Hacker News Reader

Comment by matheusmoreira | Hacker News Reader

> The difference is that an app can detect if it has been sideloaded, and the app developer can decide how to respond to that.

I don't want the app developer to have that power. The developer does not get to subvert my control. If I want to make the app believe it's running on a stock phone, that's what it should believe, and that's what it will believe.

It's my machine. What the developer wants or doesn't want is completely irrelevant to me. Only what I want matters. They should count themselves lucky if I trust them enough to allow their software to run without poking at its innards to see what it's really doing.

> The decision to use that is on the developer

Every developer making apps for a proprietary app store will make the decision to use remote attestation. It's a power struggle. They want to own our computers.

View on HN

> their software despite the rhetoric of this world filled with DRM, I believe your copy of a program belongs to you. :)

that is why i use Free Software and Open Source applications. quibbling about this detail (not your comment but the discussion as a whole) is not going to change the fact that only FOSS lets us own our computers ourselves.

Free software is a mirage. It's an illusion.

I am committed to developing all of my projects as AGPLv3 free software. However, the fact that I even get to do this at all is something of a miracle. Governments don't generally allow non-engineers to erect big buildings. So why is it that we get to make software at home?

Individuals developing software is a deeply subversive action. It heavily contributed to the democratization of cryptography. The publication of PGP source code as a book defeated the US government's attempt to keep the cryptography to itself. Someone writes a little software called bittorrent and it threatens to wipe out entire industries, wipe out entire classes of business model. Somebody invents a bitcoin thing and now US presidential candidates speak of strategic bitcoin reserves. Somebody invents stable diffusion... We're all living to see the aftermath of that. It's hard to describe just how powerful and subversive computers are. Computers can literally reshape society.

It's all enabled by free computers. General purpose processors which run the code you input into them, no questions asked. And what we are witnessing here is the destruction of those free computers. For the sake of corporate interests. The computer is not free anymore. It only runs the code the corporation allows it to run. Because if it could run the set of all programs, it means it could run code that negatively impacts the corporation's profits. Their solution is to allow execution of the programs the corporations like and nothing else. Could be worse I guess. It might have been the government making that decision. Perhaps one day it will be.

Software freedom is not the same thing as computing freedom. There cannot be free and open source software without free computers. Focusing on free software as a solution to this is missing the forest for the trees. There is no point whatsoever to free software which we can't run, free software which can't interface with the services we need, free software which gets us ostracized. Our free computers are being increasingly labeled as "untrusted" and excluded from networks and services.

We need home computer fabrication technology so that we can make the computers themselves in our homes. Our own free hardware designs, one hundred percent free from their control, fabricated by ourselves.

But more than anything, we need to enshrine computing freedom into actual law. It should be illegal for them to lock our computers down. It should be illegal for them to refuse to interoperate with non-locked down computers. Anything short of this means free software has no future.

Governments don't generally allow non-engineers to erect big buildings. So why is it that we get to make software at home?

this argument gets repeated over and over, and i really hate it. making software is not building a house or a bridge. and i can build my own house. i just need to follow some rules. i can also construct my own car from scratch. again, just need to follow some rules and pass a few tests to see if the car is considered streetworthy. otherwise i can still use it on my private property as much as i want. same goes for software. if a company uses my software in a dangerous setting, (like someone using my unlicensed car on a public road) it is their problem not mine.

Individuals developing software is a deeply subversive action

sorry, what?? i have never heard something so preposterous. is DIY anything at home subversive too?

The computer is not free anymore

yet at the same time we are reaching the capacity to build our own computers from scratch. and if the trend continues, we will have to.

There cannot be free and open source software without free computers

so far general purpose devices are still free enough to be usable. but i agree with your point. see above. eventually we may just as well have to build our own computers.

Our free computers are being increasingly labeled as "untrusted" and excluded from networks and services

we can build our own networks too. and we are. see freifunk and other projects. services is another issue, but so far most of those still allow offline solutions, or i will be able to use them with an isolated device independent from my home built general purpose computer.

We need home computer fabrication technology so that we can make the computers themselves in our homes.

it's already happening. and it will grow as the cost for that goes down.

But more than anything, we need to enshrine computing freedom into actual law

now that is a completely different argument, but also one i agree with.

Anything short of this means free software has no future

i would not go that far yet, but depending on how you look at it and how things develop you may be right, or not. i hope not.

> sorry, what?? i have never heard something so preposterous.

