I thought some of you might enjoy my latest blog post:
6 Likes
As we stand at the early stages of the era of code-focused AI models, which models are churning out detections of security vulnerabilities in open source software, it would be difficult to overstate the importance of ongoing software updates.
If an open source phone (regardless of its political persuasion 
) gets a few years of updates and then becomes abandonware, the user could easily get left with a phone that is anything but “secure” i.e. that contains potentially dozens of serious, exploitable, known vulnerabilities.
However, I believe that we will get through that, and end up with a better codebase as a result.
Privacy on the other hand is hard, by which I mean real privacy, not marketing privacy. Almost the entire web is designed for and operating towards the goal of attacking and undermining your privacy.
However both privacy and security depend as much on user habits and education and awareness as they do on software.
3 Likes
Typo
Murena has published all its codCopperhead Partner networke as free/open source since the company’s founding.
Also, are you sure Calyx has duress
Like the duress PIN/password on GrapheneOS and CalyxOS
I don’t think so but I havent used it for a long time…
I am actually shocked by how support for Android phones has improved over the last couple years. We now have Google saying it will support its phones for 7 years, and Samsung is offering 6 years of support for all its phones and 7 years for its flagship models. Qualcomm is saying that it will offer up to 8 years of support for its Snapdragon 8 series and all Snapdragons get at least 3 years of OS upgrades and 4 years of security updates. I don’t know if MediaTek and UNISOC are matching Qualcomm’s policy, but they are certainly offering longer support than they used to. I noticed that Volla, TeraCube, Brax, HIROH and FuriLabs all chose MediaTek over Qualcomm.
I hadn’t thought about how AI is going to make hacking so much worse, but it makes sense. Every time I login to my server, I see that there have been over 5000 login attempts, so someone is trying to brute force attack it. We used to be safe from malware just by using Linux, but that is no longer the case. Sadly, I suspect that we will need AI running on our machines in the future to constantly patch them with security updates and try to protect from all the AI attacks.
What made me so sad when I was writing that article is the fact that I can’t just tell right-wingers, “skip all this Google garbage and just buy a Linux phone.” At this point, we just don’t have a good Linux option to recommend to non-technical people.
Yeah, I thought that CalyxOS’s use of PanicKit was like GrapheneOS’s Duress PIN/password, but I investigated it and it doesn´t do a full system wipe and reset like the Duress PIN/password. I’ll change my article.
And there are multiple ways in which that will occur.
The only one that I was alluding to in my previous post was using AI to scan the source code and find logic errors that can be turned into usable exploits. That is a big enough problem by itself.
AI-directed attacks is a whole extra pain.
Sure, we all get that - and always did (years before widespread use of AI arose). I would not assume that AI has anything to do with those attacks though. That is probably just some script kiddie or else a completely uncoordinated coincidence of script kiddies.
(For the latter possibility, I see a lot of obvious-type-of-attack from source IP 1 followed by the same attack from unrelated source IP 2 followed by the same attack from unrelated source IP 3 etc.. I would assume that a novel vulnerability has become public, it has been added to the hacking toolkit, and every script kiddie and his dog is just trying the same vulnerability - even long after the vulnerability is no longer novel.)
To be honest, that many login attempts is probably not smart. AI could do better. If you really want to break into a system, you don’t want to be setting off security alarms / triggering counter-measures.
So 5000 attempts from the same IP address trying different passwords may be counter-productive. (I understand that you didn’t say and maybe don’t know whether those 5000 attempts were all from the same source or from 5000 different sources or something in between.)
What makes me so sad is that we should even need (right wing) privacy phones. That reflects poorly on humanity.