This is a bummer. If there was ever a time this sort of device was needed, it's now / in the near future when Google (probably) starts requiring all Android apps to be signed by approved developers and further locks down the Android platform.
I kind of regret not buying one of these instead of a Pixel 7 but, unfortunately, I'm pretty tethered to the Android ecosystem at the moment.
I'm monitoring support for PostmarketOS on Fairphone models, with a mainline Linux kernel. They actually have someone working on upstreaming stuff to mainline, which is quite nice.
The FP6 doesn't seem there yet [1], but the FP5 is close! [2]
The FP5 is a comfortable device. With call support completely figured out, Mobile Linux would probably be enjoyable on it.
The problem is SMS sucks major ass and it's, by far, the least secure channel for... well just about anything, but especially for private, personal conversations.
You say that, but they're discontinuing it because they didn't sell enough of them. It may be the device we need, but it's not the device we're buying.
I never had a PinePhone Pro but I did buy an earlier model and the user experience was very far off what we have come to expect from modern phones. I'm sure the Pro was better but still probably not that close to an Android or Apple phone. That's not a sleight on the company at all, they faced some very high barriers and I respect what they did. But I don't think this is entirely on consumers for not putting their money where their mouth is. It's just yet another example that it's really hard to create something (in the phone space, at least) that is affordable, open and highly functional.
The product was never really attractive by itself. You had to be extremely patient and willing to overlook the serious problems with their software to even try to use it.
I would like to see some other company take a real swing at this product space but with a less strict approach around the hardcore open-everything ideals. They’re good in theory, but in practice people want a phone that works and you have to get to that stage first.
> I would like to see some other company take a real swing at this product space but with a less strict approach around the hardcore open-everything ideals
That... kind of was what happened. Purism released the Librem 5, and people were shocked they pushed so hard to get the FSF's "Respects Your Freedom" certification.
The Pinephone (and Pro) used a less Free modem, resulting in much lower power draw, but the UX was still, well... Alpha-quality is putting it gently
So if you come out with a typical android phone, you have to do X amount of work yourself and some Y amount you can just buy.
If you are doing something like a PinePhone, there's a multiplier on the X of work you have to do yourself ... a significant multiplier and that's the problem.
That's why if you have a something like a Pine phone that has the sales of say something like this: https://www.bluproducts.com/android-phones/ you're going to bleed money - you won't survive - it's too much of a lift.
That's also why almost all phones (that are financially viable) look and feel almost the same.
NB: Attestation has no security value here because if the phone isn't compromised then the owner having root isn't a security problem and if the phone is compromised then the user is entering their bank login into a fake scam app that doesn't require attestation regardless of what the real one does.
But because the banks that require this are cargo culting some nonsense, they require iOS or Google Android but don't really care how old the phone is. Which means you can transfer your cellular plan to the phone you actually want to use and then just keep your existing phone indefinitely to run the bank app over WiFi or tethering.
The first is that your phone is not compromised. In this case there is no other app trying to steal your bank's authentication token. This is true regardless of which OS you use or whether you have magisk installed or what other code you put on your phone that isn't trying to steal your bank's authentication token.
The second is that your phone is compromised. Then what prevents the device from capturing your bank credentials is the same as if you use a compromised phone running Google Android: Nothing. If you enter your bank credentials into a compromised phone, the attacker gets them. Attestation can't prevent this because the phone is compromised, so the login screen isn't from a bank app that requires attestation, it's from a scam app which is exfiltrating your credentials.
This is far from the truth assuming by compromised you mean that the user has installed a malicous app. Android has proper sandboxing which means that other apps can't read the token owned by the bank app. This is part of the Android security model and attestation is evidence that the Android security model is being enforced. Phishing apps are different from an app that steals existing authentication tokens on the device.
> Android has proper sandboxing which means that other apps can't read the token owned by the bank app.
Let's consider this alternative as well:
Scenario 1: Device has no malicious code at all; same as scenario 1 before.
Scenario 2: Device has a malicious app but the malicious app doesn't have root and the OS (regardless of whether it's Android or something else) enforces proper sandboxing. The malicious app can't extract the bank authentication token regardless of attestation.
Scenario 3: Device is fully compromised; malicious code has root. Same as before, if you enter your credentials into this device the attacker gets them.
The problem is that the only useful thing for attestation to do is to distinguish between 1 or 2 vs. 3, but that's the thing it can't do because if the malicious code is privileged it can replace the bank app with one that exfiltrates the credentials without requiring attestation, so the only cases where attestation is happening are the ones where it isn't needed.
That's the point. The device being compromised to the point that malicious code is actually meddling with the bank app is the only time that having it fail attestation would be useful. The other cases are useless/vexing false positives. But attestation doesn't happen in the one case it would be useful because then the attacker-controlled code won't even attempt to do it, it will just exfiltrate the user's credentials to the attacker.
You aren't responding to the scenario that was posed. You're assuming an isolated compromised app on an otherwise clean device. GP is assuming a compromised device.
Of course attestation does nothing to improve the "single compromised app" case since (assuming Android) that goes nowhere either way. The only thing attestation does is meddle in end user affairs.
And now you're being intentionally difficult. Please interpret things in the most plausible manner. Beyond common decency, it's part of the site guidelines.
By "not compromised" GP clearly meant a scenario where no malicious apps are present.
I agree that's a serious omission. I responded to your scenario (a nonzero number of malicious apps) in my earlier comment. Any Android device will defend against that regardless of the presence of attestation.
Any non-android device can still use online banking and thus attestation doesn't appear to accomplish anything legitimate. Building out proper support for hardware tokens would provide superior security in approximately all cases.
The specific "root on android" scenario isn't generally a concern. Typical implementations require explicitly granting the capability to a given app. A malicious app can't gain it without fooling the user, at which point it could more easily phish the credentials and possibly even proxy an entire session.
>Please interpret things in the most plausible manner.
Your suggestion is not plausible as every security feature has 0 security value if there is nothing malicous. It would be like someone saying that antivirus is useless because if someone doesn't have a virus then it doesn't do anything.
>Any Android device will defend against that regardless of the presence of attestation.
Rooted android devices can be set up in a way that malicous apps can gain root and then read it.
>Any non-android device can still use online banking
But this comes with a different risk profile. A bank can reduce risk for a subset of their customers.
>Building out proper support for hardware tokens would provide superior security in approximately all cases.
I think usually the hardware token gains you access to an authentication token. You don't sign every request you are making with a hardware only key.
>Typical implementations require explicitly granting the capability to a given app.
And the majority of users have no clue what an app is able to do. If root is given to it then it can do anything. This is in contrast to when root isn't available and users are protected by the sandbox the app is in.
Yes, a user could intentionally do something stupid. A user could also voluntarily wire the majority of his balance to a foreign account. That fact has no bearing on a discussion about the security impacts of attestation.
From a technical perspective device attestation doesn't add anything here. The typical user doesn't receive any additional protection. All of its supposed "benefits" ultimately stem from the restriction of end user choice but those same end users _already_ have a practically limitless selection of stupid choices available to them. And these are generally very deliberate choices that we're talking about here. Not subtle confusion.
> the majority of users have no clue what an app is able to do. If root is given to it then it can do anything.
If a user is stupid enough to seek out root, ignore all warnings, install a malicious app, and explicitly grant it root, then he was fated to fall for a much simpler scam regardless. Such as granting a malicious app admin on his laptop and then logging into online banking. Or installing a phishing app that proxies the session to the bank.
Typical users don't seek out root, don't install custom ROMs, and don't consent to the warning message about installing APKs from unknown sources. Grandma isn't ricing her mobile phone.
Support for hardware tokens or TOTP would address widespread real world attacks. Shutting down various customer service social engineering account reset tactics would also help, but that would actually cost money. In contrast attestation doesn't accomplish anything other than infringing end user choice. It's a highly unethical waste of resources.
> It would be like someone saying that antivirus is useless because if someone doesn't have a virus then it doesn't do anything.
Suppose you have an "antivirus" program that works like this: The system makes a list of every program that runs as root during boot and then at the end of boot the antivirus program checks the list for unexpected programs and if it finds any it displays an error and refuses to display the login prompt to prevent the user from typing their password into a compromised device.
That "antivirus" system is useless, because if a malicious program did run as root during boot then it could just reconfigure the system to display the login prompt unconditionally.
The way attestation is nominally supposed to work is that a remote system cryptographically verifies the state of the local machine before giving it some secret. But that doesn't work in this case because the secret -- the thing that allows the user to sign in -- is coming from the local user rather than a remote machine. The attacker doesn't need to perform attestation or retrieve anything from a remote machine in order to display a local login prompt and collect the user's credentials, and that's the end of the game.
> Rooted android devices can be set up in a way that malicous apps can gain root and then read it.
So can PCs, or various non-rooted android devices that bank apps run on even though they have known unpatched vulnerabilities.
> But this comes with a different risk profile. A bank can reduce risk for a subset of their customers.
How is it reducing risk for anyone? Each person still has the same risk profile as before. The person with a locked Android device still has a locked Android device, the person with an unlocked Android device is now forced to use a PC which is an inconvenience with no security advantage.
Just because an antivirus isn't perfect that doesn't mean it's useless.
A bank may not want to put in the extra effort of supporting 3 platforms of secure phones, insecure phones, and insecure web and would prefer to support less and potentially dropping features from the web platform.
What's protecting me when I do online banking in the browser, which I can do using more or less any device? The answer is that targeted attacks against the average middle to lower class individual are rare enough that there are far more worthwhile things to worry about. Such as the vast majority of banks (at least in the US) not supporting hardware tokens.
Not in the US, at least so far. If that were ever to come to pass I would be in danger of becoming unbanked. I flatly refuse to install third party proprietary software on my phone (I grudgingly accept firmware blobs for lack of a realistic alternative).
Here the majority continue to use SMS based 2FA rather than supporting TOTP or hardware tokens.
Note that TOTP can be handled by any app of the user's choosing, doesn't facilitate attestation or any other user hostile practices, and in practice means that an attack requires physical theft of the device. While the theory might differ, in practice the effective security level is equivalent to other (objectionable) schemes.
> Note that TOTP can be handled by any app of the user's choosing
The banks are probably using the same standard behind the scenes, but they don't allow alternate TOTP apps. There's no point where they give you a key to set it up in an alternate app.
I suppose part of the point is a lack of trust in users' ability to handle their own security, and the possibility that they may provide such a key to a compromised TOTP app.
> hardware tokens
It'd be excellent if banks moved back to purpose-specific hardware like that. Even better if it were some standard with multiple providers, like FIDO2.
Yes FIDO2 would be ideal. The stuff about TOTP was a digression regarding the relative security levels between the two. The extra hardware doesn't provide any practical benefit (at least IMO) for the typical person running a FOSS authenticator app on a mobile device with an up-to-date OS. Obviously if you're something like a high volume day trader then it might be a different story but the venerable $5 wrench attack still applies so even then it seems pretty questionable to me.
> The extra hardware doesn't provide any practical benefit (at least IMO) for the typical person running a FOSS authenticator app on a mobile device with an up-to-date OS.
For the user (and in the context of Pinephones), the benefit would lie in getting banks out of their phones. Banks want a device that's not under the control of the user to use as 2FA. A dedicated hardware key would be a compromise for that. They used to give them out, but I pessimistically imagine that today they might prefer to lose a customer.
And what does that buy you? The user goes to the bank website in a compromised browser, attacker gets their password. Bank sends a code to their phone, user types the code into the compromised browser, attacker gets the code.
