CopperheadOS update: Developer suspended from Reddit | Hacker News Reader

CopperheadOS update: Developer suspended from Reddit

reddit.com

135 pointspetethomas49 comments

I can't believe anyone who goes by a name as trustworthy as "darknetj" could be involved in shady business.

How did the CEO do this? What strings do you pull to get someone banned for Reddit whistleblowing? Who on the Reddit staff might "fence" his request?

The story might be more involved than this, or maybe he managed to convince reddit staff that he has alternate interpretation of the events and the believed him.

Emotions seem to be running pretty high.

It's possible the developer did something that left Reddit little choice but to suspend him.

https://old.reddit.com/r/redditrequest/comments/8ra5b5/reque...

Lets see the ceo of copperheadOS wants to pretend the sole developer who did all the useful work is a peon he can fire instead of a partner and the leadership of reddit likely identifies to a greater degree with the pointy haired boss than the nerd.

I don't think it's over for CopperheadOS, but it is over for that name. Like Cyanogen changing to LineageOS, the dev who deleted his signing keys will probably just foke a new code base with a new name.

Obviously it won't be as peaceful a transition Cyanogen->Lineage, but that's my prediction for this Android variant in the next few months.

Daniel sounds rather burnt out, and also needs to find a new job. I wouldn't expect updates at the same pace.

Yes, which is quite sad both because of the amount of effort put into this and because there's nothing quite similar to migrate to. CopperheadOS was a bit unique.

> the dev who deleted his signing keys will probably just foke a new code base with a new name

"I can't continue CopperheadOS without Copperhead. I need to think about what my options are in terms of finding a new job. [...] I'm not starting many things over again from scratch and I'm not founding a new company." - strcat

I offered to help him try and find funding to work on it without copperhead, but that's what he said.

Looks like more than just the two looped in now:

https://old.reddit.com/r/redditrequest/comments/8ra5b5/reque...

Edit: The repo is also private now

https://github.com/CopperheadOS

http://archive.is/rOnWi

Update - A community member tried to document the happenings of the events and the CEO of CopperheadOS sent a DMCA request to take it down.

https://raw.githubusercontent.com/yegortimoshenko/copperhead...

Wow, that surely meets the very high bar DMCA sets for false reports, right?

This is not a valid DMCA claim, point one doesn't even mention copyright. I sent a counter-claim, then tried to republish the repo. GitLab said me I will only be able to republish in 10 days if I don't receive a response, and also that they might ban me if I try to republish it again without waiting for due process.

I thought DMCA was a US thing?

Repos have been moved to http://github.com/AndroidHardening.

    $ curl -s "https://api.github.com/orgs/AndroidHardening/repos?per_page=200" | ruby -rubygems -e "require 'json'; JSON.load(STDIN.read).each { |repo| puts \"git clone #{repo['ssh_url']} android-hardening-#{repo['name'].gsub(/(.)([A-Z])/,'\1-\2').downcase.gsub(/[^a-zA-Z0-9]/, '-').gsub(/-(-+)/, '-')}\" }" | parallel -j 8 '{}'

What is this?

They want you to clone all of the repos belonging to https://github.com/androidhardening, for some reason... I suppose they think it will be taken down by GitHub lawyers?

That's a useful snippet. I wanted to download all the repos of a different organization the other day. Thanks!

can anyone give the short version of what happened? I'm not familiarized with CopperheadOS and I like this kind of drama

Well I do have to thank them for blowing this up now, as I'm in the market for a new pocket tracker.

It seems like the least-worst option is Samsung Exynos -> Lineage -> No GoogleCrutches -> F-droid.

Still a fucking dumpster fire. Alas, here's to hoping pmOS (or the like) actually goes somewhere.

If you want to use Android, don't forget about microG. There's even their Lineage fork: https://lineage.microg.org/

Well I don't really want to use Android. What I want is a long-battery-life GNU computer that fits in my pocket, with an optional chorded keyboard. Which could then run any needed Android apps in an untrusted vm [0]. Alas.

I'll have to look into microG. My plan was just to avoid attractive nuisance apps on my everyday phone, and stick with stuff from F-droid. But then of course eg traveling puts one in a different mode of just needing to get a problem solved on the go [1].

It is a bit worrying that microG's first listed feature is augmenting perfectly-fine GPS location.

The split with Lineage seems annoying, for both practical and long term considerations. From a quick reading, it seems like Lineage is being stubborn and preserving the paradigm where Google is trusted more than the purported owner of the device.

Seems like one would definitely have to use a VPN with microG, lest Google continue to infer social metadata from whatever IP address (ie wifi network) one was connecting from [2].

[0] I wouldn't mind say running Waze for the highway part of routine trips (with a nonce account of course), to report highway robbers and other hazards.

[1] Which is how these surveillance companies get us over the barrel, but I digress.

[2] It seems like the best solution here would be some sort of headless "wifi condom" that would connect to 3g/4g/wifi networks, do the VPN stuff, and present a single constant wifi network.

>Well I don't really want to use Android. What I want is a long-battery-life GNU computer that fits in my pocket.

