OP didn't say he doesn't like it, just pointing out the reality. But yes, the reality is depressing.

In offering only two choices, when the reality is far more complex than that, GP sets the tone for the rest of the discussion. There are more options, and a far deeper lake of information to use for drawing conclusions, so the simplification is also insulting, on top of being depressing.

If you have other options or other things that should be considered, then add them. As it is, you seem to be dismissing his absolutely valid concerns without any reason as to why you think they're invalid. I have the same concerns as he does and it's the same reason I don't use custom ROMs. I have no way to know how security conscious the developers actually are.

That's a valid concern and only you can judge for yourself whether something works for you or not. It's open source. Read the code and do your research. Going to some project's thread and saying, "But, what if this is shoddy code or run by the FBI ?" is beyond pointless. Praise can be generous. Criticism needs to be conservative and precise.

That's utterly ridiculous and you're clearly arguing in bad faith.

Let's say I do have the infinite amount of time necessary and the technical expertise to conduct an audit of a custom ROM. Is every single person who's interested in privacy and security required to do their own audit?

If I publish my findings, why should anybody ever believe me? Who am I to tell anybody how safe it is? If you think it's so safe, why don't you do an audit and prove it to those of us with doubts instead of expecting us to do it?

Oh, right. You're operating on faith on these groups of people that you don't know who don't have any processes in place to ensure that what they're doing is safe for their users.

I'm not arguing that you or anyone should use this project. All I'm saying is that this line of questioning is not constructive. Sure, an audit is good, but since this hasn't been audited, what will this line of questioning achieve ? You can go to any project's announcement and pose this type of question, and it doesn't add anything. If you have concrete criticism to add, that's fine. This type of vague insinuation is what's in bad faith here.

OP is just saying that audits would be nice, which is true.

Simple answer to a drepressing reality is to say “fuck it”. Build it anyway. If you build it they will come. When Amazon was getting started selling books online - barnes and noble was pretty scary big who would trust paying for something like a book online?? The reality of software is the playing field is always up for grabs. Googles still a great company but how many great engineers are still there? Lot of them have left- still many remain . End rant

That's not really the point though is it? It's more like 'I do like it.. is it sensible to use it?' At least, that's how I read it, and how I feel about such things.

I'd very much like my next phone to run Linux (i.e. be a Pinephone) though.

I got a Pinephone.

I like the idea, but it's a deeply frustrating experience right now. Basic table-stakes features I have come to assume from both Android and iOS platforms just aren't there yet.

It's a frustrating chicken egg problem... I want the thing to succeed, but my smartphone is so critical to my day-to-day that I can either wait for it to get better or invest the time into having it suck on toast while I improve it.

Oh I get that, hence 'would very much like my next to be' vs. rushing 'out' to buy one.

I'd also have to figure out some more specifically personal stuff like alternatives or Matrix bridges for apps I 'need to' use to communicate with certain people.

I was hoping to use Pinephone this year, but nope. I have a 7yo phone with better specs, including a 2.5x faster clock. Yes it's an Android, but ... Maybe next year.

Yup, the PinePhone is still being worked on and quite far from being usable as a daily driver. To be fair, the Pine64 folks are also very clear about this.

> I'd very much like my next phone to run Linux

Why again? Android is already free and open source and Linux doesn't have good answers for the proprietary goodies

I like the level of control and ease of reproducible setup that I have on my desktop, and find my (Android) phone frustrating to use in part because it lacks it.

It's not without trying either, I've worked on and off on a terraform provider for Android - currently apps only but with some vague intention to try to manage as much of settings as possible (not much, AIUI). It's just not meant to be used like that though, of course, and I wish Linux was a viable enough option that, at least among nerds already using Linux for work if nothing else, it didn't need to be justified for use on phones.

> Linux doesn't have good answers for the proprietary goodies

It doesn't need to. The feasible short-term target is feature parity with de-googled AOSP roms, which would still make it plenty useful in a "daily driver" scenario.

Many people run their entire lives off of their phones. Being concerned about security is prudent, not depressing.

How far off of AOSP is CalyxOS though? Given that most Android users are running unaudited carrier & OEM modified ROMs that rarely see updates, a ROM that is very close to upstream AOSP is apt to be much more secure.

Nevermind that many of the apps that Google ships as part of Google Play are not receiving security audits outside of Google, Google is not committing to regularly audit their apps or publish the results, and these apps function as black boxes on your phone, with privileges that most other apps do not have.

Open source software has a better security track record than closed source software run by billion dollar corps.

Does it though? Have you looked at the vast number of vulnerabilities introduced into the Linux kernel in the last 3 years?

>Many people run their entire lives off of their phones

This is the real problem, not the lack of security audits.

Being concerned is being rational just the reality of it that's depressing.

I think theres good reason to be concerned about investing in an OS which doesn't have the kind of well funded security team capable of actively hunting for APTs with rigor and reacting promptly to zero days once they're found.

It is depressing, but phones are unique in that they need to work flawlessly in an emergency which I think is a factor in preventing people from straying from the path "well-travelled".

This is much to my lament as well, because I would love to feel more free to experiment with phone operating systems and hardware addons.