Then tell your banks they have to support the PinePhone or they'll lose you as a customer. The PinePhone folks don't have access to the source code of whatever interface your banks provide on Android/iOS, so they can't do anything about it.
I bought one as soon as they were released, as well as the keyboard case. It never really worked correctly, but I loved the concept and wish they would have succeeded.
I know it's a niche product, but I'd love a pocket sized Debian device with cellular, decent standby time, and a physical keyboard. Anything out there I should look in to? I've tried to make various GPD devices work, but they are too big, and the standby time isn't great.
I think that finding an aftermarket keyboard solution for a smartphone using the android virtualization framework to run a debian VM (i.e. the "Linux Terminal" on Android 16) is your best bet by far.
The economies of scale (and compactness!) in mainstream smartphones are very hard to match, and they tend to have superior power management.
Do heavy lifting by logging into a remote server for best battery life and compute power.
Some of them are UMPCs, some are sub-notebooks and some arguably are maybe netbooks. The GPD Micro PC 2 is not that fast and only has a 7" screen like the original Asus EEE PC. It's got less bezel, so perhaps it bleeds the line between netbook and UMPC but inflation adjusted it's pretty comparable in price.
ahhh fair enough then. I did admittedly only have a quick look at their site.
The NetBook market was such a good one. It really is a pity the Microsoft killed off the spirit of it, and then Apple convinced everyone that pretty and expensive things without keyboards are nicer than cheap and practical things.
I do miss EeePCs. The death of the netbook was probably the biggest blow for desktop Linux becoming mainstream.
Were they? I think that for work or hobbies laptop is better, has better screen and keyboard and they are not that expensive now. And for watching short videos you can just use a phone.
Pretty cheap by some definitions, yes, but as best as I can tell (historical prices aren’t exactly readily available), the Micro PC 2 ($700 list price before tax) is still between 1.5× and 2× the price of the original (€300—presumably including about 20% tax—per the linked article, between $200 and $500 per the Wayback Machine, in nominal dollars before 10% inflation).
There's https://furilabs.com/shop/flx1/, but there don't seem to be many people playing with these. Perhaps someone on HN would be willing to share their experience.
Pine has an attention problem, they produce a lot of different things but the ones that people really wanted like the PinePhone Pro just were never there, with they'd have just doubled down on something and made that REALLY good first.
I preordered the Pinebook, it was never really awesome but it was neat, I accidentally broke the screen and was never able to get a replacement (at least from the store - they were always sold out.) Turned into ewaste.
PinePhone Pro wasn't too good either, I really tried but had lots of flaky issues with basic phone functionality, eventually gave it away to a friend. It's collecting dust for sure and will eventually be more ewaste.
Pine’s approach has always felt like they wanted to make the hardware and then hope that the community would sort out of the software for it.
There isn’t a lot of motivation for the community to sort out the software for them when the products aren’t attractive enough to build a community around.
I wish they would narrow their focus, shift some resources into software development, and produce at least one very good product. As it stands, the Pine brand has become associated with buyer beware.
To be fair to them, they at least tell you that software support is largely community provided. However, you probably won't know how that is in practice until you experience it once or twice.
I really like the phone/desktop convergence concept. Mostly I think because I want the freedom / open experience of my desktop on my phone though, I think.
But I think most folks interested enough in the concept are also rich enough to afford a phone and a laptop, and if you want a keyboard for your phone you might as well just use a laptop.
I still think conceptually it's the right direction for tech that our devices should be so flexible, but it's hard enough in practice that it's not generally done.
I feel the same way, but while there are definitely actual hardware limitations preventing phones from being identical to computers, the problem is mostly a choice. Why aren’t ipads with keyboard cases able to be used exactly like laptops, for example? I think companies seized on the combined accessibility and restrictiveness of smartphones to justify design choices which are more about profit. Restricting the app library makes apple a great amount of money. Ads are hard to block across a mobile device, why else if not for more money? I think the circumstances of smartphone development gave them the opportunity to make these choices and we’ve gotten locked in since.
> Why aren’t ipads with keyboard cases able to be used exactly like laptops
Small screen - cannot fit many controls or code. Small keys - cannot type fast. No touchpad - cannot do precise clicks, therefore cannot have many controls on the screen. Try imagining something like editing lots of small notes in a music editor with your fingers...
I can hit 40-60 WPM on a BlackBerry keyboard, but a chicklet keyboard is too much for honest-to-god software developers?
The small screen is equally ludicrous. The desktops of a few decades ago had lower resolution on physically smaller displays, and I consider a large, crisp display a must-have for longer sessions - not a hard requirement for smaller, quicker tasks
Not having a trackpad is one reason the iPad supports USB mice too, and giving some users a trackpad would result in the same complaint: "This is terrible, can I use a real mouse please?". More to the point, parent is complaining about keyboard cases with trackpads, which are mediocre in part precisely because Apple has constructed a software ecosystem that is hostile to powerful, desktop-style programs
I think the convergence concept still makes sense in big corporations where most of your work happens on a VM in the cloud, while you just use your device as a thin client. Especially in places they don't even let you use a thirdparty browser >.>.
Earlier this year, I was actually tried to replace my bulky 16" MBP with a Pixel 9 for work. Android's desktop mode just wasn't there.. Maybe I will try it again next year...
All I really need was a browser and a drop down terminal anyway.
There are at least dozens of us doing this. My $5k bloated corporate laptop sits in my office 24/7. The 25% of time I’m traveling is with a $300 Chromebook with Linux Mini, a Bluetooth mouse, and logged into to a Windows VM.
Now that everything corporate is forced into the cloud, using a VM doesn’t carry all the extra downsides it used to.
and the bonus is that, when the workday is done, I have a machine I actually own and can use without breaking policy.
> But I think most folks interested enough in the concept are also rich enough to afford a phone and a laptop, and if you want a keyboard for your phone you might as well just use a laptop.
Laptops are bulky; phone and keyboard can fit in one's pocket. I also dislike the idea of carrying around a device that's not under my control. It's not about wanting my phone to behave like a laptop because I can't afford a laptop. It's about getting to have control over my phone the same way I have control over the laptop.
For example, when I try to screenshot and the OS says I'm not allowed to by the app, on my own device, I die a little inside. The very idea that an OS would obey an app over the user is really messed up. It's really wrong. It's like a guest saying their guest sets the rules in your own house.
Also the weird, arbitrary limitations. On Android you can split screen and show 2 apps vertically at limited, specific heights. On the Pinephone with i3/sway, you can divide the screen with as many windows as you want, in whatever orientations you want, with as many workspaces as you want. You can set the scaling to whatever you want, have interfaces be as big or small as you want. Limits aren't arbitrary.
> I still think conceptually it's the right direction for tech that our devices should be so flexible, but it's hard enough in practice that it's not generally done.
The difficulty isn't in getting desktop stuff to work on the phone. The difficulty is getting phone stuff to work on the phone.
Huawei as well. Used to have a P30 Pro. It felt like a true downgrade when I bought a Pixel 8 Pro two years ago and it had no desktop mode and a worse camera to boot.
the problem with keyboards like this and the ones on the surface is that they have no connective hinge and rigidity. with my UMPC at least, I like to hold it by the base while looking at the screen. I really wish there would be a clampable keyboard that used nice membranes like the GPD but had a phone clamp on top like a selfie stick and a single swivel-hinge like those fujitsu convertibles
PinePhone Pro's main drawback was the low-res display for a price of a midrange Android with far superior specs. I was thinking about buying one but it was barely better than the regular PinePhone.
It costs 600 euros in europe (plus shipping?) I don't know why they expected that it would have sold more. Even the "200 dollars" PinePhone is 350 in euros.
It was on my list of devices that would have been fun to hack on, but not at that price.
The situation with phones is pretty bad now. The phones that have or support open-source ROM (Pinephones, Pixels etc), are usually expensive and cost like 2-3 normal phones. So it might be cheaper just to buy a non-free phone and keep it in airplane mode (and connect it only to a airgapped home WiFi network to transfer data), and a second dumb phone for calling. Or have one phone with your data, connecting to Internet via second $50 phone, which has connectivity, but no data, and DPIs all requests from first phone, basically serving as a portable router.
And proprietary phones are really bad, today I read the news that Samsung promised to comply with law and auto-install Russian software (like Vk, Kaspersky, Rustore) when the phone is connected to the Internet. And that's a Korean company. Consumers are treated like garbage today.
It's understandable that you earn more on expensive phones, and freedom is not free, but I don't want to buy a phone that costs like 2 cheaper phones + a guitar.
I would prefer simply having something like GrapheneOS with root access.
That pile of garbage had crazy critical hardware faults they never fixed.
1. If the battery is discharged, then in order to recharge it, you have to take out the microsd and sim cards, press an SMT button, and plug in with battery.
2. If you bought the keyboard/battery, and you plug in USB on the phone, you fry the keyboard/battery. Shit burns up, haha screw you.
And if you say anything, you the user are at fault. You didn't read, or follow their discord, or whatever, because it is 'Your Fault' ™.
Pine's primary game here has been to paracitize off of FLOSS folks, pump out incompetent and/or broken hardware, and summarily blame FLOSS for their not-working. At minimum, they should be funding the projects they want to build on/paracitize. But they do none of the sort.
We would be better if Pine died as a company. Then they wouldn't be sucking the oxygen out of the FLOSS arena, and might get more respectable orgs here.
I do not understand why so many companies have that charging issue with Linux devices.
Anbernic has the same
issue with the RG35XX series. If the battery reaches 0, you may need to pull it out just to get the charging to work. And if you accidentally connect the wrong kind of usb-c charger, it won't charge, so you may have it plugged into the wall for days and come back to it being dead and needing battery surgery.
Great devices for hacking because they are cheap though — cannot understand why an expensive phone would have that problem too.
Anbernic cheaped out when trying to support USB host mode, as a result the device will not work correctly with an electronically marked cable. You can fix this - but you lose host mode - https://www.wirehead.be/2024/10/21/anbernic-rg35xx-h-charge-... . The article is for the RG35XXH, but pretty much all the XX devices have the same flaw.
Some of pre-HSDPA Nokia phones had the same issue. You needed a clip-on raw cell charger to revive them. It's manufacturer skill as well as a bit of cost issue.
You can buy eMMC cards that fit on the board. Their documents say you can boot from them. Like 10x performance of a mSD card and less wear-out.
I use a USB device to make the drive mountable from a Linux box, and copy the firmware as prescribed. I then unmount and load in the A64, and.... NOTHING.
Supposedly there's a uboot command that maybe enables it. Or maybe its autodetect. Or maybe (5 other ideas, that all fail).
I returned that shit too because they make claims that it works these official ways, and it never does.
Pine is a parasite. Always has been, but they make-pretend that they're some great FLOSS company.
Thank you. That was exactly my point - they camped in a niche they had no intent to do properly.
Worse yet, they screamed at users to lean on the community (read: unpaid FLOSS as support). They refused to provide even baseband images to do the things they were selling, like Pinephone Pro as as, you know, a phone.
At one point, I thought they were just an upstart trying to get off the ground. But in reality, its a complete grift that ends up taking community resources and nothing to show for it.
I have their pinenote - as far as I can tell, the community has done a great job on the Linux image, but I ended up sticking with the android fw as I can't be bothered to reflash the Linux partition now in case I brick it.
I think it can be done this way, with the manufacturer taking care of hardware and the community taking care of software - but they should at least fund one or two people and some projects directly to make it work.
the pinenote is a great little ereader with the android fw.