It's not preposterous at all. It's the truth.

Computers are world-changing technology. Citizens having access to unrestricted computers is something corporations and governments cannot and will not tolerate. Google hates it so much they added hardware remote attestation to Android devices.

Computer freedom means we can subvert their silly "integrity checks" and do whatever we want. It means we can run uBlock Origin to kill their advertising and run things like yt-dlp to download their content and keep it forever. They won't tolerate that.

> so far general purpose devices are still free enough to be usable.

Not according to the FSF. You simply cannot find a computer today that does not require you to load some signed proprietary blob onto some chip somewhere. For that you need a CPU that must be like 20 years old by now.

We do not drive our computers anymore. The entire operating system turned into the "user OS" that gets sandboxed away from the real action. It's just user code talking to the proprietary code via some kind of hardware API.

https://youtu.be/36myc8wQhLo

Just look at the sad state of our operating systems. Safely tucked away into some corner, completely oblivious to all the other computers around it. All that hardware running signed proprietary code you cannot control or modify. How did things get like this?

I've pretty much given up on that. By this point I just want IOMMUs so I can isolate all those other computers and try to limit the access they have to what's supposed to be my system. I think it's pretty screwed up that my power as the owner of the machine has been reduced to this.

> we can build our own networks too

You cannot. Not successfully. If you try, you'll find that anti-money laundering laws, know your customer laws, anti-terrorism laws, all sorts of laws will compel you to become what you sought to avoid in the first place. The government got around limitations on surveillance by privatizing it. They will make you surveil in its stead, and if you fail to do so they will blame you for anything wrong that happens in your network. Either you surveil and rat out your users, or you go to jail instead of them.

> it's already happening. and it will grow as the cost for that goes down.

I hope you're right. I really do.

You don't have to use apps that you don't like, do you?

Use apps that respect your privacy and are open source. For example FairMail developer recommend to install app from github instead of PlayStore.

I do, if I want to get the services that app gives me access to. Eg my bank's app gives me access to my bank. There are no open source bank apps that I am aware of, so switching banks doesn't help.

Why do you need access to your bank from app? Isn't browser enough?

Remote check deposit usually isn't available without an app. Probably other services as well.

It is avalible via web login. At least in mine bank.

I use free and open source software when I can. I use and contribute to open street maps. I use proton mail's open source software and have purchased a plan with SMTP included.

I still gotta use WhatsApp though. In my country, to not have WhatsApp is to be ostracized. And there is no such thing as an open source WhatsApp client. They ban your number if you try. It's in the terms of service.

I can't build a free software app to interface with my bank's systems either. I actually tried asking my banks about this once... How naive I was.

- In my country, to not have WhatsApp is to be ostracized.

Can you be more specific? I never used WhatsApp.

- app to interface with my bank's systems

Why do you need app for that?

it's the same problem with all walled gardens. to communicate with others i have to enter the garden they are in. i have the same problem with wechat in china. i was unable to keep in touch with people until i gave in and joined wechat.

my landlord, teachers, parents of my kids classmates, colleagues at work, even government institutions or some family. whatever they use, i have to use. no choice. be it whatsapp, wechat or something else. they make the rules, and they could not care less if i join them or not. but if i don't it's my loss, not theirs.

-app to interface with my bank's systems

my bank requires an app (either mobile or windows) to approve any transfer, and login to the webinterface.

- whatever they use, i have to use.

That is premise to give companies and governments control over everything. If collectivism is more valued to you than right for privacy, nothing stop them to steal all of you data piece by piece.

If someone really care about being in touch with you, they listen.

I never used app for verification of bank transaction. Smartphone is not condition to run their business.

If someone really care about being in touch with you, they listen.

that goes both ways. if i care to be in touch with them, i need to listen. the groups of people i mentioned don't care to be in touch with me. but i depend on being in contact with them. therefore i have to be the one to listen. the alternative is isolation. there is no other way. i have been there. i would not be able to travel around the world as i do now, if i stuck with that attitude.

