a smartcard somewhere like a yubikey so it couldn't be easily copied. I don't know if they do this.

On the other hand, there is more you need to do to exploit it, even if you have the signing key. You need to get the user to use some malicious software and get it on F-Droid or something undetected. Just having the private key will not net you anything.

In my point of view you're trading a definitely possible but difficult possibility of a hack, for a total certainty that Google will track you every hour of every day. Personally I don't trust my smartphone with that much information anyway, but Google manages to collect so much because of their extended network. So they're able to extract much more info from my smartphone than I put into it by association. So it's an ok tradeoff for me. Everyone needs to make their own judgement on that.

For that reason I don't use banking apps on my mobile anyway and I don't have a need for SafetyNet as a result.But it's nice to know that there is a possibility to use SafetyNet protected apps in some cases if I want (some detect the workaround I believe).

No, that's not the work around I meant.

I meant the workaround CTSPROFILEMATCH in safety net, its what makes most Payment providers work on CalyxOS.

As for MicroG, the GrapheneOS way of running unrootful GSM seems interesting, but they won't apply the Safetynet workaround, because its "hacky" and won't last when hardware attention is enforced.

This flows with most of GrapheneOS stances, they dont care about convenience much.

Personally I'm already close to my limit due to how many inconveniences I have for using a work profile and a custom ROM, and I dont want more.

There are some APKs that aren't available on Aurora.

Custom ROMs/patches can be made hide that the phone is unlocked and fake that it passes SafetyNet, even if you use official Play Services it's just ridiculous it's something that needs to be done in the first place.

If you rooted it via Magisk, the DenyList feature and the module "Universal SafetyNet Fix" should help you out [0]. If you're running a custom firmware, you might need to resort to patching the device properties [1].

Still, it's utterly absurd how many apps go to extremely long lengths just to tell me they don't like me having root access to my own f..ing phone, including Samsung's Watch interface app. The only situation where I can at least understand the reasons are DRM and cheaters in f2p games.

[0] https://github.com/kdrag0n/safetynet-fix

[1] https://github.com/Magisk-Modules-Repo/MagiskHidePropsConf

> At the same time it is apparently fineI do the same thing from the browser on my phone?

It's "fine" only because the banks security cargo cult couldn't find a way to own your device without losing money. Now they found it and they're not giving up their checklists to make your life better.

> The problem with alternative phone OS:es is that in the country I live you must have either an iPhone or and Android phone because the ID monopoly and Payment monopoly refuse to support other operating systems...

In theory its possible to run a user-land Android subsystem on Linux (and thus on Linux phones) via Anbox or Waydroid.

In practice, I've never tried this on my PinePhone since I never needed it, so I have no idea how well this works or of it works at all.

[1] https://anbox.io/

[2] https://github.com/waydroid/waydroid

I could get by with only using banking websites in the browser. But Why does Jolla not yet support any Pixel phones? I have wanted to try it out for years, but not to the point of trying to make things work on my own.

Probably because Google does not have an equivalent program to the https://opendevices.ix5.org/ that Sony has.

I don't buy that at all. That is an awesome program that I did not know about. However, they also support Gemini PDA, which is only one of Planet computers devices. And Pixels are well-known to be the among easiest to flash devices out there, and there is no shortage of third party ROMs available for them. From what I read on the SF forums, it's a sort of google boycott despite the fact that flashing a rom gets rid of the google in a pixel.

https://forum.sailfishos.org/t/any-chance-of-non-sony-phones...

Further, look at the list of devices they work on - not at all a list of phones easier to flash than a pixel.

https://wiki.merproject.org/wiki/Adaptations/libhybris

There seems to be a lot of politics in their forums (and their past funding), something that does not interest me in an OS project.

I was offering you the reason why there is no "official" support for Google Pixels, not why there aren't community ports. :)

Right, but I offered you a counter-example in the Gemini PDA, and an indication that there was generally no effort - or positive resistance - to deal with anything google related at all.

I remember Gemini and Jolla had a mutual agreement[1] to put Sailfish OS on the device.

[1] Started from here: https://twitter.com/JollaHQ/status/1100036246754213894

Carry plastic ID. Carry cash.

I do not know any first world country that has a constitution that requires you accept the terms of service of Apple or Google to function as a citizen.

Reply on news.ycombinator.com