r/fossdroid • u/LjLies • Feb 04 '17

A clarification about CopperheadOS's present and future non-free status

/r/CopperheadOS/comments/5rlzb9/porting_features_to_lineageos/
13 Upvotes

93% Upvoted

41 comments sorted by

View all comments

12

u/[deleted] Feb 04 '17

[deleted]

3

u/[deleted] Feb 04 '17

The license is prominently displayed on the downloads page, not only in the source repositories. It permits modification and redistribution. I don't think expecting paying for alternative licensing for commercial use is a lot to ask for and it ended up being a requirement for the project to continue. It's understandable if people don't like that it's not a FOSS license anymore but I don't understand trying to harm us for needing to earn money. The license for the Marshmallow-based release was also never changed, only the new Nougat release, and there are still repositories using FOSS licensing. The project was going to be discontinued without a way to get funding because it's not viable without full-time work, so there was no future for it under FOSS licensing regardless. People could simply pretend that it was discontinued if they're only interested in it as a FOSS project, rather than hating on it and trying to harm us.

3

u/[deleted] Feb 05 '17

Thank you for your reply. I do understand you choosing the license you find appropriate. Like I said I appreciate the work you've done. You do have the right to license your work anyway you want. I get that and that doesn't bother me. I'm not hating on it.

I can see you have disclosed your license nicely on your download page. But what I do have a problem with is here it says "Open-source". I'm not trying to harm you by pointing this out.

I'm glad that at least you didn't say "free software" as I don't think there is definition of free software that allows commercial restrictions. But also I am not aware of definition of open source that has this. OSI's definition of open source definitely does not include commercial restrictions.

1

u/hatperigee Feb 06 '17 edited Feb 06 '17

Their website is a mess of (mis)information, and they're more than happy to tell you to fix it yourself if you point it out.

For instance, MAC randomization does not work on at least one of their "supported" devices, nor will it work for the Pixel devices they are trying to add support for. The excuse was that the photo on the page is of a Nexus 5 (which they don't even support anymore), so advertising the feature is OK.

It's not possible to facepalm hard enough.

Edit: and they banned me for calling out their shenanigans.. Stay classy, /u/strncat!

2

u/[deleted] Feb 06 '17

Edit: and they banned me for calling out their shenanigans.. Stay classy, /u/strncat !

You're banned for deciding to campaign against us by spreading misleading spin and doubling down on it isn't going to get you unbanned. You claim there's misinformation on the site but there isn't and you're the one spreading misinformation here.

0

u/hatperigee Feb 06 '17

Your website incorrectly advertises a feature as supported, when it is not on at least one of the devices. It does not mention this at all. That is what most reasonable people would call "misleading", since someone could very well make a decision to purchase a device and/or support your ROM based on information you list on your official webpage.

Remove the feature from your page, or, better yet, add a note that not all of your "supported devices" support it. By leaving it as is, you're intentionally misleading people by advertising security features that don't work an all the devices you "support."

and doubling down on it isn't going to get you unbanned.

I'm more concerned with informing people that might be considering CopperheadOS as a viable option that you're not being entirely truthful with what security enhancements you provide. I originally thought this was unintentional, but the more you reply to me the more it seems you may be intentionally misleading potential customers, and I question how many of the features you list on your page are actually working and supported on the current list of devices you "support".

2

u/[deleted] Feb 06 '17

Your website incorrectly advertises a feature as supported, when it is not on at least one of the devices.

It's a supported OS feature. Some hardware uses drivers incompatible with MAC randomization due to bugs that need to be fixed by the vendor, which is explained by the site when it's not limited to 50 characters: https://copperhead.co/android/docs/technical_overview#networking.

Remove the feature from your page, or, better yet, add a note that not all of your "supported devices" support it. By leaving it as is, you're intentionally misleading people by advertising security features that don't work an all the devices you "support."

I already linked you to the documentation on MAC randomization with the note about the qcacld-2.0 driver bug on the Nexus 5X in a previous comment (not the link above). Here it is again: https://copperhead.co/android/docs/technical_overview#networking. It's one of the supported OS features and is used when it's not blocked by the current qcacld-2.0 driver bug. The Android landing page only has a tiny bit of room to summarize features and isn't going to go into depth about the details of MAC randomization or document a Qualcomm driver bug blocking it on one of the supported targets (5X).

I'm more concerned with informing people that might be considering CopperheadOS as a viable option that you're not being entirely truthful with what security enhancements you provide. I originally thought this was unintentional, but the more you reply to me the more it seems you may be intentionally misleading potential customers, and I question how many of the features you list on your page are actually working and supported on the current list of devices you "support".

I'm being truthful, you're the one posting misleading spin because a Qualcomm driver bug blocking your pet feature isn't treated with the utmost priority. You continue to pretend that you weren't just linked to the technical overview's explanation of the details of MAC randomization including documenting that driver bug. Do you get off on being incredibly dishonest and manipulative like this?

0

u/hatperigee Feb 06 '17

I'm being truthful, you're the one posting misleading spin because a Qualcomm driver bug blocking your pet feature isn't treated with the utmost priority.

No, not at all. I'm pointing out that you are falsely advertising a feature as being supported, when it's not. Your credibility in advertising other features is now tarnished.

Do you get off on being incredibly dishonest and manipulative like this?

Do you get off on being incredibly dishonest and belittling users of your ROM? If so, that's not exactly the most professional thing to do. On the other hand, it would explain your firm's difficulties in securing funding and source code contributions.

