• 8 Posts
  • 227 Comments
Joined 1 year ago
cake
Cake day: July 23rd, 2023

help-circle
  • Here’s a little story that shows how much society has become dystopian:

    Back in the 90’s, I worked in France for a while. When I was there, a case was brought up against the state that had violated a CNIL rule: some dude was cheating on his taxes by claiming he lived at some address. Tthe French fiscal administration sued him because they obtained a file from the electricity company and another from the water utilty company showing that the consumption of both electricity and water were so low it wasn’t consistent with the dude actually living there.

    The case was thrown out, the dude walked and the state was fined because it had violated a rule that clearly stipulated cross-referencing files for the purpose of extracting secondary information that wasn’t available in each single file was a violation of privacy and civil liberties.

    I shit you not. This used to be a thing.

    Can you imagine this today? All the Big Data sonsabitches cross-reference billions of files ALL THE TIME and nobody bats an eyelid anymore.

    If you’re old enough, you remember sovereign states taking privacy seriously. If you’re not, you don’t. And that’s how Big Data gets away with what they do today because fewer and fewer people remember a time when it was unacceptable.







  • Free software (not open-source, it’s really free software that’s important) that depends on a single for-profit vendor is not free.

    MicroG is open-source but it’s not free. It fails to address two problems:

    • What do I care looking at the source code of a Google Play Services replacement when Google still holds my cellphone by the balls for certain critical functions?
    • Why do I need permission from Google for apps to function properly on my cellphone?

    I don’t think OP cares about getting the source of the apps they run so much as the apps being free-as-in-libre in his original question. Many people mistake open-source for free software and MicroG is not truly free.





  • It’s not the only thing that leaks timezone data, and the fix is identical: have the machine pretend you’re in UTC.

    For example: if you enable Resist Fingerprinting (RFP) in Librewolf, it will lie to websites and pretend your timezone is UTC - because of course timezone is one of the factors used to fingerprint you - and all the sites you visit that show you your local time, or depend on your local time for something or other, will show you the wrong time. And that’s how you know it works 🙂



  • This danger is why I quit using the Purple Teams plugin for Pidgin: it works well enough (considering Teams isn’t exactly open to third-party clients, it works amazingly well in fact) it’s GPL-3.0, the source is provided and I compiled it.

    So I believe it’s clean, but that’s not good enough for me to hit our corporate Teams channels with it and I don’t have the time to audit the code. Not to mention, while my company trusts my good judgment, I’m pretty sure running an unauthorized client is against IT policies.

    So I dropped it, sadly. It’s a bummer because Pidgin uses a fraction of the resources needed by that pig of an Electron app - the official client - made by Microsoft.


  • So you really trust Google to release code that doesn’t do something it shouldn’t behind your back do you? How cute…

    I am an embedded developer so please don’t patronize me. And I know enough about security to know that Google’s security model on the Pixel phones is the best yet. That’s not the issue. The issues are:

    • Google’s code is untrustworthy unless reviewed, and proprietary binary blobs can’t be reviewed. If Google codes anything, they have an ulterior motive and it’s rarely in your best interest. If that’s not a security shortcoming, I don’t know what is. Or said another way, there’s something deeply ironic in claiming to have the most secured deGoogled OS and the lynchpin of that security is Google itself.

    • Yes, using a phone other than a Pixel phone with a deGoogled OS other than GrapheneOS as I do (I use a FP4 with CalyxOS) is less secure than GrapheneOS on a Pixel phone - assuming you trust Google’s drivers aren’t doing other things unrelated to their driver function.

      But as I said, my most important goal in anything technical I use is to not use Google. That’s my ideal. Some people have ideals and aren’t willing to compromise.

      With that in mind, and considering that I’m a low-value target, I deem the security provided by CalyxOS on my FP4 more than adequate for my use case. Or said another way, GrapheneOS’ - short-sighted, in my opinion - obsession with security gets in the way of my main goal, which is to avoid Google.


