News for hackers. Stuff that matters.
Re:Journalist’s phone hacked: all he had to do was visit any... by ezoe on Wednesday June 24, 2020 @12:44AM (#23624194)
I think the developer community need to start refusing to use the cellphone. It cannot be trusted. It's tainted by non-free software on top of non-free OS on top of non-free firmware with the separate processor whose behaviour we cannot observe from the main processor. It also relies on central wireless network from only a handful of providers. Easy single point of vulnerable target.

I do refuse to own a cellphone. What about you. Since you're suggesting the boycott, can you?

Re:Journalist’s phone hacked: all he had to do was visit any... by bad_user on Wednesday June 24, 2020 @01:39AM (#23624472)
What does Free/OSS software have to do with the article?

If the phone wasn't proprietary, would it have made any difference?

The answer is obvious.

Re:Journalist’s phone hacked: all he had to do was visit any... by Reelin on Wednesday June 24, 2020 @01:58AM (#23624568)
> The answer is obvious.

Is it? I'm not overly familiar with any security exploits, but my understanding is that (at least for Android) the phone OS is often woefully out of date simply because the vendor stopped supplying updates. The end user generally can't supply updates themselves because everything is locked down in a decidedly user hostile manner.

For the vendor's part, they often stop supplying updates (as I understand it) because the proprietary hardware doesn't have it's drivers upstreamed into the kernel (they're proprietary after all) which leads to a completely unjustifiable maintenance burden. They can't simply open source things because the hardware manufacturers generally require NDAs.

As far as the hardware goes, my (probably woefully incomplete) understanding is that it remains proprietary due to a combination of attempting to maintain a competitive edge through secrecy, licensing complexities due to containing third party IP, and DRM issues (which are again a licensing concern).

Re:Journalist’s phone hacked: all he had to do was visit any... by bad_user on Wednesday June 24, 2020 @03:02AM (#23624935)
No, that's not what happens on iOS. I'm writing this on a 5 year old device still getting updated.

The iOS exploits that have historically allowed the device to be jailbroken have been zero-day vulnerabilities. And I'm assuming the TFA is about a zero-day too.

Also Android is open source (AOSP). How does that help?

Re:Journalist’s phone hacked: all he had to do was visit any... by Reelin on Wednesday June 24, 2020 @03:28AM (#23625118)
I'm well aware that this isn't nearly as much of an issue for Apple devices - that's why I very clearly specified Android in my previous comment.

Yes AOSP is open source but that doesn't help as much as one might hope for the reasons I outlined in my previous comment. Basically most end user devices aren't actually running AOSP at the end of the day, and can't without investing a nontrivial amount of effort. (And that still wouldn't prevent vulnerabilities related to out of date firmware.)

The comment of yours that I originally responded to seemed to me to insinuate that having access to fully open sourced phones wouldn't be able to do anything to improve device security as a foregone conclusion. I was objecting to that, pointing out that there are a number of real world examples where access to a fully open source mobile stack would immediately and drastically improve the current situation. In a hypothetical world full of such stacks perhaps this article would never have been written.

Re:Journalist’s phone hacked: all he had to do was visit any... by msh on Wednesday June 24, 2020 @01:37AM (#23624463)
Mobile phones are way safer for normal users compared general purpose computers.
Re:Journalist’s phone hacked: all he had to do was visit any... by niyikiza on Wednesday June 24, 2020 @02:19AM (#23624696)
I think the problem can be solved by separating the "phone" experience from the "mobile" experience. Phones are these devices powered by a philosophy (and to an extent, a technology) from 3-4 decades ago and day after day we see them ruining the experience of having the internet access from your hands. We need to move from a mobile-phone era to a mobile-internet era.
Re:Journalist’s phone hacked: all he had to do was visit any... by simonh on Wednesday June 24, 2020 @02:35AM (#23624784)
In what way do you think the phone legacy is holding us back? What concrete steps would you suggest?

It seems to me this has already happened. We only call these things phones for legacy reasons, but the iPhone broke the design link with actual phones and turned the phone aspect into just another communications app.

Re:Journalist’s phone hacked: all he had to do was visit any... by kavalg on Wednesday June 24, 2020 @04:14AM (#23625449)
I guess he meant the baseband processor
Re:Journalist’s phone hacked: all he had to do was visit any... by simonh on Wednesday June 24, 2020 @08:29AM (#23627089)
OK, but how does that hold any other aspects of these devices back? Remove the baseband processor and you've got an iPod Touch, or a small iPad. It doesn't fundamentally change the device or really open up any new avenues not possible with a baseband processor.
Re:Journalist’s phone hacked: all he had to do was visit any... by fouc on Wednesday June 24, 2020 @01:55AM (#23624547)
PinePhone seems promising
Re:Journalist’s phone hacked: all he had to do was visit any... by teddyh on Wednesday June 24, 2020 @03:40AM (#23625199)
Also the Librem 5.