Librem5 is definitely something to watch: https://puri.sm/shop/librem-5/

I'm also watching the Pyra, but development is super slow: https://pyra-handheld.com/boards/pages/pyra/

The great thing about microG is that you can configure everything in it that communicates somehow with external services. So for instance you can disable Google Cloud Messaging (I think it's even disabled by default), or enable it only when you need it, or configure it so only one app can use it, etc. The same with GPS augmentation - backends for it are switchable, so you can use Google, Apple, Mozilla or even offline database for that. I'm glad microG exists, I use it on my one Android device I keep for testing Android ports of my software and for occasional emergency situations (like having to use mobile bank app or get some transport data that's very helpfully only available as a mobile app for platforms I don't want to use on my main device).

Otherwise I just keep using Nokia N900, which replaced my old Openmoko Neo Freerunner. I'm waiting for my preordered Neo900, Librem 5 and Pyra.

> microG

You don't need this crap.

If you really care just get an Apple. I don't care that much so I'm still on Android.

Isn't that a bit like avoiding a stalker by checking into a mental hospital?

I had actually considered it (if for nothing else than the more coherent target to be hacked on), but am wary of just heading towards a different strong attractor for top-down control.

Do check out libimobiledevice, available on Windows, macOS and Linux.

http://www.libimobiledevice.org

It's fairly straightforward to install LineageOS on the Xiaomi Redmi Note 4 32GB [1], but they make you wait 72 hours before you can unlock the bootloader and I had to use a Windows virtual machine to be able to use the unlock software...

1. https://www.aliexpress.com/item/Global-version-Xiaomi-Redmi-...

I discarded anything Snapdragon, as incorporating the hostile baseband processor into the same chip as the trusted CPU is the wrong idea.

This rules out an awful lot of the offerings, but at least there's Exynos (and Atom). I'd imagine the open-security-focused solution of the future will eventually push all that proprietary-algorithm-intensive hostile crap into something like a mifi.

> rules out an awful lot of the offerings,

there's already very few that have an unlockable bootloader

The damage done to this project is done. No coming back from this. Base has been compromised.

Nothing will be left here but ruins.

History is full of co-creators having a fallout and then being willing to burn whatever they made to the ground rather than give an inch to the other guy. Sadly, this looks like it will be yet another example.

As far as I can tell, both the CEO and the developer have behaved very unprofessionally during this whole affair, airing their grievances and their dirty laundry on public forums. I don’t think I would trust either of them to run a company or maintain a trustworthy codebase. They should consider the damage they are doing to their reputations and start acting like adults.

I'm not sure what you expect from the developer, to just take it? He doesn't have power in the company because even though he's a 50% shareholder, he's not on the board of directors.

I mean, personally, I hold them both to the same standard of professionalism, as they were both "c-levels" within their company. He's more than a developer, at that point, so airing of dirty laundry comes off as kind of a petty attempt at "bringing the other guy down with me". Especially the times where he was posting direct snippets from their private emails, then a sinister sounding summary of the rest (but not the actual content of the rest, meaning he's probably twisting some words).

I think both sides are acting really shitty here, I wouldn't want to partner with either of them in any future endeavor.

I have not yet read the post, but this trend of striking people off for their mistakes gets on my nerves. The morning I was reading an article on NYT comparing Einstein's remarks from his visits to Asian countries, which are rather racist, and his standing with the black in the American racial conflict. Tge possibility that he discovered the falsehood of his previous thoughts, if we take them as racist ones, and changed his ideas and stance is completely ignored. We make mistakes, sometimes we learn better.

Out of the loop here... What whistle did he blow? Anyone have a tldr?

Details and discussion here: https://news.ycombinator.com/item?id=17289536

EDIT: Further details as I'm reading...

Big reddit post from the developer here: https://www.reddit.com/r/CopperheadOS/comments/8oq1l3/cos_fu...

It seems there was a falling out between the developer and CEO over how the business was run - the CEO wanted to license Android security improvements to others, the developer wanted to go make custom hardware and sell secure devices with an entirely non-Linux based stack that still could run Android apps.

Seems like reddit has now suspended the developers account, likely due to threats of a libel lawsuit from the CEO... seems like a really bad move on reddit's part, but they're no strangers to bad moves in my book.

CopperheadOS was spearheaded by two people (to my understanding): the founder, and the lead developer. They had a falling out. The developer felt that the founder had compromised their ideals in order to make money (how this was done has not been detailed). The founder told the developer that he's out. The developer, in turn, deleted the signing keys so that no new software can be published under the CopperheadOS name.

The developer alleges now that the founder has gotten Reddit to delete his (the developer's) account.

I thought both were founders or that the developer is actually the founder and the other guy was brought in to run the business side.

They are both co-founders with 50% of the company each - at least that's what the dev said on Twitter.

But the developer started the project before he even knew the other guy. One of the issues is that, reportedly, the developer never actually assigned any copyright to the company, so he's (allegedly) the actual owner of the code.

It was never a very secure OS / product / distro if a single individual was able to destroy the signing keys in this fashion.

If this personal battle is enough for folks to say the whole thing is now compromised, and one person held all the keys, how do you know he hadn’t been compromised before? If the code has no third party audits, or a web of trust, then it was never secure to begin with.

There's always a chain of trust. What alternative would you suggest?

I think I remember reading that in Google there's like 5 people that have the master keys and are able to deploy any kind of change at any moment without any review or oversight. They're the top of the chain of trust.

There is a big difference between a chain of trust with multiple people involved and corporate oversight, and a chain of trust that consists of one person who wields absolute power.

So yeah, there is always a chain of trust, but some are better than others. In the Google case, if one of those 5 people started doing bad things, the others would presumably be able to stop him and undo the damage.

Reply on news.ycombinator.com