Hacker News Reader

Comment by markovbot | Hacker News Reader

So it says all over the site that it says it's open source, but I can't find a link to the source code.

Why are there embedded Facebook and Google tracking scripts in your site about a supposedly privacy-focused phone?

The website doesn't the website have https.

I see a lot of claims of privacy focused and openness on this page, but not a lot to back those claims up.

EDIT: So I guess the source code isn't available, so I'll have to ask here: how are phone calls on this oh-so-privacy-focsed phone secured? It says VoIP, does that mean it's SIP? Does the SIP use TLS? Is the TLS verified? is the media encrypted? Is it end-to-end encrypted? What encryption is used?

View on HN

We are in this to make money, it's not a side project. Marketing is almost impossible without tracking and I'm not going to say I like it, but I haven't found a way to do without it. I like open source/not tracking/privacy, but it's not my religion. This project would be dead already if we couldn't run Facebook ads.

The phone is for people who want hardware that can be used for hacking. We don't have any code that does anything related to tracking in the phone, and once it's released anyone can verify that.

That page is static, so I don't see how https is relevant.

Right now there is no security whatsoever. We are still getting the system to work, and work reliably. If enough people buy one we will probably add some sort of transport layer encryption.

> That page is static, so I don't see how https is relevant.

https://developers.google.com/web/fundamentals/security/encr...

Disclosure: I wrote that doc in collaboration with the Chrome security team.

So the marketing emphasizes the privacy aspects of this device, yet in the comments (not noted on the website), you state that it has "no security whatsoever". This seems like an important disclaimer that should be given on the website.

"Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith."

https://news.ycombinator.com/newsguidelines.html

dang, the author includes an entire privacy section on his site about this device. He then contradicts it downthread. Try clicking 'Privacy' in the footer... oh right, you can't.

The website doesn't use HTTPS, includes trackers, and it might be the case that the author hasn't figured it out that without mitigations, wifi can be tracked just like cellular radio.

In short, it's the scammiest looking project I've seen posted to HN in a long time. At least they aren't taking money yet so the author can continue to shoot himself in the foot in comments.

Fair enough, but the GP comment still breaks the guideline I quoted. No? Plus it breaks the one asking people not to snark.

I can edit the comment to be less snarky if that helps...

Sure! I've reopened it for editing.

It's not a privacy focused device. It's a device intended to give hackers the ability to do things they aren't able to do with typical commercial hardware.

As a side effect of that there are some properties related to security that you get for free (no tracking cookies, no black box cellular radio), and others, like encryption, that we will try to add if we make enough to fund doing it. But we won't feature creep the project and risk never delivering just to check a box that's not part of our core goal.

you can do online marketing without tracking by giant ad companies like facebook and google. for example, facebook ads don't require their tracking scripts on your site. retargeting requires tracking, but i'm not sure that's worth the hit to your nascent brand, given the target market.

In the FAQ, under the Technical section it says:

> Q: Where can I download the code?

> Probably Github. After we ship the rewards.

So, unfortunately, it looks like it'll only be open-sourced after it ships.

Don't most licenses only require the source to be available when it ships to end users?

I guess we could nitpick over the word "after" but if they ship the first phones 8am and release the code at 1pm I think it still complies.

https://github.com/ESP32-WiPhone only has the keypad as open source.

I don't think it'll be released until the phone is.

Reply on news.ycombinator.com