So whats that important that people in that group dont care about you but you insists to be there?

i am required to be there. otherwise i can't talk to teachers, arrange meetings for my kids and their friends, talk to my landlord, etc. sure, for some of these there are alternative ways, but usually they tell me if i want to be able to get a quick response (or a response at all) then i have to use their communication tool of choice.

for example my current landlord lives in a different country, that means i use his chat app or expensive international SMS or phonecalls, which would result in much more difficult communication.

teachers share photos from their activities only on whatsapp/wechat. they will reach me in other ways for important stuff, and in fact the directors of one school told me that they hate it too, but many parents are only reachable that way, so the parents force the school which would end up forcing me, at least if i want to get the photos and casual information, and not just communicate for emergencies. by insisting on a different way i would be the only one that everyone else has to make an exception for. and for many that means they would rather not bother.

also in many cases people do care about me but do not have the technical capacity to understand different communication tools. they barely can use wechat or whatsapp. and on top of that in china all good alternatives are blocked anyways. many matrix servers, for example. the only workable alternative would be deltachat because it works with email. but only if i get them to install the deltachat client, because most people read their regular emails only once a day or even less frequently.

in any group the choice is usually forced by the majority. and it would take a lot of energy to explain and convince everyone to change their preference. i do have more important things to worry about.

Did you sign consent about sharing a pictures of your kid in school in random chats with random people? That sounds a little bit odd to me. We have a laws for this in EU.

Required communication with your landlord via chat app is a part of lease contract?

also in many cases people do care about me but do not have the technical capacity to understand different communication tools

I was able to convince my closest family to use matrix. Sure, it require some teaching and maintaining but it is up to you. If you care, you can manage it.

Did you sign consent

i am not in the EU. and even there, i probably would have. it's a group for all the parents so i don't see the problem there, and even if there wasn't such a group, the teachers could send pictures privately to each parent. but not per SMS.

Required communication

there is required communication, and there is convenient communication. convenient communication helps keep the mood more friendly. also, you didn't read, international SMS and calls are expensive. and i am travelling a lot. i am not reachable under my home number all of the time, so i would have to tell my landlord my new number every time it changes because i am in a different country. (forget roaming. the cost for that is atrocious)

matrix

i use matrix. the experience is horrible. at least if you are trying to use encrypted chat. half the time it breaks. the key management is way to complex for a normal person. i have a technical friend who switched to matrix because of me. he threw it away in disgust when our chat broke for the third time. he got me to switch to signal (which now fortunately allows me to hide my phonenumber, so it became an acceptable option.)

compared to IRC, xmpp/jabber and deltachat, matrix has the worst usability among FOSS tools. i don't have the patience for the amount of teaching i would have to do, especially as it would all have to be remote. i live on a different continent from the rest of my family.

> Can you be more specific? I never used WhatsApp.

Yes. I am from Brazil. Everyone in Brazil uses WhatsApp. Over 90% of brazilians have WhatsApp installed. It's news here when the WhatsApp messages of government employees and politicians are leaked. There is no such thing as a phone number anymore, people ask you for your WhatsApp. They even shorten it to "zap", as in "what's your zap?". Phone numbers are just a thing you need to have a WhatsApp. If you do not have a WhatsApp, you're just not going to communicate with people. There's just too much friction for it to happen efficiently.

I have Signal and Matrix installed. Zero people use it to message me. Everyone who ever sent me a message through Signal went back to messaging me over WhatsApp shortly afterwards because that's where all of their other contacts are and there's just less friction that way.

It is what it is.

> Why do you need app for that?

Because the banks want to do things like prevent fraud and money laundering, and apps let them do things like "verify device integrity" as well as suck up as much identifying information about you as possible, letting them know that it's really you and therefore that the transactions you are trying to do are legitimate and shouldn't get blocked.

Here in Brazil I have to go to a bank agency and have them "authorize" specific devices. I'm not kidding. It actually used to be worse. We used to have "bank security plugins" for browsers which were basically rootkits and you could not log into a bank's website without these things installed. Many years ago I poked at one of those things and caught it intercepting every network connection. There's a package for one of these "modules" in the Arch Linux AUR right now. Who the hell knows what that thing does.

Personally I think they should just suck it up and eat the losses. Fraud and money laundering do not justify the sacrifice of our computing freedom. I literally do not care if they're losing billions of dollars, just write it off as a business expense or something. But compared to banks I am poor and powerless so all I can do is try to convince others that I'm right, thereby spreading my ideas.

I have different experience with chat apps. When someone asks for my WhatsApp I offer Signal or Matrix. If they really want to keep in touch with me, they listen and asks. I recently convince few friends to try those apps and we use them to communicate till today. One of them completely deleted all Meta accounts after many conversations about abusing privacy by their apps.

