zlacker

[parent] [thread] 22 comments
1. bsimps+(OP)[view] [source] 2025-01-04 00:41:44
Tangential, but:

I often wonder how secure these open source projects actually are. I'm curious about using Waydroid in SteamOS, but it looks like it only runs LineageOS (apparently a derivative of CyanogenMod).

I know that people claim that open source is more secure because anyone can audit it, but I wonder how closely its security actually interrogated. Seems like it could be a massive instance of the bystander effect.

All of it gives me a bias towards using official sources from companies like Apple and Google, who presumably hire the talent and institute the processes to do things right. And in any case, having years/decades of popularity is its own form of security. You know anyone who cares has already taken shots at Android and iOS, and they're still standing.

replies(7): >>mid-ki+62 >>Dalewy+82 >>okanat+r2 >>pserwy+6m >>Idesmi+sP >>LtWorf+e01 >>graeme+Nb1
2. mid-ki+62[view] [source] 2025-01-04 00:59:44
>>bsimps+(OP)
Google isn't gonna build a ROM for waydroid so someone's going to have to make a build of Android, whom you'll have to trust. Google doesn't build ROMs for anything but their own phones.

LineageOS is popular in this field because in essence it's a derivative of AOSP (the Android project as shipped by Google) with modest modifications to support a crapload of devices, instead of the handful that AOSP supports. This makes it easier to build and easier to support new platforms.

The bulk of the security in AOSP (and thus, LineageOS) comes from all the mitigations that are already built into the system by Google, and the bulk of the core system that goes unmodified. The biggest issue is usually the kernel, which may go unpatched when the manufacturer abandons it (just like the rest of the manufacturer's ROM), and porting all the kernel modifications to newer versions is often incredibly tricky.

replies(1): >>tredre+AZ
3. Dalewy+82[view] [source] 2025-01-04 00:59:53
>>bsimps+(OP)
>I know that people claim that open source is more secure because anyone can audit it, but I wonder how closely its security actually interrogated.

The answer is that, no, nobody akshuarry audits anything. This has been proven time and time again, especially in the last few years.

>All of it gives me a bias towards using official sources from companies like Apple and Google, who presumably hire the talent and institute the processes to do things right.

What you get from commercial vendors is liability, you get to demand they take responsibility because you paid them cold hard cash. Free products have no such guarantees, you are your own liability.

replies(3): >>mid-ki+l3 >>graeme+Md >>yjftsj+Kt
4. okanat+r2[view] [source] 2025-01-04 01:02:27
>>bsimps+(OP)
I think most of the Open Source projects are inadequate from security PoV but they are not at a place that can do harm.

Android is extremely complex so I think many of the custom ROMs possibly have some security rookie mistakes and quite a bit security bugs due to mishmash of drivers. Android is still better than most of the Linux distros due to its architecture though. The default setup of many distros doesn't have much isolation if at all.

replies(1): >>yjftsj+zt
◧◩
5. mid-ki+l3[view] [source] [discussion] 2025-01-04 01:08:57
>>Dalewy+82
And we've seen time and time again how that liability "harms" them when they whoopsie daisy leak a bunch of data they shouldn't have gathered in the first place...
◧◩
6. graeme+Md[view] [source] [discussion] 2025-01-04 02:56:09
>>Dalewy+82
What liability? How do they take responsibility if there is a security flaw?
replies(1): >>fl0id+8O
7. pserwy+6m[view] [source] 2025-01-04 04:38:03
>>bsimps+(OP)
While this is true of many projects, F-Droid has a track record of sourcing funding for security audits. To date there have been at least three audits, in 2015, 2018, and 2022.

https://www.opentech.fund/security-safety-audits/f-droid/

https://f-droid.org/2018/09/04/second-security-audit-results...

https://f-droid.org/2022/12/22/third-audit-results.html

I was involved in addressing in issues identified in the first one in 2015. It was a great experience, much more thorough than the usual "numerous static analysers and a 100 page PDF full of false positives that you often receive.

replies(1): >>udev40+kx
◧◩
8. yjftsj+zt[view] [source] [discussion] 2025-01-04 06:29:41
>>okanat+r2
> so I think many of the custom ROMs possibly have some security rookie mistakes and quite a bit security bugs due to mishmash of drivers

I would easily believe that many Android systems have vulnerabilities owing to the horrific mess that is their kernel situation. That said, I personally doubt that aftermarket ROMs are worse than stock, as official ROMs are also running hacked up kernels.

replies(1): >>ignora+Hx
◧◩
9. yjftsj+Kt[view] [source] [discussion] 2025-01-04 06:31:52
>>Dalewy+82
> The answer is that, no, nobody akshuarry audits anything. This has been proven time and time again, especially in the last few years.

Sooo how about the audits linked in >>42592444 ?