Last time I bothered with news from Pine was with that Manjaro and bootloader drama. I am not even sure what came out of that...
But the other issue is I just found out from this post that PineBook Pro has been discontinued. But it is well listed in their devices, a shop exists just fine, with a price tag, it is just out of stock. Forever, apparently. I thought they were just being stingy with their production sizes, or they just didn't have enough traffic to make more.
Oh well, you can install postmarketOS on Chromebooks with ARM processors, and "normal" Linux is going well on other ARM devices, too. You can also find RISC-V laptops on Alibaba.
When they were "new" the tech was old already and then the lack of drivers for the camera for example which I can't talk, I'm not a driver developer. I thought it would make me get into developing drivers but I never did.
Or writing Qt/C++ apps vs. cross platform/web that I was used to.
For some reason I was obsessed with the thought of Dex/your phone being a computer if connected to a big monitor, it was cool using VS Code on the PPP but there would be problems. The external monitor I think was capped to 1920x1080 (if connected to a 1440P display a huge chunk was just static)
I had my fun with it
I was interested in the Pine 64 eInk tablet but that seemed to not be in stock at the time. I had the Remarkable 2 at one point, I want to get it again.
edit: looks like the PineNote is in stock right now
my consumer brain is getting tickled, might get a PineNote, what I liked about the RM2 is I didn't have to charge it for like a month was crazy, unfortunately PineNote doesn't seem to have that, and no tilt support on pen but ehhh. I don't know if RM forces you to have a subscription now, I didn't have it on mine when I got it in like 2022.
Yeah for these kinds of things to work the hardware has to be at least somewhat competitive and the overall device reasonably usable. It doesn’t need to be a flagship or anything, just relatively recent, and the experience doesn’t have to be perfect, just actually suitable as a daily driver. That’s what gets people interested, inspires devs to contribute and fill app gaps. This kicks off a virtuous cycle where less technical family of those devs see the device and want to try it, which in turn creates more demand for apps pulling more dev interest and so on and so forth.
It’s critical to be good enough to clear that initial hurdle, though. Without that, the device is relegated to the most curious of tinkerers which just isn’t sustainable.
As far as dev experience goes, from my limited dabbling I think GTK+Adwaita might actually be overall nicer for mobile development than Qt, due to furnishment of a full set of widgets without having to pull in anything else, as well as bindings to way more languages. It’s considerably more comparable to UIKit and Android Framework at the very least.
>> That’s what gets people interested, inspires devs to contribute and fill app gaps.
Alas, no, sorry. It's really not the number of apps that matters. Any phone OS could have less than 500 apps and be wildly successful. On the other hand you can have a million devs cranking out apps and the device would still be useless.
Turns out the only apps that matters are the ones everyone actually use. Your banking app. Facebook. Whatsapp. Uber. Airbnb. Etc. All the product of big corporates.
And my bank (to pick just 1) is simply not interested in developing their app for yet another platform. The effort in building it, supporting it etc simply makes no sense.
Facebook, Netflix, Twitter, ESPN, and the next 40 "must haves" simply don't care. And independent devs simply cannot fill these holes. Without these the phone is simply useless as a daily driver for anything other than complete techno fanatics.
Crumbs Microsoft couldn't convince this cohort to get on board. Some random Linux phone certainly won't.
I don't say this with glee. They're nice toys. But Joe public doesn't reject them because of the hardware specs. He rejects them because they're functionally useless in the actual world.
I think this is wildly more individual-dependent than you may think. Speaking personally, while I do have a number of big commercial apps installed, the number that couldn’t be filled either with a web app or the Android version via a compatibility layer is tiny. The native apps I find most difficult to replace are those by small to midsize devs, which are exactly the ones most likely to be the primary contributors to a new platform early on.
I don’t think this is particularly unusual, either. Plenty of people have absoutely no need for video streaming on their phone outside of maybe YouTube for example, which works well enough on the web.
Microsoft’s not the best example here, because they had momentum with both devs and users but shot themselves in the foot repeatedly on both sides of the fence: warring internal factions reset Windows Mobile development multiple times consecutively and burned through dev goodwill and poor strategy on the consumer side killed things there. Mozilla’s foray into phones failed because they insisted on sticking to entry level devices which were both not interesting to most of the market and not powerful enough to handle a new unoptimized OS.
> Mozilla’s foray into phones failed because they insisted on sticking to entry level devices which were both not interesting to most of the market and not powerful enough to handle a new unoptimized OS.
I think that was not a bad idea. Other open source OSes target expensive devices like Pixel and as a result many people are not buying them because paying a premium for a non-standard phone with buggy software and lacking features doesn't make much sense.
As low as the number who buys a flagship or uses one they already have to run an immature OS may be, it’s still going to be higher than the number who buys a budget device with an immature OS, especially if your goal is to stoke developer enthusiasm.
Think about it.
The everyday Joe who might be interested in a cheap phone is going to be looking for bang for buck, which something untrusted doesn’t get them. For this person something like a budget Android phone from a proven company or a used iPhone is more attractive.
Technical people aren’t going to be interested in a budget phone because they know it’s not going to meet their standards just by looking at its specs, before even considering the OS. They wouldn’t have bought the equivalent Android phone either, and the OS just detracts further.
Lots of people buy flagships, on the other hand. It’s too not unusual for mobile developers in particular to have multiple. An OS that targets them can be put on a phone that these people already have laying around. If the OS is intriguing enough, yes, some will buy a flagship to be able to run it, because it’s low risk. Worst case scenario they have a nice Android device, which is vastly better than buying a low end phone that ends up going unused because the hardware+software combo is intolerable.
Linux phones are an experimental devices for enthusiasts where lot of things are not going to work, so it would be less risk to buy a cheaper phone for experimenting. Doesn't make sense to pay iPhone's price for a phone that barely works.
Even with that logic I think there’s a floor to how cheap/low end/old you can go and still expect significant interest. 2-4 year old midrange equivalent is probably the limit factoring in the performance overhead needed to make unfinished OSes run well enough to have a semblance of usability and not be miserable.
The hardware for the Librem 5 is difficult to justify for the price. Googling suggests that its SoC is comparable to a circa-2016 Snapdragon with worse power efficiency. At $800 you’re looking at upper-midrange/lower-flagship pricing for a device that many phones half its price or less would run circles around. Similar problem as the PinePhone Pro.
If it were in the ballpark of a 2-3, maybe 4 year old Pixel, it’d make more sense and probably sell better.
For what it's worth, I don't have a single one of the apps GP mentions installed on my phone. No Netflix, no Facebook, no WhatsApp.
I am aware that I am an outlier, though. I need either Anki or AnkiDroid. I need a somewhat decent text reader, preferably one that properly highlights and folds Org mode files. I need a voice recorder that timestamps the file name. I don't think I know anybody else who needs any of those three, other than those I've introduced to Anki.
GTK uses a C emulation of OOP, and the code gets very verbose (and functions have names like "gtk_event_controller_get_current_event_device", so you cannotfit more than one call in a line). I do not recommend to use GTK (or anything from Glib) with C, use bindings for a better language, and you save 2x-3x in code size.
> The external monitor I think was capped to 1920x1080 (if connected to a 1440P display a huge chunk was just static)
That happened to me with the PP, but I can reliably use a 1440P monitor with the PPP. Not sure if it's the phone, or the fact that I added a power cord to the phone while it was connected. I can't remember if I did that with the PP.
EDIT: Scratch that. It's because I used the official dock with the PP, and for the PPP I used one I got on Amazon.
The official dock is docked (:P) to 1080P.[1]
I wonder how it happened that the de-facto standard here is for the protocol going over USB-C to be DisplayPort, but for the hardware connection to be HDMI, and so leading to docks needed to be spec'ed to the resolution you want instead of being passive.
The answer is boring and annoying, they almost certainly want it to work with TVs and cheap monitors both of which commonly only have HDMI inputs. It has been my experience that you typically have to pay more for a USB-C dock with displayport outputs, even though they don't have the chip just cause of economies of scale.
Honestly the company is kind of a nightmare. When I ordered mine, they shipped it with no packaging from Hong Kong. Obviously it arrived broken, and when I told them they said I could pay to have someone fix it in CA. It ended up taking 2 months for my chargeback to go through, and they were threatening me the whole time. It was only after they lost (which of course they would, it's like they've never worked with a credit card processor before) they got really sweet and sent me a return label.
Just a terribly run company. I'm sure it's better if you're buying bulk boards from them but after my experience I wouldn't work with them again.
> When I ordered mine, they shipped it with no packaging from Hong Kong.
As I understand, customs (in your country) will typically check what's being imported, to verify the invoice is true for correct taxation, and also to check that it's something allowed. It might be that your customs authority didn't put it back in its package after inspecting it.
I think the PP still makes for a great educational device. I was following the Lupyuen tutorials for PinePhone nuttx for a while, and then got inspired to have a go at following his revese engineering journey using Zig. It has been slow going but great fun! Just started on volume keys.
They say they continue production on the PP for 2 more years, so hopefully I'll have a bit more than 'Hello, world' by then.
But buy a serial debug cable and SD card extension if you decide to have a play with one, huge time savers! I only just got mine and it has speeded up things no end.
With the Android becoming a privacy nightmare, Pine was like the only hope for some FOSS phones. Their main drawback was the software. Now given the coding LLMs available these days, would generating a set of useful apps for Pine be a major problem? They can be pretty minimalistic but must be 100% reliable for the platform to take off. Right now they are super buggy and basic features work randomly.
I used a Pinephone Pro as a daily carry. It wasn't actually the lack of apps that killed it for me. Fractal, the Gnome Matrix client, was great. Phone calls were functional, Mobile Thunderbird (thanks to PmOS packagers), Mobile Firefox, and Gapless (my preferred music player for mobile) all worked well, and I could actually use native apps for most of my use-cases, like Gnome Password Safe (the Keepass client), Gnome Calendar, etc.
The battery life and performance absolutely murdered it though, and it was worse for the Librem 5. The PPP at least had external chargers for sale, and was made to be compatible with Samsung batteries, so I could, and did, carry 3 on me. The (larger) dev community for the PPP also put out things like Sleepwalk (to periodically wake the modem for notifications), and had more stable, cooler- and longer-running modem software for the PPP.
Somehow, the software for Linux Mobile isn't impossibly far off. Modems are a bitch though. Like, buy Qualcomm stock levels of "This shit is insane, how does any of it work as well as it does".
Note that this improves reliability for suspending the modem, not power draw while the modem is awake. The Pinephone (and Pro's) modem stil runs circles around the L5's modem for power draw and data reliability, and I say that having used the L5 with the improvements you pointed to.
Really sad about this. I recently bought another Android and was checking out the PinePhone Pro, but only wanted something with a little better specs..
It's just big enough that it might be barely usable to touch type with sufficient practice, not comfortably though. Definitely seems smaller than the Libretto from glancing at pictures. If the idea is to have a portable keyboard to then sit down somewhere and work, there are pocket BT ones that fold in half and are comfortably big.
The only use-case I can think for the Pinephone keyboard is if for some reason you want a physical keyboard to use while walking.
they discontinued it because of quality control reasons, which tracks with my experience. the key mechanism is weird, a circular membrane around plastic posts, and it makes some of the keys (especially the top row) constantly miss inputs. there's a 3D printed shim 'fix' but that barely helped me. off-center keypresses also bind really badly. the pogo pins that connect to the phone are flaky, which can make it lose connection and require a reboot. like the keys, there's a shim you can use (putting some paper behind the contacts) which only sort of helps.
a benefit of the keyboard case is the battery it has that extends the phone's battery, which is nice, but it's an odd setup too. the charge controller on it was originally designed for a power bank and seems like a bit of a crude solution that's lead to multiple issues, like how you could damage the phone having it plugged into USB while the keyboard case is connected.
it's slow to charge too, often it can't even keep up with the phone during use.
