Free Software Foundation announces a Librephone initiative to develop a fully free and open source smartphone

submitted by

liliputing.com/free-software-foundation-announc…

76
632

Log in to comment

76 Comments

The most important thing fo me is not to fix a new Linux phone or linux compatible phone. It is to pressure the banks and digital ID providers here in Sweden and EU to support Linux.

I wanted a Linux phone, I was open and prepared to have a worse camera, battery, stability, user experience. You name it. Just to break free from the duopoly. But then I wouldn’t be able to use my bank, healthcare services, insurance, file my taxes, etc. Cause there is no support for Linux only Android and iOS, windows, Mac OS.

Services needed to exist in a modern society locked to platforms owned by private corporations. Even if ASOP gets a fork that continues without Google’s version of ASOP for future version’s, there is a good chance none of the bank apps would function without integration of google services.

I’m running /e/OS on a fairphone, that was the best option out there for my requirements. But with the latest developments around ASOP I’m not sure about how long this will be an option.

I hate BankID with a fiery passion. I complain to all my Swedish colleagues how messed up it is that government services are locked behind a private company that only supports American big-tech operating systems. They are finally coming around to my way of thinking now.

I’m one of the only people I know in Sweden without a smartphone, just a dumbphone.

I couldn’t get BankID to work with Wine or Waydroid so I just use an old Windows laptop when I need to access government services with the physical dongle. But I hate going back to Windows so it’s always a pain.

BankID is so ass, the one we have here in Finland is a bit better, but the one we have in Estonia is the best.

The Estonian one is by far the most comfortable to use of the three, with even a working and maintained Linux version. It is also tied to the PCKS#11 certificate stored in your ID card, instead of a corporate bank account.

Back when BankID was young, in the wee 00s, it was actually just a certificate on your computer. The management software for this is still around I believe, it’s called BankID Säkerhetsprogram. The Linux support for it was dropped in 2014.

The reason it took off the way it did is because it was in early, and the banks backed it. The government has been really slow implementing their own solution. They had DIGG work on it for a while, but then transferred the assignment to Polismyndigheten.

For both of you Saper and Blessed please read my comment on this comment thread for EU Linux to collectively grow with some recommendations on what to do with other people. I am certain that is our main way to get Linux phones since more EU countries are getting interested day by day with proper protections in place

“Help me, Obi-Wan Kenobi, You’re My Only Hope”

It’s annoying to have to have a card reader though, so everyone just uses Smart-ID or Mobiil-ID anyway. But at least we have the option not to.

I’m pretty sure that you can use something like a YubiKey as a PKCS#11 certificate store, if the issue is just the card reader form factor.

kagis

Yeah:

https://developers.yubico.com/yubico-piv-tool/YKCS11/

This is a PKCS#11 module that allows external applications to communicate with the PIV application running on a YubiKey.

That solves one issue, the other being how buggy it can be to use in the browser. The file signing feature is separate software (which has an official Linux port!), but to log into your bank, etc, browsers often pre-decide for you which certificate you want to use and then complain that it’s not present. Perhaps it’s changed now, I haven’t used it much in quite a few years now because Mobiil-ID and Smart-ID have just worked 99% of time.

Mobiil-ID and Smart-ID just register a new certificate to your ID, so it’s the same mechanism, different UX :)

Yes but the UX works better much of the time. Downside of course is that you can’t sign documents without an Internet connection, if that’s something you may need to do. And the fact that you need a phone

Yes, of course. Alternatives consodered, I think the Estonian eID is really well thought out and implemented in maybe the best way possible. Really pleased with it.

Kuradi lahe

I know some people on the internet is against the whole idea behind digital identification. But if its only used for things that would normally require identification in the physical world. Like banks and government interactions. I don’t have anything against it per say. It can even be administered and handed out by a company (although that is against my personal ideology) but they have to then be forced to either release the source code or support at least one distro of Linux, or flatpack works too. Let’s not get in to snap packages, it opens a whole other can of worms.

Yeah we have that in BC Canada, your digital ID gives you access to BC services and as a login credential partner to federal tax account.

Isn’t it just a webiste though?

If you mean the federal tax access, yes. However their security has increased after breaches so to login you need username, and a pass code they mail to you to setup a login and password. Then they send you a printable cyptic gridded square. So you login with a user name and password , they send a challenge code and you cross reference it on your chart to send back the codes to get access. If your paper is expired or you lose your password you have to through snail mail again. OR you use your BCID key tied to your personal device, website waits for code generated from phone.
It simplifies access, and ensures only the person holding the device can login and not a brute force from a random person

Exactly.

