Hacker News Reader

Comment by arca_vorago | Hacker News Reader

All I want is a fully open source phone from the radio firmware up. Android has been such a disappointment for me as a security conscious person, between googles questionable open source policies to the carrier hell it gets forced into and into the blackbox of radio protocols like GSM that far too often have DMA to the same segments of the CPU.

The whole point of FOSS is to be able to see what's going on, for freedom and control to the user. At this point I barely see Android as any better than IOS, aka, a very pretty jail for the user.

View on HN

The lack of security advisories for even the major open-source Android distributions scares me: can anyone imagine if major Linux distributions provided no security advisories?

I run CyanogenMod Stable on my phone, the kernel build date is given as Sep 23 2013. Are they really meaning to imply that no security advisory published for Linux after that effects CyanogenMod? Most are purely local attacks, but still therefore malware vectors, and then there's things like CVE-2013-7027, which on the face of it should effect Android.

At the moment, I'm running CyanogenMod purely under the assumption it'll be more secure than the default Samsung installation (no updates in about two years), as at least it gets updates! Yet, at the end of the day, I see little to convince myself they are actually keeping up with upstream security fixes. No Android distribution seems to have a coherent story when it comes to security advisories, sadly. :( (I have a Galaxy S2, if anyone wants to convince me to try another distribution/OS!)

I am essentially in the same boat, running CyanogenMod stable as well, mostly to escape google. I am having many issues with it, and have been actively looking for a good alternative. There are a few open source phone projects ongoing, but non are in production yet so for the time being Replicant seems to be better than CyanogenMod to me, but it has limited hardware support at the moment. I do think your S2 is supported though, you might try it out.

http://www.replicant.us/

And for anyone wondering about privacy/FOSS tools in general, the EFF put together Prism-Break site has been constantly updated.

https://prism-break.org/en/all/

http://www.cvedetails.com/vulnerability-list.php?product_id=...

There are lots of exploits, and every time someone publishes a rooting method that does not require "fastboot oem unlock" (gingerbreak, ashmem, mempodroid, exploid, etc) it's one of the CVEs being exploited.

I think Google made it a lot harder since 4.3 or 4.4 to root or unlock without fastboot oem unlock or a similar solution that's given by the OEM.

Rrrright, so I will consider my GNU/Linux installation not any better than Windows or OsX, since my video driver, my wifi driver, my BIOS, my Ethernet controller firmware and my hard disk firmware are all closed source.

You are lacking perspective if you think that: 1) a completely open source phone is easy to make 2) iOS and Windows phone are on par with Android's level of openness

Edit: people downvoting, state why please

Reply on news.ycombinator.com