News for hackers. Stuff that matters.
Re:Apple enabling client-side CSAM scanning on iPhone tomorrow by regnull on Thursday August 05, 2021 @09:23AM (#28073379)
The solution is to go back to the original spirit of the Internet, when it was a set of open standards connecting people and organizations. Somehow it got forgotten and now we have a bunch of commercial companies giving you the same stuff in exchange for your privacy and who increasingly control everything you do.
Re:Apple enabling client-side CSAM scanning on iPhone tomorrow by zepto on Thursday August 05, 2021 @09:47AM (#28073659)
The spirit of the internet won’t generate secure hardware or a transparent software stack.

Also, that spirit existed only in an adversary free environment. You may as well say the solution is for everyone to be nice to each other.

The solution is to build new technologies that are privacy preserving, transparent, don’t place trust in a central authority but are resistant to attack.

This is possible but nobody has built it yet.

Re:Apple enabling client-side CSAM scanning on iPhone tomorrow by relax88 on Thursday August 05, 2021 @09:57AM (#28073801)
You could run Mobian or similar on a phone from Purism/Pine/etc.

Problem is you end up with a vastly inferior hardware device that costs nearly as much as an iPhone.

I’m still waiting for my Librem 5 preorder.

Would love to hear if anyone is actually using a Linux phone and enjoying it.

Re:Apple enabling client-side CSAM scanning on iPhone tomorrow by kop316 on Thursday August 05, 2021 @11:56AM (#28075511)
> Problem is you end up with a vastly inferior hardware device that costs nearly as much as an iPhone.

The Pinephone is $150/$200.

> Would love to hear if anyone is actually using a Linux phone and enjoying it.

I have one, and I throughly enjoy it! One of the neatest things about it, and I still have to wrap my head around it, is that it can do anything you can do on a desktop. SSH? No problem? Dev environment? "apt install build-essentials". Want to install XFCE? Knock yourself out!

It is still missing MMS, which is why I don't use it daily, but that should be changing much sooner than later.

Re:Apple enabling client-side CSAM scanning on iPhone tomorrow by m4rtink on Thursday August 05, 2021 @05:12PM (#28079916)
Exactly! Speaking from the Sailfish OS perspective but thats essentially also a normal Linux distro. It's just so refreshing that studs behaves in logical and introspective manner - have an issue ? Check journal, there will most likely be some hints! Need to transfer data ? Mount the device via sshfs!

In comparison my Galaxy Tab S6 is just so much more black box and some stuff just does not work with no apparent way to debug! Like, I tried to setup a samba or SSH server on it for easy data transfer, with zero success after trying all the related apps in frdoid and elsewhere. It just does not work at all! Most likely some brain dead "security" option one can't override 2without rooting the device that is impossible to track down in the mess that is Android.

Re:Apple enabling client-side CSAM scanning on iPhone tomorrow by kop316 on Thursday August 05, 2021 @05:40PM (#28080292)
Honestly after using Android for so long too, even just AOSP has gotten much more user hostile.

Running root used to be very simple and semi-sanctioned. Now you have to essentially rootkit your phone (Magisk) for it.

Most of the AOSP programs are abandoned (thankfully ROM maintainers update them!), and you have to deal with a lot of things not working with Google Play.

Re:Apple enabling client-side CSAM scanning on iPhone tomorrow by zepto on Thursday August 05, 2021 @12:34PM (#28076033)
> One of the neatest things about it, and I still have to wrap my head around it, is that it can do anything you can do on a desktop. SSH? No problem? Dev environment? "apt install build-essentials". Want to install XFCE? Knock yourself out!

You can do all these things with a $10 raspberry pi-w. It’s not obvious why it helps with having security and privacy.

Re:Apple enabling client-side CSAM scanning on iPhone tomorrow by kop316 on Thursday August 05, 2021 @12:53PM (#28076331)
Respectfully, I think you missed the point of my reply.

The person asked: "Would love to hear if anyone is actually using a Linux phone and enjoying it."

...so I responded about what I enjoy about using a "Linux Phone". A "$10 raspberry pi-w" is not a Linux Phone.

The question didn't address "security and privacy", so I didn't add it. Though, since you brought it up, I will answer how the Pinephone "helps with having security and privacy".

- I have hardware (cut physical power) switches to kill the Microphone, cameras (independent for front and back), and Wifi/Bluetooth.

- I am running a full GNU/Linux distro that I have a lot more confidence in their want to protect users security/privacy.

- I can run software of my choosing on it (the Pinephone actually defaults to booting on an SD card! so it encourages you to experiement with OSes).

- There is serious effort to run the mainline Linux kernel on it, so it will not be artifically obsolete in 3-5 years (or be sutck on running some ancient swiss cheese kernel in 5 years like my old Pixel/Nexus devices).

- I don't have to install/link to some opaque binaries to even boot the system.

I'm sure I can think of more, but that's all I have for now.