When your fingers are too fat and/or your hands are too big for a Libretto, or you have pathological issues troubling the relevant appendages, then do yourself a favor and don't bother.
It's obvious: These keyboards are, or should be, primarily made for mobile people, so high quality and tray or coffee table compatibility are a must. The Psion 5-series keyboards are ideal for this as long as you don't fuck with the formula.
They were all too slow and buggy in my experience to use; basic functionality like text or camera was consistently broken or buggy, and it took way too long to load.
The speed issue could in the short term be bruteforced with stronger hardware, but as far as I'm aware there’s no Linux phone out there with anything approaching what one might consider “strong” hardware.
It’s a bit puzzling because there’s Chinese companies like Retroid and AYN pumping out Snapdragon 8 Gen 2/3 handheld gaming devices that the community has ported Linux to, with working graphics acceleration and everything. I doubt these companies are using fully bespoke mainboards, because most of their components are borrowed from existing smartphones. Seems like some company could stick one of these Snapdragon boards into a phone chassis and have a reasonably compelling Linux phone.
> It’s a bit puzzling because there’s Chinese companies like Retroid and AYN pumping out Snapdragon 8 Gen 2/3
There is no path from "I made a cellular phone" to "I can place calls" that doesn't involve tens of millions of dollars paid to the gatekeeping cellular carriers.
Without the equivalent of Carterfone for cellular, this will never change.
Not surprising. These phones were out of date when they debuted and not updated, in like five years?
I played with one for a bit but then mobian trixie updates bricked it twice and I gave up. Only wanted it to be on par with my old iPhone 6s, but it never achieved that.
Star labs makes a great Linux tablet, the starlite, so it is near possible to make a decent floss phone these days.
For quite a while I used an iPad+NUC, which was perfect and I loved it, except it could only really run terminal programs (via ssh) or iOS programs nicely. VNC kinda works but not well.
Eventually I switched to a folding convertible laptop, but it is a significant downgrade in terms of form-factor. Nice to know that exists, hopefully they’ll stick around until I’m ready to turn this thing into e-waste…
Yes, though haven't used it as a convertible yet.
I usually use tablets as my home movie machine since we don't have a proper TV. At this, the Starlite with Phosh and recent Fedora/firmware updates is fantastic. Freetube, Netflix and Kanopy on Firefox via widevine, PBS, and homegrown .mkv's are more than I have time to watch.
On the go a Framework 13 is fantastic, tall screen, light and powerful. Only waiting on coreboot and ECC RAM.
The PinePhone Pro just wasn't a very good product. There was frankly unnecessary drama regarding the bootloader of all things, which was a bad start. The specs were obviously a bad value compared to any mass-produced phone, though it did bring the Linux phone down to a price point where an enthusiast could reasonably buy it, so I can't say it was priced that poorly. But, the big problem was software. Getting the damn device to work reliably was a true pain in the ass. If you could get "deep" sleep to work, then it would last longer than a couple hours on battery, which was nice... But sleep/resume on the device was buggy and slow. Getting a phone call can wake the device, but by the time it actually wakes up you might've already missed the call. And audio routing for calls was shockingly ugly... Most of the time it was routed directly by the hardware, bypassing the Linux audio stack entirely, but it was quite flexible and you could route it into Pipewire/etc. The microphone quality is "it works" tier, though the person on the other end may be occasionally alarmed by a flash bang of noise for unknown reasons. There are two piss-quality cameras that sometimes work for a little bit until they stop working.
I waited a long time and occasionally checked to see if anything had changed, but it was clear that Pine64 had again taken the approach of "build it and they will come" hoping for other people to clean up the mess and make the phone usable. And to be fair, they were up front about this, to some degree, but they built it and nobody really came. The truth is it's just too damn hard for random people to fix all of the software issues on a device like this, especially when it's basically not usable as a daily driver yet. Working on a device like this is a full-time job, and you can't really replace that full-time job with 20 hobbyist weekends stacked in a trenchcoat. I did realize this when I bought one, with full intent to be one of those hobbyists spending weekends on it, but at least to me, it was simply too broken.
So I think the PinePhone experiment is a failure. Then there's the Librem 5, which I presume is at least more stable and usable, but it's at a price that is less easy to stomach.
I think until the software is ready and a market is proven, the best route for Linux phones is going to be by taking Android phone parts and trying to make it run regular Linux, a la libhybris. It may not really work out either, but it does seem like it is a path of significantly less resistance, where the software can be worked on with solid hardware and hopefully solid enough drivers to build on.
There are some folks working on this angle, too. The latest I've seen is the Liberux NEXX, no idea how it's going, not affiliated in any way.
> the best route for Linux phones is going to be by taking Android phone parts and trying to make it run regular Linux
> and hopefully solid enough drivers to build on.
This is the crux of the problem with this approach. That the drivers would remain closed-source. AFAIK, the Pinephones and Librem are the only ones with open-source drivers.
Fully understand the issues with this approach: my skepticism has been expressed in former HN comments. However, the issue is that in practice it already seems like this approach has yielded something closer to daily-driver maturity, which would make it a suitable platform for experimenting with software. It may be necessary since it's hard to justify actually doing all of the effort to build the phones with not much impressive to run on them.
I don't blame them for the prices given how unique the product was, but the company was always kind of a mess. Lots of broken devices and they had/have an outrageously hostile return policy, forcing people to do charge backs. I agree on the build it and they will come philosophy, it felt like they were riding the popularity of linux phones while not contributing a lot to their future.
> it felt like they were riding the popularity of linux phones while not contributing a lot to their future
I think they're the ones that contributed the most. They've provided the most open-source phone out there at the lowest price out there. The only other equivalent option is the Librem 5 at $800, double the price.
They didn't contribute much/any software, but they contributed the most accessible, viable hardware to make an open source linux phone.
I haven't tried Whatsapp or Signal. The problem I've had with Uber is feeding it GPS coordinates. Talking about Waydroid, for some reason, while I can get Google Maps to see my coordinates, Uber seems to try to get the coordinates some different way. IIRC, you can still use it, you just need to be more explicit about where you want it to pick you up.
what you're really paying for is a difference in manufacturing; the spec bump is just to make the very high price hurt less. $2k instead of $800.
they designed an elaborate process which theoretically guarantees that your phone was not tampered with at the factory or in transport. it was sort of a reaction to Bloomberg's "The Big Hack" article, which claimed Apple devices were compromised en masse at the factory in China by state actors (and the story was later retracted due to lack of evidence).
i do think it's a cool effort, even if the threat is only hypothetical. but it's a lot to pay unless you're operating under an extreme threat model.
"No one was working on it for year" is both untrue and unfair. There have been continued improvements (both PinePhone and PinePhone Pro), and I know that there are people who have put in the midnight oil to make them happen.
What that work was not is 'paid for by PINE64'. It's also not been enough to raise the bar enough to make the phone work well enough; but if you consider what's involved there, it makes sense.
You don't just need to write/fix a driver, you need upstream (or at least a distribution) to accept it and include it for that work to make a meaningful difference for anyone else.
> It wasn't "discontinued," no one was working on it for years, and it was pointless to purchase.
If it was being made and sold and now it's not, then it was discontinued. You may point out reasons why it was discontinued, but that is in fact what happened.
This is a bummer. If there was ever a time this sort of device was needed, it's now / in the near future when Google (probably) starts requiring all Android apps to be signed by approved developers and further locks down the Android platform.
I kind of regret not buying one of these instead of a Pixel 7 but, unfortunately, I'm pretty tethered to the Android ecosystem at the moment.
I'm monitoring support for PostmarketOS on Fairphone models, with a mainline Linux kernel. They actually have someone working on upstreaming stuff to mainline, which is quite nice.
The FP6 doesn't seem there yet [1], but the FP5 is close! [2]
The FP5 is a comfortable device. With call support completely figured out, Mobile Linux would probably be enjoyable on it.
[1] https://wiki.postmarketos.org/wiki/Fairphone_(Gen._6)_(fairp...
[2] https://wiki.postmarketos.org/wiki/Fairphone_5_(fairphone-fp...
The situation with RCS means Google and Apple have a complete douopoly on the texting market.
SMS will outlive us all.
The problem is SMS sucks major ass and it's, by far, the least secure channel for... well just about anything, but especially for private, personal conversations.
Nothing stops you from encrypting the message you send over SMS.
Nothing stops me from running 150 miles too. That's just hard and I don't want to do it.
You say that, but they're discontinuing it because they didn't sell enough of them. It may be the device we need, but it's not the device we're buying.
I never had a PinePhone Pro but I did buy an earlier model and the user experience was very far off what we have come to expect from modern phones. I'm sure the Pro was better but still probably not that close to an Android or Apple phone. That's not a sleight on the company at all, they faced some very high barriers and I respect what they did. But I don't think this is entirely on consumers for not putting their money where their mouth is. It's just yet another example that it's really hard to create something (in the phone space, at least) that is affordable, open and highly functional.
The product was never really attractive by itself. You had to be extremely patient and willing to overlook the serious problems with their software to even try to use it.
I would like to see some other company take a real swing at this product space but with a less strict approach around the hardcore open-everything ideals. They’re good in theory, but in practice people want a phone that works and you have to get to that stage first.
> I would like to see some other company take a real swing at this product space but with a less strict approach around the hardcore open-everything ideals
That... kind of was what happened. Purism released the Librem 5, and people were shocked they pushed so hard to get the FSF's "Respects Your Freedom" certification.
The Pinephone (and Pro) used a less Free modem, resulting in much lower power draw, but the UX was still, well... Alpha-quality is putting it gently
It's that "we" are too small a market. And I'm not convinced that most of us actually buy these niche devices, even though we say we will.
nah it's that the work delta is too great.
So if you come out with a typical android phone, you have to do X amount of work yourself and some Y amount you can just buy.
If you are doing something like a PinePhone, there's a multiplier on the X of work you have to do yourself ... a significant multiplier and that's the problem.
That's why if you have a something like a Pine phone that has the sales of say something like this: https://www.bluproducts.com/android-phones/ you're going to bleed money - you won't survive - it's too much of a lift.
That's also why almost all phones (that are financially viable) look and feel almost the same.
I'll buy them once I can access all of my banks on it, that is literally the only thing holding me to IOS or Anroid at the minute
NB: Attestation has no security value here because if the phone isn't compromised then the owner having root isn't a security problem and if the phone is compromised then the user is entering their bank login into a fake scam app that doesn't require attestation regardless of what the real one does.
But because the banks that require this are cargo culting some nonsense, they require iOS or Google Android but don't really care how old the phone is. Which means you can transfer your cellular plan to the phone you actually want to use and then just keep your existing phone indefinitely to run the bank app over WiFi or tethering.
What is protecting against another app on a PinePhone from stealing your bank's authentication token?
There are two possible scenarios here.
The first is that your phone is not compromised. In this case there is no other app trying to steal your bank's authentication token. This is true regardless of which OS you use or whether you have magisk installed or what other code you put on your phone that isn't trying to steal your bank's authentication token.
