• 1 Post
  • 27 Comments
Joined 3 years ago
cake
Cake day: April 19th, 2022

help-circle











  • applications from the Play Store or App Store are something people have to get and use everyday

    I haven’t made the full switch to mobile Linux yet, but my Android phone has 0 proprietary apps besides the firmware and it’s 100% usable

    in my country, if you exclude browser-based banking no bank will work

    Well, the question is why are you excluding web banking? While it’s less convenient at times, banking apps collect every piece of info about you they possibly could collect, they try to prevent you from “messing” not only with the banking app, but with the phone itself - they are one of the most egregious cases of “normalized privacy invasion”, so web banking is much preferable to banking apps. If you’re allergic to webapps for some reason (which would be a very weird thing to say for someone who installs banking apps), fine, switch to a bank that allows doing operations via SMS (that’s the only feature I miss from Sberbank).

    the NFC / contactless payment system here requires either Apple Pay, Google Wallet or a proprietary app develop by a banking alliance

    Why are you using contactless payment? Unsatisfied with the amount of data your bank collects, you want to give the same data to Apple/Google? What’s the problem with just carrying a card with you? I genuinely don’t understand. This certainly isn’t a “100% unavoidable requirement”, but just a fad you didn’t even think whether you could do without

    Govt provides electronic versions of your identity card, driving license and a ton of other cards related to the govt that also require an Android/iOS app they make…

    That’s absolutely true, which is egregious. You should petition your government to open-source those apps (public money = public code), you should reverse engineer those apps to get their functionality without the proprietary code (if they just show a barcode/qr code/picture, it’s easy, but it gets harder if it uses NFC). Either way, this isn’t something you “need”, as carrying your documents around really isn’t a problem… for me, anyway, YMMV I guess

    Even something simple like setting up a TP-Link Tapo wireless security camera will require an app these days.

    …first you buy an IoT device that connects to “the cloud”, then you say you need proprietary software to access it. Of course you do, that’s the kind of device you bought - the vast majority of IoT devices are made with zero regard to the user’s privacy and security, to hackability or right to repair.

    That said, it’s very easy to find hackable devices if you do the bare minimum research. Examples from my home - Valetudo (FOSS robot vacuum firmware) on Viomi V2 Pro, Tasmota (ESP32 firmware) on an AiYaTo light bulb. This is not a problem with mobile Linux, but rather you choosing a device that’s made to collect data from your phone.

    In conclusion, everything you listed so far isn’t a problem with mobile Linux, but a problem with your approach to software/hardware freedom. Chances are, you aren’t a hacker, and by extension aren’t a part of the target audience of a Linux phone. That’s fine, but don’t pretend there’s some insurmountable barrier preventing anyone from using it - it’s just that you don’t need it. Waydroid exists, which makes all of the claims in your comment invalid (besides maybe banking apps which may detect Waydroid), but you won’t consider Linux phones viable anyway - because, again, you don’t need it.









    • full disk encryption on everything except the router (no point in encrypting the router)
      • the server doesn’t have a display connected for obvious reasons, so I’m manually unlocking it via ssh on each boot
        • obviously, the SSH keys are different, so the server has a different IP in initrd. That said, I still don’t have any protection against malicious modification of initrd or UEFI
    • the server scans all new SSL certificates in realtime using certspotter and notifies me of any new certificates issued for my domains that it doesn’t know about (I use Cloudflare so it triggers relatively often, but I still do checks on who the issuer is)
    • firewall blocks outgoing 25 so nobody can impersonate my mailserver