Re:Apple enabling client-side CSAM scanning on iPhone tomorrow by zepto on Thursday August 05, 2021 @12:56PM (#28076378)
Fair enough - I fully agree it would be enjoyable for a Linux enthusiast. I have had one on my shopping list for some time, but I want to use it as a daily driver and since most people say it isn’t ready for that, slightly lower level projects keep winning out.
Re:Apple enabling client-side CSAM scanning on iPhone tomorrow by kop316 on Thursday August 05, 2021 @01:09PM (#28076540)
> I want to use it as a daily driver

What I have encountered is the requirements for it being a daily driver are user specific. I have seen a fair amount of users say "I need $FOO app to work", where $FOO is some an app only developed for Android/iOS (a common one is a banking app, there is almost no way that company will support a Linux phone). So I guess I would ask what your requirements are before I can say if it is daily driver ready or not.

My threshold for it being a "daily driver" is if I can fully replace the "phone" features of my Android phone, which for me, is: Calling, SMS, MMS, Voicemails. MMS is not yet UI functional, but will be sooner than later.

The good news is I am seeing the Linux Phone movement be a positive feedback loop: the more features add, the more users, and the more folks helping to add features.

Re:Apple enabling client-side CSAM scanning on iPhone tomorrow by zepto on Thursday August 05, 2021 @01:18PM (#28076676)
Sure - for me (and likely >99.9% of people), from what I have read, it is clearly not ready. I’m a heavy phone user in most respects. For me it would have to start as a hobby project.
Re:Apple enabling client-side CSAM scanning on iPhone tomorrow by m4rtink on Thursday August 05, 2021 @05:04PM (#28079807)
I have been using a Linux smartphone since 2010 an I certainly do enjoy it - first Nokia N900 & N9 followed by a series of Sailfish OS[0][1] devices, with Xperia 10 II with Sailfish X[2] being the latest one.

[0] https://en.m.wikipedia.org/wiki/Sailfish_OS

[1] https://sailfishos.org/

[2] https://shop.jolla.com/

Re:Apple enabling client-side CSAM scanning on iPhone tomorrow by zepto on Thursday August 05, 2021 @10:00AM (#28073831)
This is clearly a good thing to do and supporting those projects is great.

So far though, they do nothing to solve the problems we are talking about. The software is not anywhere near audited, and even if it were, you are still interacting with people and services who are using unaudited software.

Re:Apple enabling client-side CSAM scanning on iPhone tomorrow by kop316 on Thursday August 05, 2021 @12:41PM (#28076143)
> The software is not anywhere near audited

Many of the projects leverage a well known OS as their base (e.g. pmOS uses Alpine Linux, Mobian uses Debian), and actively ensure that anything that can be upstreamed is upstreamed. So it's not like you're downloading some random ROM off of XDA.

Re:Apple enabling client-side CSAM scanning on iPhone tomorrow by zepto on Thursday August 05, 2021 @01:22PM (#28076746)
That doesn’t make the system audited. The obvious reason we don’t hear more about the weaknesses is that no high value targets are using these systems, so it’s not worth exploiting them.
Re:Apple enabling client-side CSAM scanning on iPhone tomorrow by m4rtink on Thursday August 05, 2021 @05:21PM (#28080032)
Um, these distros are normally used to run like half the Internet, they are very valuable targets today and I don't think putting them on a phone changes the threat environment so much.
Re:Apple enabling client-side CSAM scanning on iPhone tomorrow by zepto on Thursday August 05, 2021 @05:50PM (#28080422)
The threat environment is utterly different between an individual person’s phone and an anonymous server behind a firewall on the internet.

It’s not even close.

Re:Apple enabling client-side CSAM scanning on iPhone tomorrow by regnull on Thursday August 05, 2021 @10:34AM (#28074268)
> The solution is to build new technologies that are privacy preserving, transparent, don’t place trust in a central authority but are resistant to attack.

I actually completely agree with this.

> This is possible but nobody has built it yet.

Doesn't mean we should stop trying. Here's my $0.02 - I've been building an email solution based on Self-Sovereign Identity ideas, still in progress, but check it out: https://ubikom.cc or https://github.com/regnull/ubikom

Re:Apple enabling client-side CSAM scanning on iPhone tomorrow by zepto on Thursday August 05, 2021 @10:47AM (#28074454)
> Doesn't mean we should stop trying.

Who is suggesting ‘stopping trying’?

To me the only thing that sounds like ‘stopping trying’ is boycotting Apple, as though that has anything whatsoever to do with the problem.

It doesn’t matter what vendor you use. The only thing you can do to help is to identify parts of the solution, explain them, and build them.

I don’t have time to check out your email solution but I hope it is part of the solution.

Re:Apple enabling client-side CSAM scanning on iPhone tomorrow by OOPMan on Thursday August 05, 2021 @09:42AM (#28073613)
Indeed. And, amusingly enough, most of the open standards stuff still exists too.
Re:Apple enabling client-side CSAM scanning on iPhone tomorrow by JKCalhoun on Thursday August 05, 2021 @10:59AM (#28074645)
It's when we substituted corporate mobile transmission for the "internet".

It became, "Sorry, AT&T carrier, AT&T rules."