Hacker News Reader

Comment by jdw64 | Hacker News Reader

Because I frequently supply to the automotive industry, I fully understand all these issues. No matter how good many open source projects are, companies always have to face lawsuits and liability. That is why, no matter how good Linux servers are, factories use Microsoft servers. Regarding the responsibility for that software, if a problem occurs, the company that signed the contract takes on the liability. Ultimately, they shift the security responsibility to Google. It is unfortunate for open source enthusiasts, but if they do not restrict open source and an accident happens, the possibility of a lawsuit being filed against Volkswagen would be the real problem.

View on HN

Grapheneos is compatible with over 99% of android apps. The only apps that don't work either actively block Grapheneos or have bugs caught by Grapheneos exploit protections which can be disabled.

You don't have to do anything extra to support Grapheneos, just don't add in attestation which does nothing for security and limits user freedom.

This is fundamentally different from not choosing to use Linux servers. It's more similar to not letting a customer enter your store because of the color of their skin saying they aren't regular humans. It's pure discrimination because just as the functionality of android doesn't depend on these extra checks, the customer works the same regardless of how they look.

I have 38 apps on my GOS phone and none have had any issues.

GOS may be much more technologically advanced and secure than Android. But that doesn't mean it has official safety certifications that can be submitted to courts and insurance companies in the event of an accident. Because GOS cannot pass hardware-based keystore authentication. I generally think open source is often better. The problem is that there is no entity to take responsibility.

There are banks that officially support Grapheneos through their hardware attestation. Android has an open and secure attestation, but Google pushes play integrity because it enables their monopoly. Companies making apps aren't exposed to these alternatives because of Google's power so that's what they choose, it's not because of security.

Are you saying Microsoft ever paid damages for problems with Windows (e.g. a non-bootable computer after an OS update)?

I think they didn't, so I don't see why them having the responsibility matters.

So is this problem of german (or EU) laws?

Reply on news.ycombinator.com