Librem 5 is rooted. It's basically just a Desktop computer in the form-factor of a phone.
> Add tools that let me see what my phone is doing behind the scenes.
Everything is open source. You have all the power to study what your phone is doing. Standard GNU/Linux tools should work.
> Give me option to turn-off some of the things I don't like
Everything is free software, you can change it as you like. Also, there is no analytics by default: https://www.youtube.com/watch?v=yHcHi0TBFv4
> Help with planned obsolence by providing updates
Lifetime updates are promised. Even if the company dies, the community can support the phone, since it's FLOSS: https://wp.puri.sm/posts/librem-5-longevity-solving-the-prob...
> Edit: one more thing, please add NFC. Going back to carrying boatload of cards again is not an option
Unfortunately, not in the first version. One step at a time.
Which is what has me worried the most.
The (common) security model of GNU/Linux is for today/2020 in my opinion pretty bad for desktops and totally unacceptable for phones.
When I first heard about snap and flatpack I thought things are slowly heading in a better direction but it turns out that was a misconception.
I haven't looked into how the libre phone does sandboxing but I don't have to much hopes to be honest.
Would you please expand on this for desktops? or reference any kind of document? Thank you.
All applications and (preferable system services too) should be sandbox fist. Linux has much sandbox technology but it's often focused on server use-cases, fairly complex and everything but sandbox first (more like non-sandbox first and then we fit the sandbox to make it so that the program doesn't notice it runs in one).
But it's also many many small problems.
Most (all?) of which you can solve by a complex combination of selinux + cgroups + ... + modified applications + ... (long list). But doing so it a lot of work and often ends up with major usability drawbacks.
Just to name one example of a small but terrible feature: LD_PRELOAD.
Sure it's nice for hot-fixes including ad-hoc security hardening but it's generally a horrible idea in a context where you don't fully trust all programs.
Another think is that most programs can read conigs/settings of most other programs or at least know that there are such settings.
And the list goes one.
Again just to be clear you can fix a lot of this by putting things into Linux containers but what is missing is a container engine focused on desktop applications which goes far enough, which also entails you can't just run existing software without at least switching out the GTK/Qt framework with a version adapted for this use-case and potentially needing more adaption then this.
So all technical possible but we are not quite there yet I think, but then I'm not completely sure as I haven't followed some of the underlying topics close enough in the recent years.
In a modern environment, software should not necessarily be trusted to act in accordance with the user's wishes or best interests, and there's often a financial incentive for software creators to do things users wouldn't want them to. In the early 2000s, the most visible issue was Windows software that displayed advertisements outside of the software, often not obviously connected to the software. It would often monitor the user's browsing habits and such, leading to the name "spyware".
Spyware of that sort was universally considered malicious, but modern smartphone apps often send far more sensitive information, such as location and address books to their creators. Those provide a simple example of a situation the classic Unix security model doesn't address very well. I am the only user of my phone, and I obviously want to be able to read my address book and get my location from the GPS. I do not want the latest and greatest app for sharing pictures of my lunch to track my location to show me restaurant ads, and I only want it to know about people I have explicitly connected to within the app, not my whole address book.
Android's security model addresses that to a degree, restricting some capabilities until the user explicitly allows them. Some of these, like filesystem access aren't handled very gracefully, and it's possible for an app to refuse to work until granted permissions it doesn't really need (this is against policy for inclusion in the Play store, but enforcement is imperfect, and software can be installed from other sources). One workaround seen in XPrivacy is to feed fake data to apps.
Breakage isn't binary though. The user is still in charge of whether a given app gets access to root or Xposed features. The Android security model and additional security features of XPrivacy can be applied to apps the user does not trust with certain kinds of data or capabilities while granting other apps increased access.
>Everything is open source. You have all the power to study what your phone is doing. Standard GNU/Linux tools should work.
Yes, for the base system, however for third-party stuff, it would still be nice to prevent the apps from phoning home and stuff.
For now the choice is privacy vs user friendliness. Currently rooted/de-Googled Android provides one of the best compromises for the average privacy-minded power user, but maybe in a few more years these Linux phones will be mature enough to give Android more of a run for their money.
