Andromxda

joined 8 months ago
MODERATOR OF
[–] Andromxda@lemmy.dbzer0.com 22 points 4 months ago* (last edited 4 months ago) (1 children)

Yes, GrapheneOS only works on Pixel devices, because the project has some pretty extensive hardware security requirements: https://grapheneos.org/faq#future-devices

The Fairphone is a highly insecure device, which comes nowhere close to the (hardware) security of a Pixel. On top of that, the Fairphone company doesn't even know how to maintain their own Fairphone OS. The verified boot implementation is fundamentally broken and very misleading, since it's signed with the publicly available (!!!) AOSP test private keys. This is such a blatant disregard of security practices, that should have made it impossible to certify their devices. It's not a surprise either that Fairphone regularly misses important Android security patches, or delivers them months later. That's also why GrapheneOS will never support devices like the Fairphone. There are more issues with Fairphone's misleading update policy that I haven't covered in detail.

I highly recommend against purchasing such insecure, and poorly maintained hardware. DivestOS is the best option for "damage control", if you already own a Fairphone. Its developer actually cares about users and their security, and the OS is properly signed.

[–] Andromxda@lemmy.dbzer0.com 15 points 4 months ago (2 children)

There's also SCEE, a more advanced version of StreetComplete, and Vespucci, another very powerful application for submitting OSM entries.

[–] Andromxda@lemmy.dbzer0.com 3 points 4 months ago (1 children)

Couldn't you just use a VPN? Hiding your IP address also increases your privacy. Mullvad VPN is one of the best, most private and trustworthy VPNs, and it's just 5 bucks a month. You don't even need an email address to sign up, and you can pay anonymously with crypto.

[–] Andromxda@lemmy.dbzer0.com 2 points 4 months ago

It really is as private as it can be, and the developer is really dedicated to improve user privacy. Other solutions (SUPL, PSDS) aren't much better in terms of privacy. And it's definitely not a solution in search of a problem, as pure GNSS is really slow and consumes a lot of battery. You can try this out yourself if you use GrapheneOS, by going into the location settings and disabling both SUPL and PSDS. I tried it, and I can tell you that it's bad (in my opinion unusable).

[–] Andromxda@lemmy.dbzer0.com 3 points 4 months ago (2 children)

GNSS does work, but it can take a pretty long time to acquire an initial location without PSDS and SUPL. It also uses much more battery. This can especially become an issue if you want to share your live location with somebody, or record your workout over a longer period of time. There are technologies like A-GNSS (Assisted GNSS) that use SUPL (Secure User Plane Location) and PSDS (Predicted Satelite Data Service), but these also require you to send your location to a third party (the default SUPL service on Android is supl.google.com, which is definitely much worse for your privacy than any NLP). GrapheneOS hosts a proxy at supl.grapheneos.org, which is much more private (see GrapheneOS's privacy policy for all their network services: https://grapheneos.org/faq#privacy-policy). PSDS isn't much better, as it's usually provided by the manufacturer of your phone's SoC (e.g. Qualcomm, Broadcom or Samsung). PSDS also sends a lot of data to the service, including SoC serial number and information on the phone including manufacturer, brand and model. GrapheneOS improves the privacy of PSDS (you can read more about all of this at https://grapheneos.org/faq#default-connections), but I still don't see how this would be better than a privacy-friendly network location provider. beaconDB is still in a pretty early phase of development, but it's likely going to be used by GrapheneOS when it becomes more stable. It's also likely, that the GrapheneOS project will either host their own proxy for the public beaconDB service, or their own server using beaconDB data. That way, it would be even more private, and it would be covered under Graphene's privacy-policy, which is essentially just the EFF's privacy-friendly Do Not Track (DNT) policy.

[–] Andromxda@lemmy.dbzer0.com 4 points 4 months ago (4 children)

there’s simply typing in the location I want to know about

That's not always possible. Imagine you're visiting a city that you've never been to, or you go hiking in the mountains, or you go to another country that uses a different alphabet, so you can't type in a street name or something like that. There are many more use cases like sharing your location with someone else (for example over Signal), tracking your workout (for example when cycling or going on a run) using an app like OpenTracks, or if you like saving geolocation to your photos.

[–] Andromxda@lemmy.dbzer0.com 6 points 4 months ago (6 children)

Using a location service obviously means that this service is going to know your location. beaconDB already minimizes the data that is collected about users. There's not much else that can be done to make these kinds of services more private. The other options (Google and Apple) are much worse. The only alternative is not using a network location service at all, and simply relying on GNSS + PSDS and SUPL, like GrapheneOS does by default. I'd say beaconDB is the next best option, much better than proprietary alternatives and on par with the now defunct Mozilla Location Service.

[–] Andromxda@lemmy.dbzer0.com 1 points 4 months ago (1 children)

On a desktop/laptop (or really anywhere I can run CLI apps and use a proper keyboard) it's mostly plain text files in Vim or Emacs. On my phone I recently switched from Standard Notes to Notesnook. Standard Notes is pretty powerful, uses end-to-end encryption by default, and can be self-hosted. The premium subscription is pretty expensive though. (Yes, it also requires a license when self-hosting. It's cheaper, but still kinda expensive). Last year, there was also some controversy about the licensing. They recently got acquired by Proton.

Notesnook is fully FOSS, but they still haven't released a self-hostable sync server. They are working on it though. It's currently my go-to option.

I just discovered a new app called Beaver Notes that I'm very excited to try out.

Joplin is another great option, it's available on all platforms and even has a CLI, it also supports E2EE, but it has to be enabled manually. Can be self-hosted: https://github.com/etechonomy/joplin-server. I think I will switch to self-hosted, end-to-end encrypted Joplin in the long term, so I can have all my notes unified in one app. The CLI app is really useful for me, as I already use the Terminal to take notes when using a desktop/laptop.

[–] Andromxda@lemmy.dbzer0.com 4 points 4 months ago (8 children)

beaconDB doesn't log location requests, and it anonymizes location submissions, making it much more privacy-friendly than Google's or Apple's location services

[–] Andromxda@lemmy.dbzer0.com 1 points 4 months ago (1 children)

What other things does Valve work on?

[–] Andromxda@lemmy.dbzer0.com 6 points 4 months ago (4 children)

I just read that it's 80 people, which one is true now? https://lemmy.dbzer0.com/post/24263263

view more: ‹ prev next ›