We already know of many honeypots ran by malicious actors such as governments. Free software and constant review of the code and group behind the project is the only way to fight against this. With millions of lines of code for programs and governments and major corporations having incredible amount of influence on things such as linux, is there any real way to avoid falling into a honeypot? There are honeypot products as you know and they tend to use big words with no link to their code for their product but some are less obvious. How can we know purism isn’t even a honeypot? Their products run non-free software including the greatest threat to freedom: a mobile phone. How can we trust anything? Even if entirely made by yourself, your programs can still have bugs even if not backdoored.
We cannot trust anything that’s proprietary but free and open source. L5 is supposedly to let you replace whatever workable OS or manage whatever apps/software as you please. They’re either impossible or very difficult to do so on Android and Apple phones. Most Linux distros don’t smear their OS with built in bloatware like Microsoft with Candy Crush, Android and Apple with Fecesbook. As for hardware, like for modems as how would they share what data to towers, that’s not something most people are caution about.
Depending on what kind of government you’re talking about. Also what kind of person you are. If you are journalist in time of our current America government admin then there’s very slim chance for you to worry about. If you’re journalist working overseas, have to be careful cuz some foregin governments are horrible. If you’re an inventor and you need to use computer for your inventions, you would be smart not to use anything that make it possible for FANMG to snoop and steal your work. If you’re a criminal, why would you want to be one? I guess it may depends on some bad and discriminating laws in some other countries, even states.
In America, its greedy corporations we should be more worrying about and we need to appoint appropriate politicans to surpass those big tech dweebs. If there are wage limits for workers, like federal workers making low as $7.50 a hour then there should be limits on how much money for every psychopath CEO to bring home.
Your other option is Huawei/Harmony OS or other Chinese’s brands. From what I had read in other news that China don’t share or sell data to outsiders but to their own. So I guess no worries as long you don’t live in China depending on your occupations of course.
At a certain level, you can’t know. You have to decide whom to trust. Of course Purism makes a substantial amount of information available publicly, for all to see and verify.
What do you mean by this?
Well, yes. You should trust yourself but you can still make mistakes. Not sure what your point is though. There can be security errors in your programs? (If you administer your own computer then you can also make mistakes in system administration that expose you to security risks even if there are no coding errors.)
That of course is also true of entirely non-malicious open source code. Just because you could see the bugs doesn’t mean that there can’t be any.
My suggestions would be: simplicity of specification and design and coding, minimalist, and a robust programming language. However that is more addressing accidental errors rather than deliberate (malicious) errors.
You are completely missing the point. Something being free (libre) doesn’t make it secure or not backdoored. With millions of lines in project, it takes a single one to f*** everything. How can we trust even free programs? How can we trust any organisation that says they protect people through their technology?
I think complete trust is not possible, but open-source software–published by organizations with good reputation–can merit more trust than closed software published by companies with a history of snooping user data for profit.
That’s my point. There is still an element of trust. I hate trust. I want absolute verifiability. Corporations turn depending on leadership and I need certainty I’m safe which purism cannot provide (or really anyone with many things).
The only products from purism with RYF is their key USB and their OS. That’s it. Their devices runs non-free software such as ME (to small extent) on their laptops and their NUC.
I’m saying that even if you completely write everything on your system from kernel to userspace programs, you can still be compromised so why should you trust another entity ran by people you don’t know that bring new people in on their own discretion who can be targeted to do malicious things.
With projects like the linux kernel ran by so many groups that are doing so many things, we should absolutely assume that there should be some malicious code in mainline. With the previous ‘pen test’ from a uni in the USA, they made it seem pretty simple. Now imagine the glow in the darks trying to do with the budget of one of the most powerful countries in the world. Linux isn’t good enough. BSD maybe? Not sure.
I see free as a step towards something better but absolutely isn’t the top of the staircase. Also, O/S isn’t a very nice term and was a coin term not made by but pushed by elites to make people forget the most important thing: freedom. Any project using terms like O/S are something I look much further into. Also, O/S licenses vary in range of freedom from absolute to very little so O/S truly means very little to me. Freedom first please.
