Hacker News Reader

> Reject all platforms that are not fully open, and reject all devices that come with any amount of closed software or firmware.

I wish we could, but they truly have us by the balls. It is nigh impossible to participate in society without using proprietary software.

There are plenty of times however where you can choose between open and closed source, and in those cases its best to chose open and support that sort of development.

It's worth a try though to push back. We are not talking holding off a bunch of murderous Russian troops. It's not a good look trying to recall " ... and they came for me" either.

Just push back. Here's an example: Reolink are a Chinese company, what makes cameras - nothing intrinsically wrong with that but you should expect them to be be required to comply with any requirements the CCP might ... require. Reolink are also quite a savvy bunch and have gradually ensured that their products don't actually require an internet connection, at all. They do offer an app and the requirements of using the app are that the cams need to see the interwebs and be gatewayed by systems that are eventually subject to the CCP.

Now this isn't quite yet perfect. Rio cams have offered ONVIF for at least five years, so Zoneminder, Frigate and all the rest can be your NVR. The camera's VLAN can be firewalled off from the internet. Mine is called THINGS and it is net door to SEWER for stuff I really worry about!

Their doorbell offering is pretty decent but two way comms needs some handling. At the moment their app is the best bet for functionality but there are signs that Home Assistant with webrtc - https://github.com/AlexxIT/WebRTC should be OK.

It is not impossible to live without prop software. At least care and try.

> reject all devices that come with any amount of closed software or firmware.

Implementing that policy would mean not owning a mobile phone, a car, a television, microwave, or washing machine, etc.

I would love to see a world where all of those things use open source software and hardware. It would take a long time to make it a reality, but I see a path to that where more people are out there today making successful open source hardware systems and learning the parameters of how to fund them and financially maintain development.

I would too. Some of us have trouble trying to justify buying a System76 laptop etc; the anti-abuse options are usually more expensive.

(Edit: PinePhones are cheaper than I thought.)

> ...the anti-abuse options are usually more expensive.

So you can read into that, "This is how profitable it is to abuse your users."

Smart TV companies make more money selling behavioral data now than they do selling TVs. Streaming stick companies are the same. Roku basically gives hardware away at cost in exchange for the juicy data streams coming off it (their "how we sell your data" "privacy" policy is a hysterical read, they grant themselves permission to scan your network and report other devices on it should they care to).

Yeah, unfortunately that ship has sailed.

The more practical advice at the moment seems to be "don't buy anything with an internet connection if you aren't 100% OK with it tracking your every movement".

Seems like that's only going to last another year or two with 5G and shit like Amazon Sidewalk making every single device internet connected.

Now you're onto something!

And thankfully, you can still find washing machines and microwaves which don't spy on you.

Keep your old stuff people cos, soon I'm sure _everything_ will spy on you and track you!

The controllers will still be closed source even if they aren't spying.

Librem 5 smartphone runs an FSF-endorsed OS (PureOS).

>Stallman was right. You absolutely cannot trust closed source to protect the privacy of your data.

People are fully accepting of data gathering when it's out in the open. Trust doesn't have anything to do with it, people are consenting to this kind of thing openly, and when something does come out they do not care.

People are not generally consenting when given the option. See what happened to FB stock when they were forced to show the pop-up.

> Location information cannot be effectively anonymized without basically nullifying its utility.

I was under the impression that properly anonymizing location data includes aggregating a sufficient amount of individuals and the radius of this aggregation of course changes based on the population density in a given area. In with anonymized location data we can only draw conclusions on a populace and not an individual, which is still very useful.

Of course, I generally agree with you. In most cases it won't be done properly and just replacing PI with the same "anonymous" id on a set of location data points of an individual achieves next to nothing.

Why should I trust open source hardware / firmware / software?

You shouldn't just automatically trust it, but it allows you to examine what its doing and make your own informed decision about whether or not you can trust it. If you discover your data is being collected in an open source project you can, at the least, make an informed decision and give consent to it.

And while everyone won't be able to understand what they're looking at, the community as a whole would benefit from people looking at it an announcing/discussing problematic things they see in the code base.

If an open source project is syphoning data, someone's going to see it and talk about it.

If a closed project is doing it, it's harder / more complicated for that act to be discovered.

and on Github too, or some other public build mechanism. The thing of it is, is that if it's open source, but the binaries are built privately, there's no guarantee that the binary actually came from the source that's been presented.

But how can I trust “the community”? I don’t know them. I don’t know their capabilities, nor do I have any say in what they check: whether it’s complete, or accurate; whether the software has been compromised since the last time the community checked; or whether they did the checking they said at all.

Because you can inspect the code and rebuild it to generate the same binaries.

"same". I haven't been following progress with reproducible builds, it that actually possible today?

That depends on the App / platform combo, but for some key comms applications (Signal, for instance) this is possible.