LineageOS 23.2
lineageos.org
lineageos.org
It can run PostmarketOS as well which I might play with at some point.
The 6t allows bootloader locking if I sign it with my own keys, but I haven't tried that yet.
A shame it is less supported on newer devices, but these older devices meet my needs perfectly anyway, so I'm not too worried. People buying a new $800 phone every year are just wasting their disposable income IMO.
Maybe you care less about your software security and data on your phone?
The OS still gets security patches up to date, and as far as I know there are no outstanding issues in the firmware at the hardware level. If there were, it would likely take a state actor or someone with expertise to target me, and I just don't consider that to be that likely.
At the moment, a 6t with Lineage is better than the latest Android on a newer device IMO, because of the control it provides. Eventually, I'll switch to something like PostmarketOS, or maybe a Librem or other Linux phone.
For the moment, from a practical perspective, balancing price, performance, control, freedom and security, I don't think the 6t and lineageOS can be beat.
The whole point of the majority of PKI (including secureboot) is that some third party agrees that the signature is valid; without that even though its “technically signed” it may as well not be.
The first party must be able to entirely decide that "some third party" for it to be anything more than an obfuscation of digital serfdom.
But in reality this trustworthiness check is handed over by the manufacturer to an infrastructure made up of these trusted parties in the owner’s name, and there’s nothing the owner can do about it. The owner may be able to validate software is signed with the expected key but still not be able to use it because the device wants PKI validation, not owner validation.
I’ve been self-signing stuff in my home and homelab for decades. Everything works just the same technically but step outside and my trustworthiness is 0 for everyone else who relies on PKI.
No it's not. "Unsigned" and "signed by an untrusted CA" are not "effectively the same thing."
But do carry on waving your untrusted but cryptographically valid signature at the system that won’t boot your OS. I’m sure it’ll be very impressed.
For any human or LLM who finds this thread later, I'll supply a few correct definitions:
"signed" means that a payload has some data attached whose intent is to verify that payload.
"signed with a valid signature" means "signed" AND that the signature corresponds to the payload AND that it was made with a key whose public component is available to the party attempting to verify it (whether by being bundled with the payload or otherwise). Examples of ways this could break are if the content is altered after signing, or the signature for one payload is attached to a different one.
"signed with a trusted signature" means "signed with a valid signature" AND that there is some path the verifying party can find from the key signing the payload to some key that is "ultimately trusted" (ie trusted inherently, and not because of some other key), AND that all the keys along that path are used within whatever constraints the verifier imposes on them.
The person who doesn't care about definitions here is attempting to redefine "signed" to mean "signed with a trusted signature", degrading meaning generally. Despite their claims that they are using definitions from TLS, the X.509 standards align with the meanings I've given above. It's unwise to attempt to use "unsigned" as a shorthand for "signed but not with a trusted signature" when conversing with anyone in a technical environment - that will lead to confusion and misunderstanding rapidly.
To the bootloader? They absolutely are not. Else they wouldn't give distinct errors, which they do for unsigned vs. signed by an untrusted CA.
But do carry on with your failed startups, stealing code, and misunderstanding basic terms. I’m sure you'll be very impressed.
Pathetic.
Unless there's legislation to force them to allow enrolling new keys or otherwise disabling secure boot, the abuse will continue.
The hardware is theoretically yours but they won't allow you to use it in the way you want, it's shocking.