The second is that your phone is compromised. Then what prevents the device from capturing your bank credentials is the same as if you use a compromised phone running Google Android: Nothing. If you enter your bank credentials into a compromised phone, the attacker gets them. Attestation can't prevent this because the phone is compromised, so the login screen isn't from a bank app that requires attestation, it's from a scam app which is exfiltrating your credentials.
>Nothing
This is far from the truth assuming by compromised you mean that the user has installed a malicous app. Android has proper sandboxing which means that other apps can't read the token owned by the bank app. This is part of the Android security model and attestation is evidence that the Android security model is being enforced. Phishing apps are different from an app that steals existing authentication tokens on the device.
> Android has proper sandboxing which means that other apps can't read the token owned by the bank app.
Let's consider this alternative as well:
Scenario 1: Device has no malicious code at all; same as scenario 1 before.
Scenario 2: Device has a malicious app but the malicious app doesn't have root and the OS (regardless of whether it's Android or something else) enforces proper sandboxing. The malicious app can't extract the bank authentication token regardless of attestation.
Scenario 3: Device is fully compromised; malicious code has root. Same as before, if you enter your credentials into this device the attacker gets them.
The problem is that the only useful thing for attestation to do is to distinguish between 1 or 2 vs. 3, but that's the thing it can't do because if the malicious code is privileged it can replace the bank app with one that exfiltrates the credentials without requiring attestation, so the only cases where attestation is happening are the ones where it isn't needed.
If the device is fully compromised then it can just take the authentication token. It's already game over.
That's the point. The device being compromised to the point that malicious code is actually meddling with the bank app is the only time that having it fail attestation would be useful. The other cases are useless/vexing false positives. But attestation doesn't happen in the one case it would be useful because then the attacker-controlled code won't even attempt to do it, it will just exfiltrate the user's credentials to the attacker.
You aren't responding to the scenario that was posed. You're assuming an isolated compromised app on an otherwise clean device. GP is assuming a compromised device.
Of course attestation does nothing to improve the "single compromised app" case since (assuming Android) that goes nowhere either way. The only thing attestation does is meddle in end user affairs.
>if the phone isn't compromised then the owner having root isn't a security problem
The scenario is the phone isn't compromised. Having root means you, or an app you run can bypass the security protecting the authentication token.
And now you're being intentionally difficult. Please interpret things in the most plausible manner. Beyond common decency, it's part of the site guidelines.
By "not compromised" GP clearly meant a scenario where no malicious apps are present.
I agree that's a serious omission. I responded to your scenario (a nonzero number of malicious apps) in my earlier comment. Any Android device will defend against that regardless of the presence of attestation.
Any non-android device can still use online banking and thus attestation doesn't appear to accomplish anything legitimate. Building out proper support for hardware tokens would provide superior security in approximately all cases.
The specific "root on android" scenario isn't generally a concern. Typical implementations require explicitly granting the capability to a given app. A malicious app can't gain it without fooling the user, at which point it could more easily phish the credentials and possibly even proxy an entire session.
>Please interpret things in the most plausible manner.
Your suggestion is not plausible as every security feature has 0 security value if there is nothing malicous. It would be like someone saying that antivirus is useless because if someone doesn't have a virus then it doesn't do anything.
>Any Android device will defend against that regardless of the presence of attestation.
Rooted android devices can be set up in a way that malicous apps can gain root and then read it.
>Any non-android device can still use online banking
But this comes with a different risk profile. A bank can reduce risk for a subset of their customers.
>Building out proper support for hardware tokens would provide superior security in approximately all cases.
I think usually the hardware token gains you access to an authentication token. You don't sign every request you are making with a hardware only key.
>Typical implementations require explicitly granting the capability to a given app.
And the majority of users have no clue what an app is able to do. If root is given to it then it can do anything. This is in contrast to when root isn't available and users are protected by the sandbox the app is in.
Yes, a user could intentionally do something stupid. A user could also voluntarily wire the majority of his balance to a foreign account. That fact has no bearing on a discussion about the security impacts of attestation.
From a technical perspective device attestation doesn't add anything here. The typical user doesn't receive any additional protection. All of its supposed "benefits" ultimately stem from the restriction of end user choice but those same end users _already_ have a practically limitless selection of stupid choices available to them. And these are generally very deliberate choices that we're talking about here. Not subtle confusion.
> the majority of users have no clue what an app is able to do. If root is given to it then it can do anything.
If a user is stupid enough to seek out root, ignore all warnings, install a malicious app, and explicitly grant it root, then he was fated to fall for a much simpler scam regardless. Such as granting a malicious app admin on his laptop and then logging into online banking. Or installing a phishing app that proxies the session to the bank.
Typical users don't seek out root, don't install custom ROMs, and don't consent to the warning message about installing APKs from unknown sources. Grandma isn't ricing her mobile phone.
Support for hardware tokens or TOTP would address widespread real world attacks. Shutting down various customer service social engineering account reset tactics would also help, but that would actually cost money. In contrast attestation doesn't accomplish anything other than infringing end user choice. It's a highly unethical waste of resources.
> It would be like someone saying that antivirus is useless because if someone doesn't have a virus then it doesn't do anything.
Suppose you have an "antivirus" program that works like this: The system makes a list of every program that runs as root during boot and then at the end of boot the antivirus program checks the list for unexpected programs and if it finds any it displays an error and refuses to display the login prompt to prevent the user from typing their password into a compromised device.
That "antivirus" system is useless, because if a malicious program did run as root during boot then it could just reconfigure the system to display the login prompt unconditionally.
The way attestation is nominally supposed to work is that a remote system cryptographically verifies the state of the local machine before giving it some secret. But that doesn't work in this case because the secret -- the thing that allows the user to sign in -- is coming from the local user rather than a remote machine. The attacker doesn't need to perform attestation or retrieve anything from a remote machine in order to display a local login prompt and collect the user's credentials, and that's the end of the game.
> Rooted android devices can be set up in a way that malicous apps can gain root and then read it.
So can PCs, or various non-rooted android devices that bank apps run on even though they have known unpatched vulnerabilities.
> But this comes with a different risk profile. A bank can reduce risk for a subset of their customers.
How is it reducing risk for anyone? Each person still has the same risk profile as before. The person with a locked Android device still has a locked Android device, the person with an unlocked Android device is now forced to use a PC which is an inconvenience with no security advantage.
Just because an antivirus isn't perfect that doesn't mean it's useless.
A bank may not want to put in the extra effort of supporting 3 platforms of secure phones, insecure phones, and insecure web and would prefer to support less and potentially dropping features from the web platform.
What's protecting me when I do online banking in the browser, which I can do using more or less any device? The answer is that targeted attacks against the average middle to lower class individual are rare enough that there are far more worthwhile things to worry about. Such as the vast majority of banks (at least in the US) not supporting hardware tokens.
> What's protecting me when I do online banking in the browser, which I can do using more or less any device?
IDK about your country, but it's also common for banks to require supplying a token from the phone's banking app in order to login via the browser.
Not in the US, at least so far. If that were ever to come to pass I would be in danger of becoming unbanked. I flatly refuse to install third party proprietary software on my phone (I grudgingly accept firmware blobs for lack of a realistic alternative).
Here the majority continue to use SMS based 2FA rather than supporting TOTP or hardware tokens.
Note that TOTP can be handled by any app of the user's choosing, doesn't facilitate attestation or any other user hostile practices, and in practice means that an attack requires physical theft of the device. While the theory might differ, in practice the effective security level is equivalent to other (objectionable) schemes.
> Note that TOTP can be handled by any app of the user's choosing
The banks are probably using the same standard behind the scenes, but they don't allow alternate TOTP apps. There's no point where they give you a key to set it up in an alternate app.
I suppose part of the point is a lack of trust in users' ability to handle their own security, and the possibility that they may provide such a key to a compromised TOTP app.
> hardware tokens
It'd be excellent if banks moved back to purpose-specific hardware like that. Even better if it were some standard with multiple providers, like FIDO2.
Yes FIDO2 would be ideal. The stuff about TOTP was a digression regarding the relative security levels between the two. The extra hardware doesn't provide any practical benefit (at least IMO) for the typical person running a FOSS authenticator app on a mobile device with an up-to-date OS. Obviously if you're something like a high volume day trader then it might be a different story but the venerable $5 wrench attack still applies so even then it seems pretty questionable to me.
> The extra hardware doesn't provide any practical benefit (at least IMO) for the typical person running a FOSS authenticator app on a mobile device with an up-to-date OS.
For the user (and in the context of Pinephones), the benefit would lie in getting banks out of their phones. Banks want a device that's not under the control of the user to use as 2FA. A dedicated hardware key would be a compromise for that. They used to give them out, but I pessimistically imagine that today they might prefer to lose a customer.
And what does that buy you? The user goes to the bank website in a compromised browser, attacker gets their password. Bank sends a code to their phone, user types the code into the compromised browser, attacker gets the code.
>What's protecting me when I do online banking in the browser
Modern operating systems will protect the cookies from being stolen from other applications on the system.
Then tell your banks they have to support the PinePhone or they'll lose you as a customer. The PinePhone folks don't have access to the source code of whatever interface your banks provide on Android/iOS, so they can't do anything about it.
I bought one as soon as they were released, as well as the keyboard case. It never really worked correctly, but I loved the concept and wish they would have succeeded.
I know it's a niche product, but I'd love a pocket sized Debian device with cellular, decent standby time, and a physical keyboard. Anything out there I should look in to? I've tried to make various GPD devices work, but they are too big, and the standby time isn't great.
Way back when I had a Nokia N900 [0].
I still miss it. Wonderful little phone, physical keyboard, Linux, perfect (almost).
[0] https://en.m.wikipedia.org/wiki/Nokia_N900
One of my favorite phones. Despite a bizarre hiccup preventing sd cards from being recognized if the camera lens sensor broke.
I think that finding an aftermarket keyboard solution for a smartphone using the android virtualization framework to run a debian VM (i.e. the "Linux Terminal" on Android 16) is your best bet by far.
The economies of scale (and compactness!) in mainstream smartphones are very hard to match, and they tend to have superior power management.
Do heavy lifting by logging into a remote server for best battery life and compute power.
> I know it's a niche product, but I'd love a pocket sized Debian device with cellular, decent standby time, and a physical keyboard
yes they're called netbooks and x86 tablets but you may need a time machine back to 2015 to get one.
You don't have to go to 2015
GPD has a bunch, they are not exactly cheap though https://gpd.hk/product
Those aren’t netbooks. They’re another class of device which I’ve forgotten the name of. Something like umpc or something.
But the idea was netbooks were the bottom end of the market and this other class were the same form factor but at the top end of the market.
Some of them are UMPCs, some are sub-notebooks and some arguably are maybe netbooks. The GPD Micro PC 2 is not that fast and only has a 7" screen like the original Asus EEE PC. It's got less bezel, so perhaps it bleeds the line between netbook and UMPC but inflation adjusted it's pretty comparable in price.
ahhh fair enough then. I did admittedly only have a quick look at their site.
The NetBook market was such a good one. It really is a pity the Microsoft killed off the spirit of it, and then Apple convinced everyone that pretty and expensive things without keyboards are nicer than cheap and practical things.
I do miss EeePCs. The death of the netbook was probably the biggest blow for desktop Linux becoming mainstream.
Were they? I think that for work or hobbies laptop is better, has better screen and keyboard and they are not that expensive now. And for watching short videos you can just use a phone.
GPDs used to be much cheaper[1], and IMO made much more sense that way. Unfortunately, GPD indeed seems to have caught the expensive bug.