Yes, you always have to trust someone/some code. The best solution is to minimize the trust. I recommend Qubes OS for that: it provides security through compartmentalization. You only really trust the core of the system, mostly XEN hypervisor, you do not trust the millions lines of code, just about 100 thousand.
That’s nice however you still trust their kernels, that programs will not escape their box to dom0, the virtualisation technology intel/amd provide and proprietary code ran on lower levels for hardware. Qubes doesn’t support power PC to put them on a talos computer either.
edit: Not saying I don’t like their model though. I use qubes myself but nothing truly seems good enough.
This is all in the 100 thousand lines, which are constantly verified by the best security experts in the world. You can verify them, too.
Same here; escapes from the VT-d are extremely rare, and most famous of them was found by the Qubes founder.
Yes, this is a problem, but the current state is not the end of the development:
Also Purism disables and neutralizes(*) Intel ME.
(*) In older laptops. They are still working on it for Librem 14.
Just on your last comment “neutralizes” is eh. As I’ve said on the forums before, I see it as them heavily disabling the ME but not truly “neutralising” it because it still exists and cannot be disabled without Intel’s special permission at manufacturing stage without the watchdog catching you. Also, the microcode is proprietary and the concept of microcode is actually a really good thing but we simply can’t do anything about it to do what we want and all this adds to x86 simply being a horrible place for freedom. ARM is okay though still has its own problems. Things like RISC-V are very early. I see ppc as the only real thing you can get now that has power and can do a person good. This port of qubes to ppc, from the link you sent, seems very early and nowhere near being developed.
That’s a loaded statement saying that “honeypots ran by malicious actors such as governments”. Inverse logic would imply that “honeypots run by drug cartels are the good guys”.
We seem to forget that a government honeypots are intended to catch thieves and spies.
And yet they catch so many more. And some criminals aren’t criminal when considered with reason in relatively free countries. I don’t want a honeypot except for very specific applications such as saying a v3 has cp and making people visit with JS enabled so government can catch.
I wish government only fought with the criminals. In reality, they too often go against dissidents and journalists who disagree with the current state of affairs. Even in the democratic countries. See: Snowden and Assange.
All operating systems have security vulnerabilities. Some are better than others 
I trust Linux more than Windows, for example. Then you have the hardware issues (I don’t trust Intel chips). Someday, Risc-V will be mature, and I think we will be able to trust those more.
I understand the issue of trust. What I like about Purism’s laptops are the physical kill switches, which means when you want to be offline, you truly are.
To be truly secure, use an airgapped machine and use USB keys or SD cards to transfer files on and off, and be careful with those files too, as even in pre-internet days people would get a virus over the physical media. That isn’t a popular solution today, because people want to use services on the Internet. But those services, as well, can be compromised.
I’m old enough, that my family’s first computer copied data onto and off of it with a cassette tape Then we went to a machine with a 5.25-in floppy drive, then 3.5-in floppies, etc. I didn’t go “online” until I was in college, so while physically sharing files is “old school”, it doesn’t feel totally alien to me
That would be more secure than transferring anything over the internet. And you could still apply encryption keys to it, so that only the receiving person (of the physical media) could decrypt the file.
This is not necessarily more secure than Qubes OS:
I might be picturing something a bit different than you.
If, say, @user1 has a machine that has never been on the Internet, and I have a machine that has never been on the Internet, and we only ever trade files with each other, then I think that setup would be more secure than even Qubes OS
But once we add a third, fourth etc machine into this mix, and even one of those machines connects to the Internet, security becomes much more complicated. And even if I trust “Person A”, and “Person A” trusts “Person B”, I may not necessarily trust Person B.
Person B can’t steal data off my machine over a network, if I have no network connectivity, but a virus could end up on my system to damage files, etc.
This is naive. Governments honeypots go after people they don’t like. I live in Australia and see people arrested on dodgy charges frequently. It will be interesting to see how many crims walk free after the Anom thing runs its course which is a high profile honeypot.
That’s not the only solution, formal verification is another solution. This is for instance used by the seL4 project, https://sel4.systems/, that also releases their code as open-source. I hope that one day we can run something like seL4 instead of Linux on the L5.