If you resign from your right of privacy and excuse it with collectivism, nothing stop companies and governments to steal everything from you piece by piece.

For verification of bank transaction, I never used any app. Banks business is not built on smartphones and apps. Its not condition for using their services. If so, I would quickly find competition.

It is your machine and it is their software. Why do you think what you want is more important than what they want? You can decide not to run their software if you do not like what it does, if you decide to run it, it will do what they want it to do.

Because I own the machine that runs the code. It's that simple. Their code will do what I allow it to do. It's not really a "take it or leave it" deal. I have numerous options available to me. If those options aren't there, it means I don't own the machine.

If they don't want others to "tamper" with their code, they should run it on their computers. Keep them safe and secure on their servers. Code that runs on our machines is and should be completely under our control. Anything that enables them to usurp this control from us is an attack on computing freedom and should be illegal.

This "you decide to run their software" narrative is the same bullshit as the "just vote with you wallet" crap that even economists don't push anymore. I can choose between one of half a dozen banks, all of which have "integrity" anti-features. Some government and school apps also have them and you basically have to use them.

What apps are doing these days is like if all the major grocery store chains decided you can only drive there using a BMW and said "just buy a BMW or shop somewhere else" to everyone that complained, ignoring the fact that 1) there's nowhere else to shop, 2) BMWs are expensive and 3) many people have needs that a BMW isn't suitable for.

It's just an "our way or the highway, take it or leave it" attitude from people with zero leverage over us. In fact we have a third choice: run their software anyway, and stop it from doing things we don't want it to do, whether they want it or not. We have numerous options available to us at all times. Because we own the computer.

Adversarial interoperation. It should be our right, as the owners of the computers, to do this.

https://www.eff.org/deeplinks/2019/10/adversarial-interopera...

https://www.eff.org/deeplinks/2019/06/adversarial-interopera...

I am all for that, if they do hostile things and you can break them, go for it. I just think that you can not just demand that a company builds their software the way you want it. For this we have markets, find or build a better alternative. The exception is of course in case of market failures, there it is legitimate to intervene. If Google forced apps to do this integrity check, that would be very different from some random apps deciding to make use of it.

> you can not just demand that a company builds their software the way you want it

I absolutely can. I think building certain types of software should be straight up illegal. And not the copyright infringement kind either.

These days our computers come pwned straight off the factory. The only difference between this and malware is that the company consented to it. In other words, from our perspectives as users and owners of computers, there is no difference whatsoever between their software and illegal malware. The entire purpose of those softwares is to usurp control of your computer and make it do somebody else's bidding.

Creating malware is already illegal. I think it should also be illegal to sell a computer to a person with such malicious DRM "integrity checking" software included. It should also be illegal for corporations to require it. And so on.

This isn't about markets anymore, it's about politics. If a politician shows up and proposes to enforce what I am saying above by force of law, they will have earned my vote.

>The exception is of course in case of market failures, there it is legitimate to intervene

Can't think of a bigger market failure than big techs building digital fiefdoms where they own the users and their data, where users don't have private property, where the corporations sell their users to other corporations and to software developers, dictate the developer's working conditions and control their futures, collect taxes on their earnings, enforce border controls on "their" devices so that software that didn't pass their customs clearance can't get installed.

> If Google forced apps to do this integrity check, that would be very different from some random apps deciding to make use of it.

The only reason why they are even able to "check integrity" to begin with is Google gave them the ability to do so via their attestation nonsense. They deployed hardware cryptography against us to deny us control over what was supposed to be our devices. The ones who have the keys own the machines, and it sure as hell ain't us.

The truth is these apps should not even have the ability to do any integrity checks at all. They should run on whatever device we put them on. And they should be happy that they get to run at all.

Just don't swim in stream with dead fishes and look for alternatives. You are not alone.

> I can choose between one of half a dozen banks

This certainly isnt true in the US. There are thousands of banks and thousands more credit unions.

The medium sized city I live in easily has more than a dozen options, and the county probably has nearly 100 if not more.

I know this is taboo knowledge on the Internet, but other countries exist too!

And on a more serious note, banks have a lot of explicit and implicit lock-in power. Switching is a an annoying process, you might have loans or multi-year deposits with your bank that mean you can't just close your account...

Google already enforces a lot of restrictions on how people write their software. Otherwise you could apply the same logic to say, requesting unneeded permissions. If the user doesn't want that they he could just not use the software, right?

Reply on news.ycombinator.com