Through Handelsbanken I have two physical card readers.
- One is wireless and I can use to authenticate online purchases and login to Handelsbanken. That one works on any browser so it works no problem on Linux. It even has a camera on the back of it to scan QR codes.
- The second one connects through USB and requires you to download a program that only works on Windows and MacOS. This is the one that is required for all government services, other banks and everything else.

My hope was that I would be able to use the first physical card reader to scan the QR codes that come up for mobile bankID for other sites, but the QR code scanning functionality only works with Handelsbanken’s website.

If I could login to everything with the wireless card reader then they wouldn’t even need to make a version that specifically works for Linux, just a version that works for all browsers. It doesn’t seem like it would need to be that big of a change from perspective.

We have that but it’s just a website we go to login to. And every 3 or 6 months forget which it asks for your drivers license. So we can login to governmment sites on any platform since it is another website used for verification.

This

I would have been in Linux for my phone years ago if it wasn’t that so many companies are conspiring working together to lock down every service just to make sure that spyware phones are the only option to citizens.

Fuck. That. Shit.

I want to be able to make payments with my phone. THROUGH LINUX. MY PHONE, MY RULES.

This is why I prefer websites, and try to avoid apps. I can use them across any device.

Sure, there are some things I may not be able to do, like pay by phone, but I have a little card to do that.

This is the worst part. They all have functional websites, but to login you need digital ID(bankID) so one app is acting as the gate keeper

The problem isn’t really the app, it’s that a private organisation is controlling the default digital identification system, and how it is accessed. Until 2014 they had a Linux client for it, but it was discontinued. BankID has been around for a long time, so it’s absolutely engrained in so many aspects of society here.

Past few weeks, these are instances I’ve used BankID, off the top of my head
- Had to pick up a DHL parcel in person, authenticated with BankID
- Picked up a parcel from a PostNord locker, BankID required
- Called my mobile phone provider many times (fuck telenor), authenticated with BankID
- Paid my bills, BankID to log in, as well as authenticate payment
- Bought a game expansion, BankID required to use my debit card
- Bought groceries (online, I struggle going out to groups of people), BankID at checkout
- Updated my dog’s food subscription, BankID at checkout
- Checked in at dentist office, BankID to authenticate that I was present
- Digital mailbox to get a bill, BankID

Honestly I’m sure I’ve missed a bunch. In general though, doing something digitally and authenticating with BankID is the primary way of getting things done here. The “old fashioned way” is unconventional, and tends to be woefully slow. When my previous roomie didn’t have a social security number (and subsequently not access to BankID) every single administrative thing they needed doing took forever, registering for school, doing tests, updating licenses, registering your address, even just plain buying things can be tricky.

Yeah you are basically soft-locked out of society without a phone with bank ID here in Sweden.

Aye. The amount of phone calls my friend had to do to get things done, and people generally had no idea how to go about things if you didn’t have BankID. Things were slow and unreliable.

The solution is to get a phone that does two things.

  1. Connect to a mobile network
  2. Share the link via hotspot to device of choice

Now you can do whatever you want with a mobile Linux device or anything your heart desires with your hotspot.

Set the bar low. Put out a product. Get traction.

But I still won’t be able to use it to access those mentioned services, due to the Digital ID not working on Linux.

Can you elaborate?

In Sweden we have something called “Bank-ID” its a digital ID. Most services such as logging in to renew medical receipts, access your tax information, and file your taxes, pay your bills, access your bank. Buy insurance, cancel insurance. Think anytime it would be unreasonable to not verify your identity, you need bank-id. It is basically a certificate you generate together with your bank, that can only be accessed through the bank-id app/application depending on if you have it installed on your desktop or phone. Everytime a website has Bank-id integrated as a login method. You will need to scan a QR-code with the app or initiate the app from the website. Then type in your code to authenticate. Voila you have verified yourself. This requires their proprietary application, and the certification that lives in the app is issued by Bank-id. So you are locked in

Edit: basically in Sweden any linux phone without working bank-ID would be dead in the water from the start.

If I may make a suggestion get together with many other EU Linux enthusiasts and collectively push not only for usage of Linux all over EU but also for having them partner up with PostmarketOS, Mobian, Ubuntu Touch, and FSF Librephone Project for phones then future tablets. KDE, Framework, and Tuxedo Computers for Laptops/Computers

Linux Community over there has so much ability to grow Linux if everyone there collectively gets it done. I humbly request you do that and I’ll do the same. Who should I call to get all this going as well?