The Linux desktop is an obvious counterexample. If the open source community can develop user-friendly desktop environments (GNOME, KDE Plasma, Xfce) they can surely develop user-friendly mobile stacks.
The vastness of the just the changelogs makes that untenable. Understanding the changes to such a nontrivial stack is something experts will even struggle with.
Certainly, open source code is a prerequisite to any trust, but just that isn't enough.
As a freedom-, privacy- and also security-aware person, I disagree quite strongly. Phones should by default provide a way for people to modify their phone as they see fit but they should definitely not be rooted by default. The reason being that root access is, well, the root of all evil. Practically nothing has advanced end consumer device security in recent times as much as Apple and Google enforcing a secure boot chain (in particular: read-only root file systems), implementing heavy sandboxing and cutting down[0] on apps' permissions. All this is worth nothing if apps can obtain root and do whatever they want.
People often claim Linux (as a desktop OS) is secure. It's not by any standard. All the apps you use in your day-to-day tend to have full file system access to all your personal files and full network access. You've merely been lucky so far that you (hopefully) haven't gotten pwned by any rogue application.
I'm eagerly awaiting a time when my root file system will be read-only, my entire boot chain will be verified[1] and all my day-to-day applications will be fully sandboxed and only very few of them have network access.
[0] Granted, one might argue whether this is actually what Google has done.
[1] https://safeboot.dev.
You don't see the contradiction here? Root access is synonymous with the ability to modify the device as you see fit. The root of trust starts with the owner of the device, not the hardware manufacturer or operating system developer. This does not imply that any random app should be able to obtain root access, or that you can't have things like verifiable read-only root filesystems and strict sandboxing. It just means that the owner of the device should be in control of the keys—i.e. the "root" user—and that apps should not be able to introspect the system to determine whether or not it's running in a "vendor-approved" configuration. You don't have to use the root account for day-to-day operations just because it's there.
So no, I don't see a contradiction here. For instance, I'm running LineageOS on my one phone and stock Android without GApps on my other, so in both cases I'd say I have full control over what's running on my phone. But neither of my phones is rooted.
If they own the phone and that's what they want then it should be available to them.
> Namely, apps can simply request root access and, boom!, they will have it after the mere tap of a button.
How easy the root account should be to access is debatable. I agree that one-tap-root by default without some kind of authentication beyond physical access is probably not the best idea, but I don't think that is what the OP was proposing. The point is that the owner should have root access to customize the software if they want it, without begging anyone's permission (e.g. phones requiring a code from the manufacturer to unlock) or having key features disabled (e.g. "SafetyNet").
> If they own the phone and that's what they want then it should be available to them.
Not if what they want and don't want entirely depends on how well informed they are. Keep in mind that malicious apps do everything to convince their users to grant them the necessary permissions.
> The point is that the owner should have root access to customize the software if they want it, without begging anyone's permission (e.g. phones requiring a code from the manufacturer to unlock) or having key features disabled (e.g. "SafetyNet").
Then we agree. :)
Going back to carrying boatload of cards again is not an option.
Google Pay doesn't (officially) work on rooted phones.
There are lots of other things like that, which is why it makes a lot of sense to ship phones not rooted, while still making it easy to do so.
As the original request was at least partially pointed in Google's direction, it's probably reasonable to treat it as including a request that google not punish the user in other ways for rooting.
I do believe fundamentally that if you don't have (or can't easily get) root on a device, you don't really own it. On the other hand, giving unlimited permission to third-party apps isn't a great idea in today's model where arbitrary app developers are most certainly not worthy of unlimited trust. I'd like to have a more sophisticated permissions model, to include things like allowing an app access to only specific files and directories rather than full filesystem access (I'm aware Android has a barely-usable form of this), or network access, but only to specific domain names.
I think in addition to the focus on hardware, one approach should be to provide the tools to the users for more control. Provide a rooted phone by default. Add tools that let me see what my phone is doing behind the scenes. Give me option to turn-off some of the things I don't like (e.g. an app is sending analytics to some domain, let me turn that part off without turning off the whole app in a relatively simple way). Help with planned obsolence by providing updates etc and so on.
Basically give back some control of jail/castle to the users without asking them to leave it completely.
Edit: one more thing, please add NFC. Going back to carrying boatload of cards again is not an option.