Re:Ask HN: Stock Android phone free of bloatware?
by predictabl3 on Friday June 30, 2023 @04:20PM
(#36541647)
Except that popular chipsets (ie: get community support due to device saturation) do see vulnerabilities published past the point of support. I trust Qualcomm's ability to develop their modem driver (which is an entire Linux install) very little, and I trust it's ability to stand the test of time to be even less.
I'm not sure I'm saying it's a total loss, but I feel a bit lost on what to do as well. Do I think Google will support their Tensor chips longer? Not really.
I feel like I still lean towards buying a portable hotspot, a small Android tablet, and calling it good. I already get calls over VOIP and SMS/MMS over jmp.chat so I don't really need a "cellular phone". But also, ugh, those portable hotspots are probably even more of a vendor-ware security nightmare. At least I could upgrade them independently and somewhat treat it as isolated, if I only connect over Wifi? Maybe?
Re:Ask HN: Stock Android phone free of bloatware?
by jqpabc123 on Friday June 30, 2023 @05:21PM
(#36542478)
If the mere possibility of a bug is a show stopper, you really shouldn't use anything because this possibility always exists --- with all hardware and software.
Re:Ask HN: Stock Android phone free of bloatware?
by predictabl3 on Friday June 30, 2023 @09:27PM
(#36545261)
I think there's a difference in saying "software tends to be buggy, security can't be perfect" vs "I'm using a baseband modem running out-of-date Linux, that has DMA to my entire phone, that the manufacturer has stopped supporting, and there's active CVEs".
> Without physical possession of the device, access to drivers passes through the OS.
With all due respect, that is not a wise take on modern device security. At all, all, all.
See here: https://e.foundation/
Do they just allow older phones to run newer versions of Android, albeit without full security updates?
The "full security updates" GrapheneOS references has to do with proprietary device drivers. This is an unrealistic over-reaction in my opinion.
Why abandon perfectly functional hardware based on some unknown possibility that exists with both old and new hardware? Newer, supported devices could easily have these same sort of issues. They really don't know and the OEM does not offer any guarantee or certification otherwise.
Most security issues occur in the OS or can be mitigated in the OS. Without physical possession of the device, access to drivers passes through the OS.