Inferencium/website
1
0
Fork 0
Code Issues Activity

Switch from hyphen-formatted list to HTML unordered list.

Browse Source
This commit is contained in:
inference 2023-03-13 13:44:33 +00:00
parent ac1d8d7180
commit 23e02fa6df
Signed by: inference
SSH Key Fingerprint: SHA256:9Pl0nZ2UJacgm+IeEtLSZ4FOESgP1eKCtRflfPfdX9M
1 changed files with 30 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

51
blog/foss_is_working_against_itself.html
View File

@ -5,7 +5,7 @@
<!-- Copyright 2022-2023 Jake Winters -->
<!-- SPDX-License-Identifier: BSD-3-Clause-Clear -->
<!-- Version: 3.1.2.15 -->
<!-- Version: 3.1.3.16 -->
<html>
@ -41,8 +41,9 @@
<p class="update_date">Posted: 2022-01-27 (UTC+00:00)</p>
<p class="update_date">Updated: 2022-11-09 (UTC+00:00)</p>
<br>
<br>
<!-- Table of contents. -->
<!-- Table of contents. -->
<h2 id="toc"><a href="#toc" class="h2"
>Table of Contents<a/></h2>
<ul>
@ -59,6 +60,8 @@
<li><a href="#conclusion" class="body-link"
>Conclusion</a></li>
</ul>
<br>
<br>
<h4 id=introduction"><a href="#introduction" class="h4"
>Introduction</a></h4>
@ -95,10 +98,10 @@
>ideology</a>, privacy and control will *never* be achieved. There is no foundation to build privacy
or control upon. It is impossible to build a solid, freedom respecting platform on this model.</p>
<br>
<br>
<h4 id="examples"><a href="#examples" class="h4"
>Examples</a></h4>
<br>
<h5 id="examples-smartphones"><a href="#examples-smartphones" class="h5"
>Smartphones</a></h5>
<p>A FOSS phone, especially so-called
@ -135,29 +138,33 @@
<a class="body-link" href="https://lineageos.org/"
>LineageOS</a>?", to which I answer with "What's not bad about it?".<br>
<br>
- LineageOS uses
<a class="body-link" href="https://github.com/LineageOS/hudson/blob/master/lineage-build-targets"
>debug builds</a>, not safe and secure release builds.<br>
- LineageOS requires an unlocked bootloader. Even when installed on devices which support custom
Android Verified Boot (AVB) keys, the bootloader cannot be locked due to lack of the OS being
signed.<br>
- LineageOS does not install critically important firmware without manual flashing, requiring users
to perform a second update to install this firmware; this likely causes users to ignore the
notification or miss firmware updates.<br>
- LineageOS does not implement
<a class="body-link" href="https://source.android.com/docs/security/features/verifiedboot/
verified-boot#rollback-protection"
>rollback protection</a>, meaning any adversary, from a stranger who physically picks up the device,
to a goverment entity remotely, can simply downgrade the OS to a previous version in order to
exploit known
<a class="body-link" href="https://en.wikipedia.org/wiki/Vulnerability_(computing)"
>security vulnerabilities</a>.<br>
<ul>
<li>LineageOS uses
<a class="body-link" href="https://github.com/LineageOS/hudson/blob/master/lineage-build-targets"
>debug builds</a>, not safe and secure release builds.</li>
<li>LineageOS requires an unlocked bootloader. Even when installed on devices which support custom
Android Verified Boot (AVB) keys, the bootloader cannot be locked due to lack of the OS being
signed.</li>
<li>LineageOS does not install critically important firmware without manual flashing, requiring users
to perform a second update to install this firmware; this likely causes users to ignore the
notification or miss firmware updates.</li>
<li>LineageOS does not implement
<a class="body-link" href="https://source.android.com/docs/security/features/verifiedboot/
verified-boot#rollback-protection"
>rollback protection</a>, meaning any adversary, from a stranger who physically picks up the device,
to a goverment entity remotely, can simply downgrade the OS to a previous version in order to
exploit known
<a class="body-link" href="https://en.wikipedia.org/wiki/Vulnerability_(computing)"
>security vulnerabilities</a>.</li>
</ul>
<br>
LineageOS is not the only Android OS (commonly, and incorrectly, referred to as a "ROM") with such
<p>LineageOS is not the only Android OS (commonly, and incorrectly, referred to as a "ROM") with such
issues, but it is one of the worst. The only things such insecure OSes can provide you are
customisation abilities, and a backdoor to your data. They are best suited as a development OS, not
a production OS.</p>
<br>
<br>
<h4 id="solution"><a href="#solution" class="h4">Solution</a></h4>
<p>What can you do about this? The answer is simple; however, it does require you to use logic,
fact, and evidence, not emotion, which is a difficult pill for most people to swallow. Use your
@ -187,6 +194,8 @@
<a class="body-link" href="https://source.android.com/docs/security/bulletin/pixel/"
>guaranteed monthly security updates</a> for the entire support timeframe of the devices.</p>
<br>
<br>
<h4 id="conclusion"><a href="#conclusion" class="h4">Conclusion</a></h4>
<p>Use what you can, and do what you can. By neglecting security, you are, even if unintentionally,
neglecting exactly what you are trying to gain; privacy and control.</p>