  • Graphene is against GNU ideals getting in the way of security,

    Funny, Graphene’s obsession with security is getting in the way of my ideals.

    Fuck Google and their proprietary security updates. I want no Google in my life and if that means a bit less security, I’m okay with that. In fact, I’d argue that running Google code that does who-knows-what for your security is itself not a very safe thing to do.





  • If you can live without all the apps that only exist on Android or iOS, then a non-Android-non-iOS phone is a great choice. But it only takes one of those apps to be essential to you and your non-Android-non-iOS phone suddenly becomes a miserable experience on a daily basis.

    You say you don’t need a banking app. That’s great.

    Me, I currently live in a country where banks are entrusted by the government to handle secure authentication online. If you can’t use the mobile banking app, you can’t interact with social services, the local equivalent of the DMV, healthcare system, police… And you can’t book a train ticket, change the trash collection schedule, check if your parcel has arrived at the post office… Everything is online here, and without the banking app, your life becomes very very difficult. Not impossible, but not a pleasant experience.

    And my company requires me to use the Teams app. In fairness, if I can’t use it on my phone or I refuse to install it on my phone on principle, they will readily provide me with a work phone - and a pretty nice one too. But that means I’ll have to carry two phone and, well… I just don’t want to do that.

    So if a Linux phone works for you, more power to you. It’s just that you’re a minority of extremely lucky people for whom this arrangement is at all workable.


  • Yes, an inept user can install it. I know because I am a fairly inept user 🙂

    The key to a successful deGoogled OS installation is picking the most compatible phone possible for the AOSP flavor you want to run. If the phone is well supported and everything is reported to work, you’re unlikely to run into issues.

    I chose a Fairphone 4 to run CalyxOS. Or rather, it went the other way in my case: CalyxOS was kind of imposed on me because my requirements for the phone was first and foremost not be Google Pixel phone (i.e. GrapheneOS was not an option) and good repairability second. CalyxOS is the only deGoogled AOSP distribution that runs on the Fairphone.

    If you look at the instructions to install CalyxOS on the Fairphone 4, it’s nicely detailed and really simple. It went without a hitch for me. You can also install it on the Fairphone 5 and it looks simple enough too, but I haven’t tried it myself.

    As to why I like it:

    • It emphasizes privacy over security (like GrapheneOS). Yeah it might not be quite as secure as GrapheneOS, but it’s more practical.

    • Enable MicroG and you basically have a normally-working phone. Yes, you still hit the Google server and that’s not great. But sadly that’s part of the compromises you have to make with your principles if you want to have a somewhat normal digital life in this day and age.

    • System-level integration with F-Droid and Aurora. The GrapheneOS people think it’s a liability. I think it’s a plus.

    • Comes with a work profile manager that works fine out of the box. You don’t need to install a third party manager like Shelter.

    • I know I’m gonna be shouted at for saying this, but… The Calyx Institute is always a little behind with Android updates unless they’re critical, and I find that to be a plus regardless of the OS you use - desktop or mobile: when your OS pulls updates as soon as they come out, it pulls screw-ups as soon as they come out too. CalyxOS’ delay in pushing updates means you let others play guinea pigs for you, and you only get updates after they’ve been thoroughly tested by a large number of users.

    • CalyxOS comes preinstalled with a nice set of apps. I especially like the Datura firewall: it lets you use sketchy app and deny them access to the internet. For instance, I use it to configure my TP-Link smartplugs with the TP-Link Tapo app without letting this hateful turd of a spyware app call the mothership. I don’t quite like how the SeedVault backup software follows the Android security model, because it prevents you from doing a true, full backup. But it does backups nicely and securely and that’s better than nothing. And the Calyx institute offers a free VPN: I only tried it once and it was kind of slow, but hey… it’s free.

    • Like I said, it runs on a non-Google phone. I hate Google with a passion and there was no way I was going to give them money to get a Pixel phone for the privilege of not being subjected to the Google surveillance. So most other deGoogled OSes weren’t even an option for me.