Shut up and take my money!

Here’s the split.

Either Linux on mobile needs to specialize to vertical screens, smooth out controls and usability, grow an app ecosystem for mobile and not just desktop apps squeezed, harden the network stack so 4G and 5G don’t shit the bed, or…

There’s also the concept of a fully FOSS Android, which personally, I believe is the lesser of two hills to climb, but I believe both could be used in tandem using Waydroid if both succeed in the end. If you have Android apps, made for Android, they can run on Linux mobile OSes right now through a compatibility layer.

Used in tandem, both could be more than the sum of either-or, at least on the short-term while Linux mobile development gets a bit more gas under its ass.

Talk is cheap. Contribute to postmarketOS. You can translate, code, test-drive or donate. The more people realise this the quicker we’ll have a properly FLOSS mobile landscape and an alternative upon which to build apps and other things.

Why PostmarketOS and not Mobian, Sailfish, or Ubuntu Touch?

Why not fork Android?

What hardware deals are being made between Postmarket and phone manufacturers? Do they have a development timeline? How far are you guys from 1.0? Come on, action speaks.

Given googles latest updates might need to be a hard fork. The issue is who will build the phone if android based they can’t make any other “authorized” android devices, since that is part of the play services ToS. (This actually has had me annoyed with Google+android for a 5-8 years now..)

Oh so now they get this bright idea. Better late than never I guess.

They’re not the first.

Was talking about FSF specifically

I know. Sadly. I’ve joined them. I have a Puri.sm Librem 5 I bought when it was in design.

So like, in the interest of our whole ideology, is there anything folks can do, other than money, to help? I can solder.

I can solder.

Great - you can build all the phones then. I can program, so I think we’re most of the way there. We need one more person to write the manual.

I can drive a manual, does that help?

I’ve done a lot of technical writing and knowledge articles in my career. I’m in!

You cheeky cunt, I love it. Strong responses too. I think we got ourselves a cottage industry.

please make something affordable. I want to be able to make mobile apps without being forced to the Java/swift shit duo.

The app ecosystem will be wild, if this succeeds.

I hate Java so much, and so deeply, that I do not develop quick handy little Android apps.

But if I can use a less obnoxious language, the world is going to see some mobile apps for tracking all the push-ups I’m not doing, and all the salads I intend to eat.

Edit: Android is already a huge success, by any meaure, of course. But it can get better without Java.

Edit 2: I do know that cross compilers exist. They still smell like Java, though.

Isn’t the default for Android nowadays Kotlin? Which, yes, still runs on the JVM, but the language itself is much nicer designed.

Yes. I have heard it is much nicer since last time I tried it.

I might give it another try sometime, if AOSP survives what Google is doing to it, and my dream Linux phone still isn’t ready yet.

I’ve used it for backend development not Android so I wouldn’t know how that’s improved (presumably you still have to deal with any Android idiosyncrasies), but I definitely loved it. Just knowing if something can be null or not is already awesome. Same thing I like about Swift, the language iOS uses.

What is annoying about Android, is that whatever language you use, YOU NEED SOME JAVA GLUE to make your app, and the signature thing. When I tried making the “hello world” apk I was astonished to see how hard it is compared to Linux dev. There has to be something wrong that led to the disgrace that is Android Studio (+10GB or something, I just recall it being ultra bloat) to start up with android dev.

There has to be something wrong that led to the disgrace that is Android Studio (+10GB or something, I just recall it being ultra bloat) to start up with android dev.

I agree. There’s something just a bit off about the whole ecosystem.

I think it may reflect Google wanting to appear FOSS while not actually giving up control.

When I tried making the “hello world” apk I was astonished to see how hard it is compared to Linux dev.

I mean, to be fair, if you’re doing the APK, you’re also doing the packaging. If you compare that to building and packaging for all the Linux distros out there, especially considering all the different packaging systems, doing up a single APK is probably a lot easier.

Deleted by author

 reply
10

Last I checked, no. However, you can move actual radio chip off to a separate chip that is isolated by the MMU or connects through the USB bus.

I was wondering the same thing. I thought the reason this thing has never taken off is because it’s ridiculously hard to make firmware that operates these radios.

Exactly. It took Apple with their infinite resources and top engineers many years to build their own baseband.

And that’s still very new. Who knows how it’ll hold up.

Look FSF. If you want this to work you cannot just copy fairphones design and pricing. I’ll be honest IDK how anyone can justify spending more than 200$ on a phone especially in this economy but the privacy nerds seem to always be in good enough financial conditions no matter what they’ll happily pay 800$ for a 5 year old phone with hard kill switches and modular parts.

