Elektrine lite

← Feed

@JasonDJ@lemmy.zip

Post #1791623

2026-04-22 13:44 UTC

Not to be pro-corporate/anti-repair…but I feel I have to play devils-advocate here… That sounds like a legal and security nightmare. If you just give binary blobs and no sources, there’s no way to maintain the code/device long term. As exploits continue to be found in upstream dependencies, the hardware continues to become increasingly insecure. But if the source needs to be released…I imagine that there are heaps of proprietary code that is still in use on “active” devices even after another model goes EoL…so if that code is released, there’s instantly thousands of nefarious eyes on it. On top of the regular zero-days that are found out when a popular product reaches EoL. I think that’s potentially a lot to ask of users. Will your technically-challenged great-Aunt switch to post-support build when her phone hits EoL, or will hackers be able to remote control her banking app and take away your inheritance before the community can even patch it (assuming there’s enough community support out there for an 8-year-old Galaxy A-series…) Then there could also be licensed code that would need to be released as well…hence the legal nightmare. Not saying it’s impossible…in fact, I greatly agree with your stance and stated position. Just saying that there are some blockers on this epic.

Replies (7)

  • @qqq@lemmy.world 2026-04-22 14:05

    Security is constantly used as a guise for removing consumer rights and as someone who has been in the security industry for about 9 years I’m so sick of it. First and foremost, everyone please understand: the user should be allowed to opt into your concept of insecurity: you do not know their threat model and you do not know their risk tolerance. Using exploits in low level drivers in the wild is approaching APT level, and even if there were a simple one to use it’d likely be useless without some sort or local access to the device (bar some horror show bug in a Bluetooth or WiFi firmware). The risk is incredibly low for the average person. I’d put it pretty close to 0. Wire transfers aren’t instant and for large sums (your inheritance) the banks will likely require more than just a request from your app. If the bank cares about that then they can also use the attestation APIs which would be more than sufficient, as much as I hate them. This boogey man of the APT going after my technologically illiterate with nation state level exploits needs to die. Long ago we entered a new era of security where it just isn’t worth it to waste exploits. Especially when you can just text people and ask for their bank account and that works plenty well. Security is not a valid reason to soft brick consumer devices at some arbitrary end of life date.

    Open ##1792590

  • @CileTheSane@lemmy.ca 2026-04-22 14:40

    That implies any and all FOSS project should be getting exploited constantly, especially those being run by a community of hobbiests, and that is simply not the case.

    Open ##1811134

  • @PlexSheep@infosec.pub 2026-04-23 11:58

    I think the worst risk with this would be data leaks from that government database.

    Open ##1822107

  • @unwarlikeExtortion@lemmy.ml 2026-04-24 07:44

    If you just give binary blobs and no sources The main point is that you give the source to the blobs, so it’s not a black box anymore - new maintainers knowing what the blob does (and how) saves a HUGE amount of time prodding the black box (blob) to infer its behaviour. And it doesn’t pose a security risk - if anything, more eyes on the code is better. Security through obscurity has been proven a myth since open code has more eyes on it. Security researches have smarter things to do than prod some binary blob when there’s so much code that’s either open source in the first place or at least only they got access to closed code. What obscurity does is limit the eyes on the code, but the share of bad actors hoping to strike gold to researches looking at it outdoes any benefit. Will your technically-challenged great-Aunt switch to post-support build when her phone hits EoL She won’t. But you as her niece/nephew might. And the local repair tech might when she comes to ask. Abd she’s not an idiot, just the technology isn’t mature enough in the societal sense: people don’t think of bringing their phone to a repair shop like they do their cars, which is a fixable issue - even without much advocacy groups time will fix this issue. hackers [will] be able to remote control her banking app and take away your inheritance before the community can even patch it You might be mixing apples and orabnes here: why and how is the community expected to “fix” a banking app? A banking app is a closed blob just like phobes nowadays. It’s a parasitic relationship: blobbed phones are used to justify blobbed apps and vice versa. It’s like saying “well, the foubdation of the building is bad, but to fix it we’d need to also deal with the crumbling walls” - so instead of fixing, it often is better to do a fresh start. But you’re suggesting we should continue making buildings with bad walls and foubdations because we have the wall materials lying around, so why not use them? Then there could also be licensed code This is a recipe for disaster. I hope you’re trolling. The Internet wouldn’t work if DNS were centralized, and the only thing DNS is used for is translating key pairs (basically). Now a single point of failure would have to do code vetting? It’s the totalitarian dream! Oh, and absolutely out of touch with reality.

    Open ##1841097

  • @VieuxQueb@lemmy.ca 2026-04-22 15:10

    Security by obscurity is a myth

    Open ##2093623

  • > security nightmare That is not a corporations problem who's given away the rights to his product. That is my problem as an informed user, deciding that I know well enough about what I'm doing. Security can't be the constant reason for EoLs. Especially when there's no real reason beyond the company needing the next cash cow. > Will your technically-challenged great-Aunt switch to post-support build when her phone hits EoL This isn't for the average user. My grandma isn't gonna learn how to flash a custom firmware on her old phone. But an informed user can. Right now, if your device has no more support, you can use it until something else changes and it becomes incompatible. Then you have a dead box that doesn't do anything anymore, and simply because the company decided to no longer support it. It's about having the OPTION to use it in the future so the community can at least try to fix it.

    Open ##2093627

  • @porcoesphino@mander.xyz 2026-04-23 21:09

    I can't believe this is so heavily downvoted for pointing out flaws in the expressed/written stance while still expressing they agree with the general position

    Open ##2093628