◧◩
10. udev40+kx[view] [source] [discussion] 2025-01-04 07:28:30
>>pserwy+6m
I'm surprised that several audits didn't uncover this signing issue. GrapheneOS devs do not recommend f-droid. Instead, Play Store is the safest option for now, after Aurora Store
replies(2): >>cenamu+UA >>t0bia_+IU
◧◩◪
11. ignora+Hx[view] [source] [discussion] 2025-01-04 07:32:22
>>yjftsj+zt
> ...owing to the horrific mess that is their kernel situation.

Do you mean OEM drivers or the Android Kernel, specifically?

Google invests quite a bit on hardening the (Android Commons) Kernel including compile-time/link-time & runtime mitigations (both in hardware & software).

Ex: https://android-developers.googleblog.com/2018/10/control-fl...

replies(1): >>yjftsj+HL1
◧◩◪
12. cenamu+UA[view] [source] [discussion] 2025-01-04 08:22:28
>>udev40+kx
But their goals are also kinda opposed, software security with not much concerns paid to freedom.
replies(1): >>udev40+cF
◧◩◪◨
13. udev40+cF[view] [source] [discussion] 2025-01-04 09:17:47
>>cenamu+UA
What? That's so not true. They give heavy preference to security because without it, your freedom and privacy has no value
replies(2): >>fl0id+2G >>t0bia_+SU
◧◩◪◨⬒
14. fl0id+2G[view] [source] [discussion] 2025-01-04 09:31:23
>>udev40+cF
Well yeah so Theo goals are opposed. F-droid is foss first and probably say proprietary illusion of security has no value ;)
◧◩◪
15. fl0id+8O[view] [source] [discussion] 2025-01-04 11:52:01
>>graeme+Md
Especially as many licenses have liability disclaimers. Sure some enterprise stuff etc will have stronger guarantees etc but not by default probably
16. Idesmi+sP[view] [source] 2025-01-04 12:12:50
>>bsimps+(OP)
> CyanogenMod

Has been dead for 8+ years. LineageOS is its own thing by now.

> anyone who cares has already taken shots at Android and iOS

LineageOS is based on AOSP, plus some modifications that do not affect security negatively.

◧◩◪
17. t0bia_+IU[view] [source] [discussion] 2025-01-04 13:32:31
>>udev40+kx
Aurora Store downloads apk files directly from gplay servers, why it should be less safe than Play Store?
◧◩◪◨⬒
18. t0bia_+SU[view] [source] [discussion] 2025-01-04 13:34:22
>>udev40+cF
How can you trust proprietary software, when you cannot inspect code? It's just a blind trust.
replies(1): >>gruez+w51
◧◩
19. tredre+AZ[view] [source] [discussion] 2025-01-04 14:37:11
>>mid-ki+62
> Google doesn't build ROMs for anything but their own phones.

Are you suggesting that ROMs provided through Android Studio's emulator are somehow not built by Google?

20. LtWorf+e01[view] [source] 2025-01-04 14:42:12
>>bsimps+(OP)
They have a much better track record of apple, microsoft, google and so on…
◧◩◪◨⬒⬓
21. gruez+w51[view] [source] [discussion] 2025-01-04 15:26:14
>>t0bia_+SU
You don't have to. On grapheneos google play service isn't given special privileges and is sandboxed like any other normal app.
22. graeme+Nb1[view] [source] 2025-01-04 16:23:52
>>bsimps+(OP)
> I know that people claim that open source is more secure because anyone can audit it, but I wonder how closely its security actually interrogated. Seems like it could be a massive instance of the bystander effect.

It depends on the software. Something widely used and critical to people who are willing to put resources in is a lot more likely to be audited. Something that can be audited has got to be better than something that cannot be.

> All of it gives me a bias towards using official sources from companies like Apple and Google, who presumably hire the talent and institute the processes to do things right.

I am not entirely convinced about that, given the number of instances we have of well funded companies not doing it right.

> You know anyone who cares has already taken shots at Android and iOS, and they're still standing.

There has been quite a lot of mobile malware and security issues, and malicious apps in app stores. Being more locked down eliminates some things (e.g. phishing to install malware) but they are far from perfect.

◧◩◪◨
23. yjftsj+HL1[view] [source] [discussion] 2025-01-04 21:38:56
>>ignora+Hx
The drivers; last I heard, literally every Android device on the market was using a forked kernel in order to support its hardware. And Google keeps trying things to improve that situation, but... https://lwn.net/Articles/680109/ was ~9 years ago and since then not even Google themselves have managed to ship a device running a mainline kernel. Supposedly it should get better with their latest attempt to just put drivers and user space, but 1. I haven't heard of any devices actually shipping with an unmodified kernel, probably because 2. AIUI that doesn't cover all drivers anyways.
[go to top]