I just can’t do it. I don’t have 800$ in play money to spend on a nerd phone. If you really want to help people you need to make some deals and mass produce this shit on the cheap. IDC if its got the build quality of a tracphone from walmart, find a way to bring those priced down to something the average person can actually consider.

I agree with you, I think there is a huge market for cheap functional smartphones that just gets the day-to-day things done.

Mass production comes after you can make a low volume high end niche product.

I’ve been seeing this kind of stuff three times a year for 15 years.
Perpetual inertia.

It’s slowly moving forward. Remember how long it took to actually be able to use Linux easily as a daily OS? A smartphone is a significant challenge due to how hostile the hardware companies are

So you’re saying if we keep declaring [current year] as the “Year of the Linux Mobile Phone”, eventually it will become true!

I’m saying free work in a hostile environment isn’t going to be able to keep up with trillion dollar companies… I’m happy to still see progress happening

I felt bad for the younger generations buying steam decks and watching the Linux usage for increases.

I would say being able to use Linux daily was achieved a few years after Ubuntu came out, so almost 20 years ago or by now.

Linux on Phones has already peaked in 2009. The Nokia N900 running Maemo in 2009 was amazing. The Palm Pre running webOS was the other good Linux based phone. Both of these had their fan base, keeping them running and active for a couple of years before fading. Since then Linux on phones has been lingering on in obscurity across various projects. Firefox phone was the most promising for a while. Jolla is still holding on, continuing Nokia‘s legacy.

I’m not sure I agree that 2005 was the proverbial “Year or the Linux Desktop": I remember all the WiFi driver hell in the late 2000s, but let’s say that was when Linux became a valid competitor because it’s close enough. That’s 10 years after Windows 95! That only furthers my point, but it does show that the phone progress seems to be slower by comparison. All of this is assuming we leave out Android of course.

In my personal experience I dual booted until around 2010

Yes, Wifi drivers were a bit of a hassle. However there was this wrapper which allowed windows drivers to be used and it was integrated into the Ubuntu GUI.

It was the age of the live CD. You could run Linux from a CD easily. Trying out Linux was as easy as downloading an ISO, burning it, and booting from it. Print computer magazines included Linux live CDs like Knoppix and DVDs regularly. Installing was easy as well with a nice wizard guiding you through.

OpenOffice, VLC, Firefox, Thunderbird, GIMP all existed. Hell, Skype had an official Linux version.

and if it goes as well as the other projects, in 5 years they’ll announce the Librephone One, a phone with 2016 specs that costs 2000$

And it seems like the goal isn’t to start from scratch, but to take an existing operating system like Android and reverse engineer all the proprietary components until it’s capable of running on smartphones and other mobile devices without relying on any proprietary drivers.

This is going to stall out like all the previous attempts. At best the phone will half work and then rapidly become completely outdated.

Oh, wow, announcing an initiative to develop a fully free and open source smartphone. That’s a great idea! No one has announced such a thing before. Because if they had obviously it would have come to fruition by now.

I saw a custom smartphone used by the military - no idea what’s inside but it looked like a regular one with giant battery and with some different OS. It also had a kill switch button (or so I was told).

Signal comes preinstalled.

With random journalists in the contacts.

Comments from other communities

They should team up with other projects like Ubuntu Touch, SailfishOS, GrapheneOS, PostMarketOS, etc, at least for the base OS and device drivers. This would mean a lot more hardware available, and some pressure on manufacturers to be compatible. One project I’m really interested on is the Liberux Nexx.

I know this is a bit too hopeful, but if we don’t get at least some of the general public on our side and put pressure on manufacturers then it really won’t happen.

The trouble with these FOSS phones is support from banking, payments, and government apps, which are also the main things that can’t be run from a laptop. They usually also require NFC support, and that implies having the right kind of security certificates that these organisations recognise as well.

Yep, there are also development tools missing (at least at the level Android and iOS have them) and the motivation for developers to support yet another platform with no users (at least initially). A good example is Microsoft which thrown awful lot of money and resources at Windows Phone only to give up eventually. OTOH it’d be interesting if i.e. EU decided to support a new phone/OS, that’d certainly help with those delicate apps at least.

A good example is Microsoft which [threw an] awful lot of money and resources at Windows Phone only to give up eventually.

I just want to point out that they started or bought themselves into a Windows phone idea no less than three times before giving up, ruining Nokia in the process.

