2022-06-27 00:35:36 +01:00
|
|
|
<!DOCTYPE html>
|
|
|
|
|
<html>
|
|
|
|
|
<head>
|
|
|
|
|
<title>Inferencium Network - Blog - FOSS is Working Against Itself</title>
|
2022-10-29 23:54:59 +01:00
|
|
|
<link rel="stylesheet" href="../infnet.css">
|
2022-06-27 00:35:36 +01:00
|
|
|
</head>
|
2022-10-29 03:26:53 +01:00
|
|
|
<div class="sidebar">
|
|
|
|
|
<a class="title">Inferencium Network</a><br>
|
|
|
|
|
<br>
|
|
|
|
|
<br>
|
2022-10-29 23:54:59 +01:00
|
|
|
<div><a href="../about.html">About</a></div>
|
|
|
|
|
<div><a href="../contact.html">Contact</a></div>
|
|
|
|
|
<div><a href="../blog.html">Blog</a></div>
|
|
|
|
|
<div><a href="../source.html">Source</a></div>
|
2022-10-29 03:26:53 +01:00
|
|
|
</div>
|
2022-06-27 00:35:36 +01:00
|
|
|
<body>
|
|
|
|
|
<h1>Blog - #0</h1>
|
|
|
|
|
<br>
|
|
|
|
|
<h2>FOSS is Working Against Itself</h2>
|
|
|
|
|
<br>
|
2022-10-29 17:38:51 +01:00
|
|
|
<p>Posted: 2022-01-27 (UTC+00:00)</p>
|
|
|
|
|
<p>Updated: 2022-10-29 (UTC+00:00)</p>
|
2022-06-27 00:35:36 +01:00
|
|
|
<br>
|
|
|
|
|
<h4>Introduction</h4>
|
2022-10-29 03:26:53 +01:00
|
|
|
<p>The world has become a dangerous, privacy invading, human rights stripping,
|
|
|
|
|
totalitarian place; in order to combat this, people are joining a growing,
|
|
|
|
|
and dangerous, trend, which I will refer to in this post as the "FOSS
|
|
|
|
|
movement".
|
|
|
|
|
With that stated, I will now debunk the misinformation being spread inside
|
2022-06-27 00:35:36 +01:00
|
|
|
of this extremely flawed movement.</p>
|
|
|
|
|
<br>
|
2022-10-29 03:26:53 +01:00
|
|
|
<p>The FOSS movement is an attempt to regain privacy and control over our
|
|
|
|
|
devices and data, but the entire concept of FOSS-only, at the current time,
|
|
|
|
|
is severely, and dangerously, flawed. What the FOSS community does not seem
|
|
|
|
|
to understand is the fact that most FOSS software cares not about security.
|
|
|
|
|
"Security"; keep that word in mind as you progress through this article.
|
|
|
|
|
What is security? Security is being safe and secure from adversaries and
|
|
|
|
|
unwanted consequences; security protects our rights and allows us to
|
|
|
|
|
protect ourselves. Without security, we have no protection, and without
|
|
|
|
|
protection, we have a lack of certainty of everything else, including
|
2022-06-27 00:35:36 +01:00
|
|
|
privacy and control, which is what the FOSS movement is seeking.</p>
|
|
|
|
|
<br>
|
2022-10-29 03:26:53 +01:00
|
|
|
<p>FOSS projects rarely take security into account; they simply look at the
|
|
|
|
|
surface level, rather than the actual root cause of the issues they are
|
|
|
|
|
attempting to fight against. In this case, the focus is on privacy and
|
|
|
|
|
control. Without security mechanisms to protect the privacy features and
|
|
|
|
|
the ability to control your devices and data, it can be stripped away as
|
|
|
|
|
if it never existed in the first place, which, inevitably, leads us back to
|
|
|
|
|
the beginning, and the cycle repeats. With this ideology, privacy and
|
|
|
|
|
control will *never* be achieved. There is no foundation to build privacy
|
|
|
|
|
or control upon. It is impossible to build a solid, freedom respecting
|
2022-06-27 00:35:36 +01:00
|
|
|
platform on this model.</p>
|
|
|
|
|
<br>
|
|
|
|
|
<h4>Example: Smartphones</h4>
|
2022-10-29 03:26:53 +01:00
|
|
|
<p>A FOSS phone, especially so-called "Linux phones" are completely
|
|
|
|
|
detrimental to privacy and control, because they do not have the security
|
|
|
|
|
necessary to enforce that privacy. Unlocked bootloaders prevent the device
|
|
|
|
|
from verifying the integrity of the boot chain, including the OS, meaning
|
|
|
|
|
any big tech or government entity can simply inject malicious code into
|
|
|
|
|
your software and you wouldn't have any idea it was there. If that's not
|
|
|
|
|
enough of a backdoor for you to reconsider your position, how about the
|
|
|
|
|
trivial evil maid and data extraction attacks which could be executed on
|
|
|
|
|
your device, whether with coercion or not? With Android phones, this is
|
|
|
|
|
bad enough to completely break the privacy and control the FOSS movement
|
|
|
|
|
seeks, but "Linux phones" take it a step further by implementing barely any
|
|
|
|
|
security, if any at all. Privilege escalation is trivial to achieve on any