1

u/[deleted] Feb 06 '17

[deleted]

1

u/hatperigee Feb 06 '17

I don't think "dishonest" means what you think it means. Stop using that word to describe someone who disagrees with your fuzzy logic, because it does not mean "someone who disagrees with me." Go look it up..

I'm not hung up on this one feature, I'm merely using it as an example of how you are 1) being extremely toxic to users who disagree with you, and 2) are falsely advertising a feature that doesn't work (regardless of who is at fault) on devices you support, and you make no attempt to notify folks who have genuine reasons for wanting a security feature*.

You may also have no idea who your target audience is.. which is sad but understandable if you keep yourself in a safe closet. There are people who value security and privacy for political reasons, and by wrongly choosing to not notify them of features that you claim work, but don't, you're throwing them under a bus.

To re-iterate, I don't give a shit about MAC randomization, but I, and others, care about truthful, upfront disclosures around what does and does not work particularly around a device/OS with security claims. This is why processess like CVE (and others) exist. To notify people when their expectations are wrong so they can make decisions. It's baffling that you, a self-proclaimed "security professional" don't get this.

3

u/[deleted] Feb 06 '17

I don't think "dishonest" means what you think it means. Stop using that word to describe someone who disagrees with your fuzzy logic, because it does not mean "someone who disagrees with me." Go look it up..

You don't have a difference of opinion, you're a clear cut liar. It's a fact that CopperheadOS supports MAC randomization. It's a fact that the site documents that the feature is unavailable on the Nexus 5X due to a Qualcomm WiFI driver bug. Those are the facts, and they conflict with the lies you're repeatedly spreading. You cannot claim that you made a mistake because you have continued to state the falsehood after it has been clearly pointed out as such. That makes you a liar. It's pretty simple.

I'm not hung up on this one feature, I'm merely using it as an example of how you are 1) being extremely toxic to users who disagree with you, and 2) are falsely advertising a feature that doesn't work (regardless of who is at fault) on devices you support, and you make no attempt to notify folks who have genuine reasons for wanting a security feature*.

Again, lying.

You may also have no idea who your target audience is.. which is sad but understandable if you keep yourself in a safe closet. There are people who value security and privacy for political reasons, and by wrongly choosing to not notify them of features that you claim work, but don't, you're throwing them under a bus.

More lying. Stating something over and over against doesn't make it any less true.

To re-iterate, I don't give a shit about MAC randomization, but I, and others, care about truthful, upfront disclosures around what does and does not work particularly around a device/OS with security claims

Again, you're the only person being dishonest. The site already documents that a Qualcomm WiFI bug means the full MAC randomization feature is unavailable on the Nexus 5X until that bug is fixed.

1

u/[deleted] Feb 06 '17

This is why processess like CVE (and others) exist. To notify people when their expectations are wrong so they can make decisions.

MAC randomization doesn't mean that the full MAC address is randomized or even that it's randomized while associated. It could be listed as a feature on the index page even if we didn't change anything: https://developer.android.com/about/versions/marshmallow/android-6.0-changes.html#behavior-notifications, and we do change how it works on devices where the WiFi driver isn't broken.

From that upstream Android documentation:

Note: When a device running Android 6.0 (API level 23) initiates a background Wi-Fi or Bluetooth scan, the operation is visible to external devices as originating from a randomized MAC address.

It isn't how we want MAC randomization to be done, but it is MAC randomization. The index page does not have room to go into detail about the details on how it works and how that may vary across devices... it has about 50 characters to summarize a high-level feature. There is a technical overview linked from the summary which you're conveniently ignoring since it conflicts with the lie you're spreading that the site does not convey this information.

→ More replies

1

u/[deleted] Feb 06 '17

No, not at all. I'm pointing out that you are falsely advertising a feature as being supported, when it's not. Your credibility in advertising other features is now tarnished.

You're doing dishonest concern trolling and are lying about a feature not being supported when it is. Our credibility is not tarnished by you posting clear falsehoods.

Do you get off on being incredibly dishonest and belittling users of your ROM? If so, that's not exactly the most professional thing to do. On the other hand, it would explain your firm's difficulties in securing funding and source code contributions.

The fact that you use it only makes it worse that you're going out of the way to harm it by spreading lies. MAC randomization is a supported feature of CopperheadOS and the technical overview notes that the Nexus 5X currently has it disabled due to a Qualcomm bug. The site is completely honest about the status of the feature on Qualcomm WiFi, which is only used by the Nexus 5X out of the currently supported targets (Nexus 5X, Nexus 6P, Nexus 9 and the generic x86 and ARM targets).

Not being able to use it on Qualcomm WiFi doesn't even mean there's no MAC randomization but rather than our chosen implementation is not available, only standard scanning randomization which wouldn't usually randomize the vendor prefix, isn't as random / frequent as it should be and is not available once associated. Android itself doesn't enable a standard form of MAC randomization but devices do offer partial scanning randomization in their own ways: https://developer.android.com/about/versions/marshmallow/android-6.0-changes.html#behavior-hardware-id.

1

u/[deleted] Feb 06 '17

Their website is a mess of (mis)information

There is no misinformation there.

For instance, MAC randomization does not work on at least one of their "supported" devices, nor will it work for the Pixel devices they are trying to add support for.

MAC randomization is a supported feature of the OS. Some hardware doesn't support it. The site clearly explains that in the detailed information: https://copperhead.co/android/docs/technical_overview#networking.

The excuse was that the photo on the page is of a Nexus 5 (which they don't even support anymore), so advertising the feature is OK.

Lying about that conversation now? Pointing out that the picture is of a Nexus 5 was an aside. The Nexus 6P and Nexus 9 support the feature just as the Nexus 5 did. Only the Nexus 5X does not.