[1] https://blog.danieljanus.pl/2022/08/18/i-love-my-gpd-micro-p...
The GPD Micro PC 2 is still pretty cheap. The other models are way way faster so it's not surprising they cost more.
Pretty cheap by some definitions, yes, but as best as I can tell (historical prices aren’t exactly readily available), the Micro PC 2 ($700 list price before tax) is still between 1.5× and 2× the price of the original (€300—presumably including about 20% tax—per the linked article, between $200 and $500 per the Wayback Machine, in nominal dollars before 10% inflation).
You can get it for $513.
https://gpdstore.net/laptops/gpd-micropc-2/
GPD makes decent small devices, that can be equipped with cellular, and work fine with Debian. So no need for a time-travel here. :)
Aliexpress still has those.
There's https://furilabs.com/shop/flx1/, but there don't seem to be many people playing with these. Perhaps someone on HN would be willing to share their experience.
I'm fighting myself on the Jolla C2 at the moment. I'm kinda in the same category as you I guess :D
not sure about standby time, but MNT Pocket Reform is a neat and unusual device in that category.
The FuriPhone looks pretty good: https://furilabs.com/ though I haven't seen many reviews yet. But am keeping my eyes peeled.
Pine has an attention problem, they produce a lot of different things but the ones that people really wanted like the PinePhone Pro just were never there, with they'd have just doubled down on something and made that REALLY good first.
I preordered the Pinebook, it was never really awesome but it was neat, I accidentally broke the screen and was never able to get a replacement (at least from the store - they were always sold out.) Turned into ewaste.
PinePhone Pro wasn't too good either, I really tried but had lots of flaky issues with basic phone functionality, eventually gave it away to a friend. It's collecting dust for sure and will eventually be more ewaste.
Pine’s approach has always felt like they wanted to make the hardware and then hope that the community would sort out of the software for it.
There isn’t a lot of motivation for the community to sort out the software for them when the products aren’t attractive enough to build a community around.
I wish they would narrow their focus, shift some resources into software development, and produce at least one very good product. As it stands, the Pine brand has become associated with buyer beware.
To be fair to them, they at least tell you that software support is largely community provided. However, you probably won't know how that is in practice until you experience it once or twice.
As someone who doesn't run Linux on any of my Pine64 systems, that suits me fine.
What do you run?
I really like the phone/desktop convergence concept. Mostly I think because I want the freedom / open experience of my desktop on my phone though, I think.
But I think most folks interested enough in the concept are also rich enough to afford a phone and a laptop, and if you want a keyboard for your phone you might as well just use a laptop.
I still think conceptually it's the right direction for tech that our devices should be so flexible, but it's hard enough in practice that it's not generally done.
I feel the same way, but while there are definitely actual hardware limitations preventing phones from being identical to computers, the problem is mostly a choice. Why aren’t ipads with keyboard cases able to be used exactly like laptops, for example? I think companies seized on the combined accessibility and restrictiveness of smartphones to justify design choices which are more about profit. Restricting the app library makes apple a great amount of money. Ads are hard to block across a mobile device, why else if not for more money? I think the circumstances of smartphone development gave them the opportunity to make these choices and we’ve gotten locked in since.
> Why aren’t ipads with keyboard cases able to be used exactly like laptops
Small screen - cannot fit many controls or code. Small keys - cannot type fast. No touchpad - cannot do precise clicks, therefore cannot have many controls on the screen. Try imagining something like editing lots of small notes in a music editor with your fingers...
I can hit 40-60 WPM on a BlackBerry keyboard, but a chicklet keyboard is too much for honest-to-god software developers?
The small screen is equally ludicrous. The desktops of a few decades ago had lower resolution on physically smaller displays, and I consider a large, crisp display a must-have for longer sessions - not a hard requirement for smaller, quicker tasks
Not having a trackpad is one reason the iPad supports USB mice too, and giving some users a trackpad would result in the same complaint: "This is terrible, can I use a real mouse please?". More to the point, parent is complaining about keyboard cases with trackpads, which are mediocre in part precisely because Apple has constructed a software ecosystem that is hostile to powerful, desktop-style programs
I think the convergence concept still makes sense in big corporations where most of your work happens on a VM in the cloud, while you just use your device as a thin client. Especially in places they don't even let you use a thirdparty browser >.>.
Earlier this year, I was actually tried to replace my bulky 16" MBP with a Pixel 9 for work. Android's desktop mode just wasn't there.. Maybe I will try it again next year...
All I really need was a browser and a drop down terminal anyway.
There are at least dozens of us doing this. My $5k bloated corporate laptop sits in my office 24/7. The 25% of time I’m traveling is with a $300 Chromebook with Linux Mini, a Bluetooth mouse, and logged into to a Windows VM.
Now that everything corporate is forced into the cloud, using a VM doesn’t carry all the extra downsides it used to.
and the bonus is that, when the workday is done, I have a machine I actually own and can use without breaking policy.
> But I think most folks interested enough in the concept are also rich enough to afford a phone and a laptop, and if you want a keyboard for your phone you might as well just use a laptop.
Laptops are bulky; phone and keyboard can fit in one's pocket. I also dislike the idea of carrying around a device that's not under my control. It's not about wanting my phone to behave like a laptop because I can't afford a laptop. It's about getting to have control over my phone the same way I have control over the laptop.
For example, when I try to screenshot and the OS says I'm not allowed to by the app, on my own device, I die a little inside. The very idea that an OS would obey an app over the user is really messed up. It's really wrong. It's like a guest saying their guest sets the rules in your own house.
Also the weird, arbitrary limitations. On Android you can split screen and show 2 apps vertically at limited, specific heights. On the Pinephone with i3/sway, you can divide the screen with as many windows as you want, in whatever orientations you want, with as many workspaces as you want. You can set the scaling to whatever you want, have interfaces be as big or small as you want. Limits aren't arbitrary.
> I still think conceptually it's the right direction for tech that our devices should be so flexible, but it's hard enough in practice that it's not generally done.
The difficulty isn't in getting desktop stuff to work on the phone. The difficulty is getting phone stuff to work on the phone.
Don't most Samsung phones and tablets already do this? Dex or something?
yeah, but Dex lets you use your android apps with desktop ergonomics. PinePhone and Librem let you use your desktop apps with mobile ergonomics.
It's not most phones, just the high end ones, Galaxy S series, Galaxy Z Fold Series, Tab S series and the A90 phone.
Huawei as well. Used to have a P30 Pro. It felt like a true downgrade when I bought a Pixel 8 Pro two years ago and it had no desktop mode and a worse camera to boot.
Tbf huawei got heavy subsidies and just wanted marker share, google actually tried to make a profit.
I always read here that China gives subsidies to everyone, they must be rich to afford it.
Android 16 (coming to Pixel 8 series if it's not there already) supports this.
if it is only the keyboard you want, A small foldable keyboard is less bulky than the laptop. I am talking about just a keyboard and a trackpad.
https://www.newegg.com/p/0GA-03F8-00011
the problem with keyboards like this and the ones on the surface is that they have no connective hinge and rigidity. with my UMPC at least, I like to hold it by the base while looking at the screen. I really wish there would be a clampable keyboard that used nice membranes like the GPD but had a phone clamp on top like a selfie stick and a single swivel-hinge like those fujitsu convertibles
PinePhone Pro's main drawback was the low-res display for a price of a midrange Android with far superior specs. I was thinking about buying one but it was barely better than the regular PinePhone.
https://puri.sm/posts/the-danger-of-focusing-on-specs/
It costs 600 euros in europe (plus shipping?) I don't know why they expected that it would have sold more. Even the "200 dollars" PinePhone is 350 in euros.
It was on my list of devices that would have been fun to hack on, but not at that price.
Those price are from the (non-official?) european reseller.
You can still get the pinephone at the original price from the original store
https://pine64.com/product-category/smartphones/
The situation with phones is pretty bad now. The phones that have or support open-source ROM (Pinephones, Pixels etc), are usually expensive and cost like 2-3 normal phones. So it might be cheaper just to buy a non-free phone and keep it in airplane mode (and connect it only to a airgapped home WiFi network to transfer data), and a second dumb phone for calling. Or have one phone with your data, connecting to Internet via second $50 phone, which has connectivity, but no data, and DPIs all requests from first phone, basically serving as a portable router.
And proprietary phones are really bad, today I read the news that Samsung promised to comply with law and auto-install Russian software (like Vk, Kaspersky, Rustore) when the phone is connected to the Internet. And that's a Korean company. Consumers are treated like garbage today.
It's understandable that you earn more on expensive phones, and freedom is not free, but I don't want to buy a phone that costs like 2 cheaper phones + a guitar.
I would prefer simply having something like GrapheneOS with root access.
Pinephone pro... The phone was not specced well enough and had issue. Hoping the FLX1 isn't vaporware.
Good riddance.
That pile of garbage had crazy critical hardware faults they never fixed.
1. If the battery is discharged, then in order to recharge it, you have to take out the microsd and sim cards, press an SMT button, and plug in with battery.
2. If you bought the keyboard/battery, and you plug in USB on the phone, you fry the keyboard/battery. Shit burns up, haha screw you.
And if you say anything, you the user are at fault. You didn't read, or follow their discord, or whatever, because it is 'Your Fault' ™.
Pine's primary game here has been to paracitize off of FLOSS folks, pump out incompetent and/or broken hardware, and summarily blame FLOSS for their not-working. At minimum, they should be funding the projects they want to build on/paracitize. But they do none of the sort.
We would be better if Pine died as a company. Then they wouldn't be sucking the oxygen out of the FLOSS arena, and might get more respectable orgs here.
I do not understand why so many companies have that charging issue with Linux devices.
Anbernic has the same issue with the RG35XX series. If the battery reaches 0, you may need to pull it out just to get the charging to work. And if you accidentally connect the wrong kind of usb-c charger, it won't charge, so you may have it plugged into the wall for days and come back to it being dead and needing battery surgery.
Great devices for hacking because they are cheap though — cannot understand why an expensive phone would have that problem too.
Anbernic cheaped out when trying to support USB host mode, as a result the device will not work correctly with an electronically marked cable. You can fix this - but you lose host mode - https://www.wirehead.be/2024/10/21/anbernic-rg35xx-h-charge-... . The article is for the RG35XXH, but pretty much all the XX devices have the same flaw.
This is awesome info and I couldn't find it ANYWHERE I looked, thank you so much!
Some of pre-HSDPA Nokia phones had the same issue. You needed a clip-on raw cell charger to revive them. It's manufacturer skill as well as a bit of cost issue.
> Great devices for hacking because they are cheap though — cannot understand why an expensive phone would have that problem too.
Because the more I read about Pinephone, the more it seems like a grift.
I also had run ins with their Pine A64 LTS.
You can buy eMMC cards that fit on the board. Their documents say you can boot from them. Like 10x performance of a mSD card and less wear-out.
I use a USB device to make the drive mountable from a Linux box, and copy the firmware as prescribed. I then unmount and load in the A64, and.... NOTHING.
Supposedly there's a uboot command that maybe enables it. Or maybe its autodetect. Or maybe (5 other ideas, that all fail).
I returned that shit too because they make claims that it works these official ways, and it never does.
Pine is a parasite. Always has been, but they make-pretend that they're some great FLOSS company.
> Good riddance.
Yes, we should be happy to have less options.../s
some options act like decoys - they take the pressure off and a proper alternative cannot arise.
Thank you. That was exactly my point - they camped in a niche they had no intent to do properly.
