Océane (@oceane)

Me: "You literally cannot trust your cellphone, obviously."

Friend: "That sounds kinda paranoid..."

Me, blinking: "I do not understand how you go through life, day after day, completely unaware of REPORTED reality all around you. It's truly incredible to me."

@AnarchoNinaWrites I'd rather trust a device running fully free software, like my ThinkPad running GNU Guix, because I'm probably not worth a six-figures zero-day, and there's no proprietary software accessing to my personal data. Everything that runs on my computer is transparent, cannot be easily forged, and can be challenged anyway, by compiling each program and verifying it matches the substitutes' checksums.

I'd trust a phone running on the same principles, but no such thing exists ATM, the Replicant compatibility page is pretty scarce. And I don't even have a working wifi card on my laptop.

1/2

@AnarchoNinaWrites I love this, because I'm struggling with an IT addiction, so whatever helps me to put distance between social media and my use of my computer it a good thing. I can do most of my work offline anyway – reading the news, checking my emails, writing stuff, reading ebooks, etc.

But most people will get scared of IT literacy because (1) there's an untold free/open source software divide, where free software is a community of both users and developers, will give users the resources they need to start working with the developers, etc., while open source users will work for the developers, (2) open source users and IT in general lack transparency about the education materials (books) one needs to read to become a better infrastructure maintainer, developer, etc.; (3) Twitter is professional software, useful to white collar workers, and terrible for high school students, with no intellectual project and no idea of why they're using it or where they're heading to, in terms of personal/professional projects, etc.; likewise, a lot of open source software is professional software, and open source users will fall for it, even if they lack the educative materials they need, and even if forcing themselves to use them will put them into depression, because (4) as far as I know, rationality is the minimal coherence of action to individual goals, values, affects, and traditions (Déchaux's interpretation of Weber's theory of rationality); however, as affordances are non-living entities letting us access to biocognitive resources, an environment where they're inaccessible being frustrating and motivating, while an environment where they're absent being depressing, projecting one's social media (as professional software) addiction into professional open source software such as sway, IMHO, is a strong factor of depression; there's evidence of a high rate of depression on 4chan and especially among its Archlinux users, because Archlinux is a distribution developed for IT professionals.

So I can totally understand the sort of existential dread one would feel by getting exposed to how unreliable consumer-grade phones and computers are.

2/2

@oceane @AnarchoNinaWrites There's the pinephone people (i think they may have changed their name) but the phone is apparently a clunky, impossible-to-use piece of shit.

@adrienne @AnarchoNinaWrites I heard the hardware switch was backdoored, but I guess they have to compromise with the Chinese government to stay alive. This very compromise implies that this government could compromise fully free software phones at the software level, and then leverage an hardware backdoor; but I still think we should be all behind such initiatives, paving the way for more reliable electronics, especially in such an hostile environment.

They've also released the Pinephone Pro haven't they? Something more modern with 4 GB of RAM.

@oceane @AnarchoNinaWrites tbh i'm just not that worried about the Chinese government, personally. They don't have any reason to give a shit about me! And they're unlikely to sell my data to US or Canadian data brokers.

@adrienne @AnarchoNinaWrites Yes it's a matter of threat model. Pretending you need overkill opsec to use professional software you don't need, again…

@oceane I mean I'm not gonna lie, even if such a thing existed, I'd have no idea how to trust it. Google "the Anom sting."

Now keeping in mind, the FBI and its sister organizations were using it to track drug dealers, like big time cartel guys, so I don't REALLY care - but that was the "safest" encrypted phone on the market... until it was revealed the whole thing was an FBI sting.

It's hard to escape a surveillance state; but let's not make it EASY on them by planning resistant on cellphones

@AnarchoNinaWrites There's a key difference here, which is that a criminal has developed software for criminals, while GNU Guix is software developed by comrades, for comrades. I'm not asking for that, but they'd still take a bullet for us.

Yes, there are flaws, because any package maintainer's private key could be cracked, and I've literally come to sleep yesterday by devising an hardware security scheme with an airgapped private key hosted on a Raspberry Pi, signing a Yubikey public key used to sign packages.

And then build farms, both ci.guix.gnu.org and where I live, bordeaux.guix.gnu.org, can be compromised, but because every Guix setup can be reproduced byte-perfect from its derivation Git hash, Guix users can challenge the servers' packages they've installed by building each of them, and checking their checksums. It isn't perfect, because a compromised sha256sum package could defeat this, but there are still more serious ways to do this than throwing a mere “guix challenge” and warming your choccy milk on your ThinkPad.

The GNU project is actually pretty serious on software reproducibility and verifiability, there are efforts to fully bootstrap your GNU operating system, so while being imperfect, I do trust my environment enough to keep unencrypted recordings of sociological interviews.