[nemothekid]

>No. Devices running a FOSS operating system like the Pinephone are the least worst mobile option, people don't like it because it's not sexy and it's currently very inconvenient

Just because it's FOSS doesn't mean it's secure. If your problem is privacy then sure, the PinePhone is the least worst mobile option. If your problem is security I don't see how a phone that doesn't have hardware embedded key manager is a step up. It's not like the Linux Kernel, and whatever messenger you do decide to use is free from zero-days either.

>But it encourages users to download unaditable closed apps and reassures them that doing so is totally safe despite the fact that most of them are using 3rd party telemetry services run by data brokers.

And for the very same reason your bicycle is safer than a car because it doesn't encourage you to drive 75mph. I agree the world might be a lot better if we "return to monkey" but I don't think anarcho-primitivism is a solution.

[swiley]

>Just because it's FOSS doesn't mean it's secure.

Right, but it does mean you won't be forced to do things the wrong way because it makes Apple money.

>hardware embedded key manager

This means keeping copies of keys unencrypted (or encrypted with a key on the same device which is effectively the same) on the device. You're just a couple exploits away from sharing the keys at that point so many people argue that these make things worse and not better.

>It's not like the Linux Kernel, and whatever messenger you do decide to use is free from zero-days either.

Sure but you can't even guess at which messenger I use. Attacking me means taking expensive professional time and focusing it on one person. As for zero days in the kernel, they seem to appear less often than for iOS but I could be missing some.

>anarcho-primitivism

There's nothing more primitive than flinging binary artifacts around the way you do on closed OSes. The FOSS OS approach where knowledgeable people protect those who aren't knowledgeable (without restricting their rights) is a significantly more advanced social structure.

[nemothekid]

>Right, but it does mean you won't be forced to do things the wrong way because it makes Apple money.

I don't understand this point. What's wrong with downloading binaries from a trusted distributor (Apple)?. If you agree that just because it's FOSS doesn't mean it's secure, then downloading binaries is as "right" as you are going to get when it comes to mobile app distribution. It's no different than downloading binaries from apt.

>This means keeping copies of keys unencrypted (or encrypted with a key on the same device which is effectively the same) on the device.

No. The whole point of the Secure Enclave means the keys never leaves the hardware - they never touch the main memory and the keys can never be read out of the chip. You are never "a few exploits away" from getting the keys because there is no mechanism to read the keys at all. This also prevents attacks on the device itself - you cannot brute force an iPhone without the Secure Enclave locking you out. I'm not certain (and I really doubt) the PinePhone is resistant to physical attacks.

>Sure but you can't even guess at which messenger I use. Attacking me means taking expensive professional time and focusing it on one person.

The article is about journalists who were targeted by a state sponsored cyber security firm. This is a moot point, not to mention security by obscurity doesn't work.

>The FOSS OS approach where knowledgeable people protect those who aren't knowledgeable (without restricting their rights) is a significantly more advanced social structure.

Except that, in practice, this is no different (and arguably worse) than just trusting Apple. It turns out knowledgeable people do not work for free, most other knowledgeable people don't read the code or recompile sources, and FOSS maintainers aren't always properly equipped to ship secured software. Heartbleed is poster child for this.

I'm not saying that it's impossible for there to be secure FOSS code, but that it's incredibly difficult to ship secure code at all in any situation. For the non-technical person it's far easier to trust platform that is hardened from the outset (like the iPhone) that has a well-funded security team (like Apple) and is recommended by other security professionals.