[CountSessine]

I wouldn't try to minimize this issue - it's terrible that the Chinese are trying to fit spyware into unbranded phones like this. Perhaps the bright side here is that when the Chinese do try to commit electronic espionage, they're pretty clumsy about it.

BUT...

Given the way smartphones everywhere are made - China and elsewhere - it's impossible for even technical users to know that their phones aren't spying on them. While most of the software running on your smartphone's application processor is now open-source (if you're in the Android majority), the software running on the baseband processor is 100% closed source and secret. We don't know anything about the horrible agreements that have been made between shady government agencies and the baseband manufacturers like Qualcom.

[gress]

False. The software running on your Android phone's application processor is not open source.

A significant fraction of it is based on a closed source fork of AOSP. The rest (both the Google Mobile Services layer, and the manufacturers customizations) are all closed source and have never been open.

[pwnna]

On top of that, there are baseband firmware which runs a realtime OS, which is completely closed source.

[CountSessine]

Oh heavens. I did say 'most', didn't I?

[gress]

Almost none of it is open source.

[fpgeek]

> False. The software running on your Android phone's application processor is not open source.

You're skipping over an important practical distinction: The precise software running on the application processor may not be open source, but it is closely related to usable software that is. Given that, it's possible to learn quite a bit by comparing the behavior of the closed-source fork and the open-source base.

Is that as good as "open source all the way down"? Of course not. But it is a hell of a lot better than the "opaque binary blobs all the way down" offered by most of the alternatives.

[coldtea]

>Is that as good as "open source all the way down"? Of course not. But it is a hell of a lot better than the "opaque binary blobs all the way down" offered by most of the alternatives.

I fail to see how. It's not like a partial binary blob is better than a full on binary blob. The opaque part might do anything too...

[fpgeek]

Well, consider the example of Carrier IQ.

The Carrier IQ software was installed on some Android phones, some iPhones and some Blackberry devices: http://www.computerworld.com/s/article/print/9222319/AT_T_Sp...

Where was Carrier IQ found first? Why?

[coldtea]

>Where was Carrier IQ found first? Why?

The link doesn't say. And if anything it was not because there was an open-source part of the phone OS.

For one, on active, sold, phones, the device code is compiled anyway.

[gress]

I'm not skipping anything, and at least you are agreeing that shipping Android phones are not using open source software.

I do not dispute that having a related system that is open-source can aid in reverse engineering.

However the source of commercial Android phones is not open source, and does not have the benefits that open source would imply.

[userbinator]

Qualcomm is American, but on the other hand, Chinese/Taiwanese companies like Spreadtrum and Mediatek which make the bulk of the processors in these unbranded phones have no incentive to cooperate with the US government (including the NSA).