@Nami, you should read this Reddit thread where I argue with madaidan (a Whonix dev) and Daniel Micay (the developer of GrapheneOS) about the points raised in that article.
Some of madaidan’s arguments don’t make much sense, but he and Micay do raise a couple valid points about better kernel security in Android vs Debian. The problem is that they seem to be exclusively focused on kernel hardening, and often fail to address the larger issues beyond the kernel and they refused to acknowledge that Purism may also have ways to do things like secure and verifiable boot. Just because it hasn’t yet been implemented on the Librem 5 doesn’t mean that Purism won’t do it. It is hard to argue about how the OpenPGP card will be used, when it is not yet implemented.
I’m not going to rehash all the arguments that I already made in that thread, but let add some additional points that I didn’t mention:
- Android may have a more hardened kernel than Debian (and by extension the Librem 5), but Android literally has millions of pieces of malware created for it, and a lot of it can be found in the Google Play Store, so there is a high chance that you will install malware on an Android device. With the Librem 5, where you are getting all your apps from the PureOS Store and most of the mobile apps are converted FOSS desktop applications that have spent years in the Debian repositories, the probability that you are going to install malware in the first place is very low.
- Android and Windows 10 are operating systems designed to monetize its users’ personal data for targeted advertising. Now that Apple is switching to services over device sales, it will likely begin to harvest its users’ data to better market its services to its users. Google, Microsoft and Apple all collaborated willingly with the NSA, before Snowden’s revelations exposed how they were sharing people’s private data with the government. Since then, Google and Apple have made it a policy to resist government access, but one has to question these companies’ commitment to your privacy, considering their earlier cooperation with government surveillance.
- Google in particular, but also Microsoft and Apple to a lesser degree, encouraged developers to create software on their platforms that is based on exploiting people’s personal data. You can avoid a lot of this spyware by installing an AOSP derivative (such as LineageOS, /e/ or GrapheneOS) and only using apps from the F-Droid, but that takes a lot of work on your part, compared to getting a phone with Linux preinstalled. The Librem 5 will be preconfigured to use a safe app store, where all the code is free/open source and collection of user’s personal data is strongly frowned upon by a system of badges that will inform you how the apps will violate your privacy.
- Google spends a lot of time hardening the kernels that it takes from mainline Linux, but what that means is that you have an out-of-date kernel in your phone, and Google doesn’t guarantee that kernel is updated when Android is upgraded to a new version. The Linux kernel is typically 1 - 1.5 years out of date when you buy an Android phone, so it may be 3 - 3.5 years out of date by the time you stop using the phone, and most phone models stop getting updates after 2-3 years of being on the market, which is an even bigger security threat. Yes, that Android kernel may be hardened, but what good is that when you are no longer getting security updates after 2-3 years and you are using an ancient kernel? In contrast, with the Librem 5, you are getting lifetime software updates, and the phone can run the latest mainline kernel, so it is going to receive the latest security updates. Because its drivers are all open source, the community can maintain them, and because it uses chips that are manufactured for many years, unlike the integrated mobile SoC’s used by Android phones which are only manufactured for 1-2 years and only get 2-3 years of updates, we can count on years of firmware updates from the manufacturers. The fact that a Linux phone can count on so many years of updates has huge security benefits, because old security holes can’t be exploited.
PS: madaidan uses a pseudonym and some of his code commits are found in GrapheneOS, so I confused him with Daniel Micay. He got really offended that I had confused him with Micay, but he causes this kind of confusion by posting articles on the internet under a pseudonym. As you can see from the thread, I found out that both he and Micay were quite obnoxious, so in the end, I decided that it wasn’t worth arguing with them any further.