Worse yet, they screamed at users to lean on the community (read: unpaid FLOSS as support). They refused to provide even baseband images to do the things they were selling, like Pinephone Pro as as, you know, a phone.
At one point, I thought they were just an upstart trying to get off the ground. But in reality, its a complete grift that ends up taking community resources and nothing to show for it.
I have their pinenote - as far as I can tell, the community has done a great job on the Linux image, but I ended up sticking with the android fw as I can't be bothered to reflash the Linux partition now in case I brick it.
I think it can be done this way, with the manufacturer taking care of hardware and the community taking care of software - but they should at least fund one or two people and some projects directly to make it work.
the pinenote is a great little ereader with the android fw.
Last time I bothered with news from Pine was with that Manjaro and bootloader drama. I am not even sure what came out of that...
But the other issue is I just found out from this post that PineBook Pro has been discontinued. But it is well listed in their devices, a shop exists just fine, with a price tag, it is just out of stock. Forever, apparently. I thought they were just being stingy with their production sizes, or they just didn't have enough traffic to make more.
Oh well, you can install postmarketOS on Chromebooks with ARM processors, and "normal" Linux is going well on other ARM devices, too. You can also find RISC-V laptops on Alibaba.
>> On the other hand, the PinePhone (A64) will continue to be sold for around two years. It is currently still selling well.
Interesting! Well, there's a hint at your market.
Enough stock on the shelves for an expected 2 years of slow sales.
Kind of sad, I had both PP and PPP
When they were "new" the tech was old already and then the lack of drivers for the camera for example which I can't talk, I'm not a driver developer. I thought it would make me get into developing drivers but I never did.
Or writing Qt/C++ apps vs. cross platform/web that I was used to.
For some reason I was obsessed with the thought of Dex/your phone being a computer if connected to a big monitor, it was cool using VS Code on the PPP but there would be problems. The external monitor I think was capped to 1920x1080 (if connected to a 1440P display a huge chunk was just static)
I had my fun with it
I was interested in the Pine 64 eInk tablet but that seemed to not be in stock at the time. I had the Remarkable 2 at one point, I want to get it again.
edit: looks like the PineNote is in stock right now
my consumer brain is getting tickled, might get a PineNote, what I liked about the RM2 is I didn't have to charge it for like a month was crazy, unfortunately PineNote doesn't seem to have that, and no tilt support on pen but ehhh. I don't know if RM forces you to have a subscription now, I didn't have it on mine when I got it in like 2022.
Yeah for these kinds of things to work the hardware has to be at least somewhat competitive and the overall device reasonably usable. It doesn’t need to be a flagship or anything, just relatively recent, and the experience doesn’t have to be perfect, just actually suitable as a daily driver. That’s what gets people interested, inspires devs to contribute and fill app gaps. This kicks off a virtuous cycle where less technical family of those devs see the device and want to try it, which in turn creates more demand for apps pulling more dev interest and so on and so forth.
It’s critical to be good enough to clear that initial hurdle, though. Without that, the device is relegated to the most curious of tinkerers which just isn’t sustainable.
As far as dev experience goes, from my limited dabbling I think GTK+Adwaita might actually be overall nicer for mobile development than Qt, due to furnishment of a full set of widgets without having to pull in anything else, as well as bindings to way more languages. It’s considerably more comparable to UIKit and Android Framework at the very least.
>> That’s what gets people interested, inspires devs to contribute and fill app gaps.
Alas, no, sorry. It's really not the number of apps that matters. Any phone OS could have less than 500 apps and be wildly successful. On the other hand you can have a million devs cranking out apps and the device would still be useless.
Turns out the only apps that matters are the ones everyone actually use. Your banking app. Facebook. Whatsapp. Uber. Airbnb. Etc. All the product of big corporates.
And my bank (to pick just 1) is simply not interested in developing their app for yet another platform. The effort in building it, supporting it etc simply makes no sense.
Facebook, Netflix, Twitter, ESPN, and the next 40 "must haves" simply don't care. And independent devs simply cannot fill these holes. Without these the phone is simply useless as a daily driver for anything other than complete techno fanatics.
Crumbs Microsoft couldn't convince this cohort to get on board. Some random Linux phone certainly won't.
I don't say this with glee. They're nice toys. But Joe public doesn't reject them because of the hardware specs. He rejects them because they're functionally useless in the actual world.
I think this is wildly more individual-dependent than you may think. Speaking personally, while I do have a number of big commercial apps installed, the number that couldn’t be filled either with a web app or the Android version via a compatibility layer is tiny. The native apps I find most difficult to replace are those by small to midsize devs, which are exactly the ones most likely to be the primary contributors to a new platform early on.
I don’t think this is particularly unusual, either. Plenty of people have absoutely no need for video streaming on their phone outside of maybe YouTube for example, which works well enough on the web.
Microsoft’s not the best example here, because they had momentum with both devs and users but shot themselves in the foot repeatedly on both sides of the fence: warring internal factions reset Windows Mobile development multiple times consecutively and burned through dev goodwill and poor strategy on the consumer side killed things there. Mozilla’s foray into phones failed because they insisted on sticking to entry level devices which were both not interesting to most of the market and not powerful enough to handle a new unoptimized OS.
> Mozilla’s foray into phones failed because they insisted on sticking to entry level devices which were both not interesting to most of the market and not powerful enough to handle a new unoptimized OS.
I think that was not a bad idea. Other open source OSes target expensive devices like Pixel and as a result many people are not buying them because paying a premium for a non-standard phone with buggy software and lacking features doesn't make much sense.
As low as the number who buys a flagship or uses one they already have to run an immature OS may be, it’s still going to be higher than the number who buys a budget device with an immature OS, especially if your goal is to stoke developer enthusiasm.
Think about it.
The everyday Joe who might be interested in a cheap phone is going to be looking for bang for buck, which something untrusted doesn’t get them. For this person something like a budget Android phone from a proven company or a used iPhone is more attractive.
Technical people aren’t going to be interested in a budget phone because they know it’s not going to meet their standards just by looking at its specs, before even considering the OS. They wouldn’t have bought the equivalent Android phone either, and the OS just detracts further.
Lots of people buy flagships, on the other hand. It’s too not unusual for mobile developers in particular to have multiple. An OS that targets them can be put on a phone that these people already have laying around. If the OS is intriguing enough, yes, some will buy a flagship to be able to run it, because it’s low risk. Worst case scenario they have a nice Android device, which is vastly better than buying a low end phone that ends up going unused because the hardware+software combo is intolerable.
Linux phones are an experimental devices for enthusiasts where lot of things are not going to work, so it would be less risk to buy a cheaper phone for experimenting. Doesn't make sense to pay iPhone's price for a phone that barely works.
Even with that logic I think there’s a floor to how cheap/low end/old you can go and still expect significant interest. 2-4 year old midrange equivalent is probably the limit factoring in the performance overhead needed to make unfinished OSes run well enough to have a semblance of usability and not be miserable.
Then why were there so many more distos, matrix channels, and general discussion for the Pinephone, while the Librem 5 is scarecly mentioned?
The hardware for the Librem 5 is difficult to justify for the price. Googling suggests that its SoC is comparable to a circa-2016 Snapdragon with worse power efficiency. At $800 you’re looking at upper-midrange/lower-flagship pricing for a device that many phones half its price or less would run circles around. Similar problem as the PinePhone Pro.
If it were in the ballpark of a 2-3, maybe 4 year old Pixel, it’d make more sense and probably sell better.
For what it's worth, I don't have a single one of the apps GP mentions installed on my phone. No Netflix, no Facebook, no WhatsApp.
I am aware that I am an outlier, though. I need either Anki or AnkiDroid. I need a somewhat decent text reader, preferably one that properly highlights and folds Org mode files. I need a voice recorder that timestamps the file name. I don't think I know anybody else who needs any of those three, other than those I've introduced to Anki.
That is true, you have to have two phones
GTK uses a C emulation of OOP, and the code gets very verbose (and functions have names like "gtk_event_controller_get_current_event_device", so you cannotfit more than one call in a line). I do not recommend to use GTK (or anything from Glib) with C, use bindings for a better language, and you save 2x-3x in code size.
Makes a lot of sense and explains the proliferation of Vala and Rust among other languages in the GTK ecosystem.
> The external monitor I think was capped to 1920x1080 (if connected to a 1440P display a huge chunk was just static)
That happened to me with the PP, but I can reliably use a 1440P monitor with the PPP. Not sure if it's the phone, or the fact that I added a power cord to the phone while it was connected. I can't remember if I did that with the PP.
EDIT: Scratch that. It's because I used the official dock with the PP, and for the PPP I used one I got on Amazon.
The official dock is docked (:P) to 1080P.[1]
I wonder how it happened that the de-facto standard here is for the protocol going over USB-C to be DisplayPort, but for the hardware connection to be HDMI, and so leading to docks needed to be spec'ed to the resolution you want instead of being passive.
[1] https://pine64.com/product/pinephone-pro-usb-c-docking-bar/
The answer is boring and annoying, they almost certainly want it to work with TVs and cheap monitors both of which commonly only have HDMI inputs. It has been my experience that you typically have to pay more for a USB-C dock with displayport outputs, even though they don't have the chip just cause of economies of scale.
To be clear when I say 1440p I mean 3840x1440 which might be obvious
I was using random USB-C to HDMI/usb that I bought on Amazon, I primarily used Mobian
I meant 2560×1440. Checking online, I didn't realize there were so many different 1440p resolutions.
https://en.wikipedia.org/wiki/1440p
Random adapters on Amazon specify 4K though, so I would've thought they'd work for you too.
you might habe an old enough rm account to have free base subscription.
Honestly the company is kind of a nightmare. When I ordered mine, they shipped it with no packaging from Hong Kong. Obviously it arrived broken, and when I told them they said I could pay to have someone fix it in CA. It ended up taking 2 months for my chargeback to go through, and they were threatening me the whole time. It was only after they lost (which of course they would, it's like they've never worked with a credit card processor before) they got really sweet and sent me a return label.
Just a terribly run company. I'm sure it's better if you're buying bulk boards from them but after my experience I wouldn't work with them again.
> When I ordered mine, they shipped it with no packaging from Hong Kong.
As I understand, customs (in your country) will typically check what's being imported, to verify the invoice is true for correct taxation, and also to check that it's something allowed. It might be that your customs authority didn't put it back in its package after inspecting it.
Could be, but this seems to be a common problem with them other people have complained about.
I think the PP still makes for a great educational device. I was following the Lupyuen tutorials for PinePhone nuttx for a while, and then got inspired to have a go at following his revese engineering journey using Zig. It has been slow going but great fun! Just started on volume keys.
They say they continue production on the PP for 2 more years, so hopefully I'll have a bit more than 'Hello, world' by then.
But buy a serial debug cable and SD card extension if you decide to have a play with one, huge time savers! I only just got mine and it has speeded up things no end.
With the Android becoming a privacy nightmare, Pine was like the only hope for some FOSS phones. Their main drawback was the software. Now given the coding LLMs available these days, would generating a set of useful apps for Pine be a major problem? They can be pretty minimalistic but must be 100% reliable for the platform to take off. Right now they are super buggy and basic features work randomly.
I used a Pinephone Pro as a daily carry. It wasn't actually the lack of apps that killed it for me. Fractal, the Gnome Matrix client, was great. Phone calls were functional, Mobile Thunderbird (thanks to PmOS packagers), Mobile Firefox, and Gapless (my preferred music player for mobile) all worked well, and I could actually use native apps for most of my use-cases, like Gnome Password Safe (the Keepass client), Gnome Calendar, etc.