Oh. And some of the Nokia handsets were gorgeous.

The Chinese government has thrown its weight behind Huawei’s HarmonyOS. I wonder what the EU will do?

With current (and in general) EU leadership I wouldn’t be optimistic as they don’t understand any of it.

They trick is to do what MS did in the early years, provide an API layer for compatibility.

No reason they couldn’t throw on an Android API layer specifically for targeting things like banking apps, etc,(maybe not games).

Phones have significant power these days.

You can do your banking on any web browser, including mobile web. You do not need a god damn app for everything. NFC antennas are supported on credit/debit cards that have no screens or CPUs, certs are handled by the non-client device, so it sure as fuck will work on any hypothetical FOSS phone. This is a dumb as fuck take.

I’m glad you have all this figured out!

There’s zero technical reason to need an app to perform HTML presentation.

That’s all an app does anyway - use current web tech to present a page.

Try Hermit or Native Alpha, both present websites as apps, and work very well.

To that end, I use apps like Hermit and Native Alpha, which make an app-like experience for any website.

I don’t see this happen, sadly. I mean yes, few enthusiasts will jump aboard, but that will be it.
I’d go with AOSP modified in a way that can run google services and their apps in isolated mode, which at least GrapheneOS is doing (if I’m not mistaken).

GrapheneOS really needs something like that, since Google stopped shipping drivers and locks down Pixels now. Maybe some collaboration could help here

its good they did this after the Android AOSP and “sideloading” change

Can it be used in the US though? That’s always been the sticking point — the carriers have too much power.

I use an iPhone because I don’t like the idea behind Android. All your data to Google to sell to the highest bidder, in exchange for a generations-old phone at the same price as an iPhone.

The dream, for me anyway, for a phone is basically a blank slate I can run whatever I want on it without anyone telling me what I can and can’t run on it. A device I truly own. No, Apple does not provide that. Android has more flexibility when it comes to sideloading, but Google is closing that down as ad blockers threaten their business model. Maybe as they reclaim that missing ad revenue, they will make the next Pixel as powerful as the latest iPhone, and/or drop the price to match what you’re paying in personal information they sell off the back end… but I don’t think they will.

So all your data go to Apple instead. And many apps collect data and send to Google (eg. Any Google app, like maps or waze).

There’s very little reason any more that a phone can’t be used in the US, it just needs to support US frequencies. Cell providers like US Mobile don’t care what phone you bring, so long as it’s compatible with US frequencies.

Plus I’m sure someone building an OSS device isn’t going to ignore an entire market of frequencies.

Yeah, so Apple, like Mozilla, collects telemetry data. And some people are against that as well. And on an Android phone with custom firmware, you can disable the telemetry as well as the marketing stuff. And you can turn it off in Firefox. But in iOS you cannot.

Everyone has a threat model they base their needs around. Telemetry doesn’t bother me. I’ll turn it off if I can, but I won’t disqualify a device where I can’t. I do believe you should be able to, though.

I use an iPhone because I don’t like the idea behind Android.

“Oi, Pot,” shouted the kettle.

All your data to Google to sell to the highest bidder,

That’s not “the idea behind Android”.

Android does none of this by default; Google services like Gmail are ad-supported, but they’re up-front about using your content to serve you targeted ads.

Both Google and apple still COLLECT your data. Apple tells you it doesn’t do anything with it. It’s fun to trust Apple in this, so carry on.

I’m not saying you’re doing more than repeating Apple’s fud, though. You’re a huge help to them.

in exchange for a generations-old phone at the same price as an iPhone.

This is comically incorrect as Apple’s never been on the bleeding edge of phone tech past 2010. But they will tell you they are, and that’s all some people need.

  • Apple promises you compatibility as long as you stay on the one brand and refresh everything every few years. They’re a hardware vendor, simple-as, and their entire schtick is to keep you locked in that refresh cycle. Absolutely nothing wrong with that as long as your eyes are open and your wallet can cope.

  • Google shows you ads based on content of yours they’re storing.

  • android powers 70% of the phones in the known universe. Currently it likes to bundle Google add-ons in a default fashion but in contrast does not lock you into using just them.

Apple’s never been on the bleeding edge of phone tech past 2010

Here’s the M4 against the Snapdragon X Elite and an Intel processor for good measure: https://www.xda-developers.com/tested-apple-m4-vs-intel-lunar-lake-snapdragon-x-elite/

Edit: I was under the impression the M4 was in phones, it’s not.

No, but it is in the 2024 iPad Pro.