Hacker News new | ask | show | jobs
by fsflover 1902 days ago
> In the event a vulnerability is discovered in the modems or radios, the firmware cannot be updated without physically dismantling the phone.

But wouldn't it make the phone more secure, since no malware can update the firmware without your knowledge? (Although it's just not true as kop316 showed).

> Current releases of the Librem 5 have been plagued by thermal throttling issues and poor battery life which in some cases has clocked in at less than 1 hour at idle.

This was true about a year ago. Current state is 10-12 hours battery life without suspend. No thermal throttling issues anymore. https://source.puri.sm/Librem5/community-wiki/-/wikis/Freque...

> The Librem 5 does not even support software encryption

Yes, it does: https://puri.sm/posts/sneak-peek-of-the-next-pureos-release-....

> The Librem 5 lacks a secure element for any hardware binding on the encryption and so would be entirely dependent on software-only encryption.

Not true, it has a smartcard: https://puri.sm/posts/your-own-personal-enclave-the-smart-ca....

> uses the same security model as the desktop stack

Yes, this may be a problem. However, you do not have to use PureOS. You can install anything you like on this phone.

Concerning the USB isolation, you are probably right. How other phones deal with it? Couldn't you simply avoid connecting it to untrusted hosts?

1 comments

> But wouldn't it make the phone more secure, since no malware can update the firmware without your knowledge?

No not really. Look up the boot ROM vulnerability on the Nintendo Switch. I'm sure Nintendo wishes they could update that.

I am not saying that total lack of updates is more secure. I am saying that special actions required for the update can make it more secure.
Ahh gotcha, that makes sense!

I'm not sure if I agree or not to be honest. I think there's good things (like you said, make sure the user knows they are doing it), but I have never convinced myself it is absolutely superior.

EDIT: One example of why it may not be good. If there is friction to updating, it means less folks will update (or you have to now take special care to make it as easy to update as if the switch was not there).

But like I said, I'm not convinced one way or another. I think there's cases when it is true, but I lean to that being the exception, not the rule.

Chromebooks have this!

Some seriously forward thinking shit.