|
|
|
|
|
Linux system, which is the reason Linux hardening strategies often include
|
|
|
|
|
restricting access to the root account; if you root your Android phone, or
|
|
|
|
|
use a "Linux phone", you've already destroyed the security model, and thus
|
|
|
|
|
privacy and control model you were attempting to achieve. Not only are
|
|
|
|
|
these side effects of FOSS, so is the absolutely illogical restriction of
|
|
|
|
|
not being able to, or making it unnecessarily difficult to, install and
|
|
|
|
|
update critical components of the system, such as proprietary firmware,
|
|
|
|
|
which just so happens to be almost all of them. "Linux phones" are not as
|
2022-06-27 00:35:36 +01:00
|
|
|
free as they proclaim to be.</p>
|
|
|
|
|
<br>
|
2022-10-29 03:26:53 +01:00
|
|
|
<p>You may ask "What's so bad about using LineageOS?", to which I answer with
|
2022-06-27 00:35:36 +01:00
|
|
|
"What's not bad about it?".<br>
|
|
|
|
|
<br>
|
|
|
|
|
- LineageOS uses debug builds, not safe and secure release builds.<br>
|
2022-10-29 03:26:53 +01:00
|
|
|
- LineageOS requires an unlocked bootloader. Even when installed on devices
|
|
|
|
|
which support custom Android Verified Boot (AVB) keys, the bootloader cannot
|
|
|
|
|
be locked due to lack of the OS being signed.<br>
|
|
|
|
|
- LineageOS does not install critically important firmware without manual
|
|
|
|
|
flashing, requiring users to perform a second update to install this firmware;
|
|
|
|
|
this likely causes users to ignore the notification or miss firmware
|
|
|
|
|
updates.<br>
|
|
|
|
|
- LineageOS does not implement rollback protection, meaning any adversary,
|
|
|
|
|
from a stranger who picks up the device, to a goverment entity remotely, can
|
|
|
|
|
simply downgrade the OS to a previous version in order to exploit known
|
|
|
|
|
security vulnerabilities.<br>
|
|
|
|
|
<br>
|
|
|
|
|
LineageOS is not the only Android OS (commonly, and incorrectly, referred
|
|
|
|
|
to as a "ROM") with such issues, but it is one of the worst. The only
|
|
|
|
|
things such insecure OSes can provide you are customisation abilities, and
|
|
|
|
|
a backdoor to your data. They are best suited as a development OS, not a
|
2022-06-27 00:35:36 +01:00
|
|
|
production OS.</p>
|
|
|
|
|
<br>
|
|
|
|
|
<h4>Solution</h4>
|
2022-10-29 03:26:53 +01:00
|
|
|
<p>What can you do about this? The answer is simple; however, it does require
|
|
|
|
|
you to use logic, fact, and evidence, not emotion, which is a difficult
|
|
|
|
|
pill for most people to swallow. Use your adversaries' weapons against
|
|
|
|
|
them. The only way to effectively combat the privacy invasion and lack of
|
|
|
|
|
control of our devices and data is to become a renegade and not take sides.
|
|
|
|
|
Yes, that means not taking sides with the closed source, proprietary, big
|
|
|
|
|
tech and government entities, but it also means not taking sides with any
|
|
|
|
|
FOSS entities. The only way to win this war is to take *whatever* hardware
|
2022-06-27 00:35:36 +01:00
|
|
|
and software you can, and use it tactically.</p>
|
|
|
|
|
<br>
|
2022-10-29 03:26:53 +01:00
|
|
|
<p>The only solution for phone security, privacy, and control, is to use
|
|
|
|
|
a Google Pixel (currently, Pixel 4-series or newer) running GrapheneOS. Google
|
|
|
|
|
Pixel phones allow you complete bootloader freedom, including the ability
|
|
|
|
|
to lock the bootloader after flashing a custom OS (GrapheneOS includes a
|
|
|
|
|
custom OS signing key to allow locking the bootloader and enabling verified
|
|
|
|
|
boot to prevent malware persistence, evil maid attacks, and boot chain
|
|
|
|
|
corruption), long device support lifecycles (minimum 3 years for Pixel 3a
|
|
|
|
|
series to Pixel 5a, minimum 5 years for Pixel 6 series), and fast,
|
|
|
|
|
guaranteed security updates for the entire support timeframe of the
|
2022-06-27 00:35:36 +01:00
|
|
|
devices.</p>
|
|
|
|
|
<br>
|
|
|
|
|
<h4>Conclusion</h4>
|
2022-10-29 03:26:53 +01:00
|
|
|
<p>Use what you can, and do what you can. By neglecting security, you are,
|
|
|
|
|
even if unintentionally, neglecting exactly what you are trying to gain;
|
2022-06-27 00:35:36 +01:00
|
|
|
privacy and control.</p>
|
|
|
|
|
<br>
|
|
|
|
|
<br>
|
|
|
|
|
</body>
|
|
|
|
|
</html>
|