The battery life and performance absolutely murdered it though, and it was worse for the Librem 5. The PPP at least had external chargers for sale, and was made to be compatible with Samsung batteries, so I could, and did, carry 3 on me. The (larger) dev community for the PPP also put out things like Sleepwalk (to periodically wake the modem for notifications), and had more stable, cooler- and longer-running modem software for the PPP.
Somehow, the software for Linux Mobile isn't impossibly far off. Modems are a bitch though. Like, buy Qualcomm stock levels of "This shit is insane, how does any of it work as well as it does".
> and it was worse for the Librem 5
I guess it should be better now: https://forums.puri.sm/t/status-of-suspend-for-librem-5/1391...
Note that this improves reliability for suspending the modem, not power draw while the modem is awake. The Pinephone (and Pro's) modem stil runs circles around the L5's modem for power draw and data reliability, and I say that having used the L5 with the improvements you pointed to.
Really sad about this. I recently bought another Android and was checking out the PinePhone Pro, but only wanted something with a little better specs..
I'm so sad I couldn't get my hands on that Psion-like keyboard for it.
Oh they look really cool : https://pine64.org/documentation/Phone_Accessories/Keyboard/
This is one of those things seems cool but is it (usability)?
My own opinion, I bought a Toshiba Libretto CT50 and the keyboard is really cool but also so small/hard to use.
It's just big enough that it might be barely usable to touch type with sufficient practice, not comfortably though. Definitely seems smaller than the Libretto from glancing at pictures. If the idea is to have a portable keyboard to then sit down somewhere and work, there are pocket BT ones that fold in half and are comfortably big.
The only use-case I can think for the Pinephone keyboard is if for some reason you want a physical keyboard to use while walking.
they discontinued it because of quality control reasons, which tracks with my experience. the key mechanism is weird, a circular membrane around plastic posts, and it makes some of the keys (especially the top row) constantly miss inputs. there's a 3D printed shim 'fix' but that barely helped me. off-center keypresses also bind really badly. the pogo pins that connect to the phone are flaky, which can make it lose connection and require a reboot. like the keys, there's a shim you can use (putting some paper behind the contacts) which only sort of helps.
a benefit of the keyboard case is the battery it has that extends the phone's battery, which is nice, but it's an odd setup too. the charge controller on it was originally designed for a power bank and seems like a bit of a crude solution that's lead to multiple issues, like how you could damage the phone having it plugged into USB while the keyboard case is connected. it's slow to charge too, often it can't even keep up with the phone during use.
When your fingers are too fat and/or your hands are too big for a Libretto, or you have pathological issues troubling the relevant appendages, then do yourself a favor and don't bother.
It's obvious: These keyboards are, or should be, primarily made for mobile people, so high quality and tray or coffee table compatibility are a must. The Psion 5-series keyboards are ideal for this as long as you don't fuck with the formula.
Are Linux phones viable? Eg even the librem 5 seems like not workable as a daily driver.
They were all too slow and buggy in my experience to use; basic functionality like text or camera was consistently broken or buggy, and it took way too long to load.
The speed issue could in the short term be bruteforced with stronger hardware, but as far as I'm aware there’s no Linux phone out there with anything approaching what one might consider “strong” hardware.
It’s a bit puzzling because there’s Chinese companies like Retroid and AYN pumping out Snapdragon 8 Gen 2/3 handheld gaming devices that the community has ported Linux to, with working graphics acceleration and everything. I doubt these companies are using fully bespoke mainboards, because most of their components are borrowed from existing smartphones. Seems like some company could stick one of these Snapdragon boards into a phone chassis and have a reasonably compelling Linux phone.
> It’s a bit puzzling because there’s Chinese companies like Retroid and AYN pumping out Snapdragon 8 Gen 2/3
There is no path from "I made a cellular phone" to "I can place calls" that doesn't involve tens of millions of dollars paid to the gatekeeping cellular carriers.
Without the equivalent of Carterfone for cellular, this will never change.
Librem 5 works fine as my daily driver.
Yes, Android has billions of users and is wildly successful.
Librem 5 was good enough for a few years. Too old to buy now at the price they're still charging however.
Why is it too old? See also: https://puri.sm/posts/the-danger-of-focusing-on-specs/
It’s a decade out of date, and can’t keep up with my EOL iPhone 6s. Charging $700 for that is unacceptable.
I have hope for the furiphone.
Not surprising. These phones were out of date when they debuted and not updated, in like five years?
I played with one for a bit but then mobian trixie updates bricked it twice and I gave up. Only wanted it to be on par with my old iPhone 6s, but it never achieved that.
Star labs makes a great Linux tablet, the starlite, so it is near possible to make a decent floss phone these days.
Oh wow, that Star lab tablet looks great.
For quite a while I used an iPad+NUC, which was perfect and I loved it, except it could only really run terminal programs (via ssh) or iOS programs nicely. VNC kinda works but not well.
Eventually I switched to a folding convertible laptop, but it is a significant downgrade in terms of form-factor. Nice to know that exists, hopefully they’ll stick around until I’m ready to turn this thing into e-waste…
Yes, though haven't used it as a convertible yet. I usually use tablets as my home movie machine since we don't have a proper TV. At this, the Starlite with Phosh and recent Fedora/firmware updates is fantastic. Freetube, Netflix and Kanopy on Firefox via widevine, PBS, and homegrown .mkv's are more than I have time to watch.
On the go a Framework 13 is fantastic, tall screen, light and powerful. Only waiting on coreboot and ECC RAM.
The PinePhone Pro just wasn't a very good product. There was frankly unnecessary drama regarding the bootloader of all things, which was a bad start. The specs were obviously a bad value compared to any mass-produced phone, though it did bring the Linux phone down to a price point where an enthusiast could reasonably buy it, so I can't say it was priced that poorly. But, the big problem was software. Getting the damn device to work reliably was a true pain in the ass. If you could get "deep" sleep to work, then it would last longer than a couple hours on battery, which was nice... But sleep/resume on the device was buggy and slow. Getting a phone call can wake the device, but by the time it actually wakes up you might've already missed the call. And audio routing for calls was shockingly ugly... Most of the time it was routed directly by the hardware, bypassing the Linux audio stack entirely, but it was quite flexible and you could route it into Pipewire/etc. The microphone quality is "it works" tier, though the person on the other end may be occasionally alarmed by a flash bang of noise for unknown reasons. There are two piss-quality cameras that sometimes work for a little bit until they stop working.
I waited a long time and occasionally checked to see if anything had changed, but it was clear that Pine64 had again taken the approach of "build it and they will come" hoping for other people to clean up the mess and make the phone usable. And to be fair, they were up front about this, to some degree, but they built it and nobody really came. The truth is it's just too damn hard for random people to fix all of the software issues on a device like this, especially when it's basically not usable as a daily driver yet. Working on a device like this is a full-time job, and you can't really replace that full-time job with 20 hobbyist weekends stacked in a trenchcoat. I did realize this when I bought one, with full intent to be one of those hobbyists spending weekends on it, but at least to me, it was simply too broken.
So I think the PinePhone experiment is a failure. Then there's the Librem 5, which I presume is at least more stable and usable, but it's at a price that is less easy to stomach.
I think until the software is ready and a market is proven, the best route for Linux phones is going to be by taking Android phone parts and trying to make it run regular Linux, a la libhybris. It may not really work out either, but it does seem like it is a path of significantly less resistance, where the software can be worked on with solid hardware and hopefully solid enough drivers to build on.
There are some folks working on this angle, too. The latest I've seen is the Liberux NEXX, no idea how it's going, not affiliated in any way.
https://liberux.net/
> the best route for Linux phones is going to be by taking Android phone parts and trying to make it run regular Linux
> and hopefully solid enough drivers to build on.
This is the crux of the problem with this approach. That the drivers would remain closed-source. AFAIK, the Pinephones and Librem are the only ones with open-source drivers.
Fully understand the issues with this approach: my skepticism has been expressed in former HN comments. However, the issue is that in practice it already seems like this approach has yielded something closer to daily-driver maturity, which would make it a suitable platform for experimenting with software. It may be necessary since it's hard to justify actually doing all of the effort to build the phones with not much impressive to run on them.
I don't blame them for the prices given how unique the product was, but the company was always kind of a mess. Lots of broken devices and they had/have an outrageously hostile return policy, forcing people to do charge backs. I agree on the build it and they will come philosophy, it felt like they were riding the popularity of linux phones while not contributing a lot to their future.
> it felt like they were riding the popularity of linux phones while not contributing a lot to their future
I think they're the ones that contributed the most. They've provided the most open-source phone out there at the lowest price out there. The only other equivalent option is the Librem 5 at $800, double the price.
They didn't contribute much/any software, but they contributed the most accessible, viable hardware to make an open source linux phone.
Fortunately, Pinephone and Librem 5 still exist and work quite well, despite being relatively slow. Sent from my daily driver Librem 5.
Do you use WhatsApp, signal or Uber from your Librem 5? Is that possible?
I haven't tried Whatsapp or Signal. The problem I've had with Uber is feeding it GPS coordinates. Talking about Waydroid, for some reason, while I can get Google Maps to see my coordinates, Uber seems to try to get the coordinates some different way. IIRC, you can still use it, you just need to be more explicit about where you want it to pick you up.
I don't use them, but some people do. You can use Waydroid to run Android apps. Also, concerning Signal:
https://forums.puri.sm/t/building-and-running-signal-desktop...
https://github.com/signalapp/Signal-Desktop/issues/3410
Concerning Whatsapp:
https://forums.puri.sm/t/how-to-install-whatsapp-and-discord...
Ah you’re a legend thank you. That’s great to know.
See if I’m able to use Waydroid to run signal/WhatsApp and Uber then that’s all I need.
Much appreciated!
Anyone have thoughts on Purism’s Liberty Phone? Looks like it’s an upgraded Librem 5 of sorts.
what you're really paying for is a difference in manufacturing; the spec bump is just to make the very high price hurt less. $2k instead of $800.
they designed an elaborate process which theoretically guarantees that your phone was not tampered with at the factory or in transport. it was sort of a reaction to Bloomberg's "The Big Hack" article, which claimed Apple devices were compromised en masse at the factory in China by state actors (and the story was later retracted due to lack of evidence).
i do think it's a cool effort, even if the threat is only hypothetical. but it's a lot to pay unless you're operating under an extreme threat model.
I had the original Pine Phone and it never worked well and was too limited/slow five years ago.
You should have tried to run SXMo on it.
I looked into buying one a while back, and the spec sheet said it was using a 9 year old processor, and PinePhone uses a 13 year old processor.
It wasn't "discontinued," no one was working on it for years, and it was pointless to purchase.
The PinePhone is an outdated ripoff.
"No one was working on it for year" is both untrue and unfair. There have been continued improvements (both PinePhone and PinePhone Pro), and I know that there are people who have put in the midnight oil to make them happen.
What that work was not is 'paid for by PINE64'. It's also not been enough to raise the bar enough to make the phone work well enough; but if you consider what's involved there, it makes sense.
You don't just need to write/fix a driver, you need upstream (or at least a distribution) to accept it and include it for that work to make a meaningful difference for anyone else.
> It wasn't "discontinued," no one was working on it for years, and it was pointless to purchase.
If it was being made and sold and now it's not, then it was discontinued. You may point out reasons why it was discontinued, but that is in fact what happened.