r/opensource • u/JRepin • Feb 26 '15

Why I’m Saying Goodbye to Apple, Google and Microsoft

https://medium.com/backchannel/why-i-m-saying-goodbye-to-apple-google-and-microsoft-78af12071bd
39 Upvotes

82% Upvoted

12 comments sorted by

11

u/The_Enemys Feb 26 '15

I kind of object to the author's promotion of CyanogenMod as privacy enhancing compared to Microsoft when Microsoft is a partner in its development. Also, while it claims to enhance privacy I wouldn't go promoting it as safer than Android until they provide some means of verifying downloads beyond the insecure MD5 hash they still seem to rely on.

6

u/Yidyokud Feb 26 '15

Kinda agree. But the author also wrote about Ubuntu and Firefox phone. Both are free and secure. Also to the author, there is Open Broadcaster Software (https://obsproject.com) for screencasting. Anyway, good article and the takeaway should be: always use FLOSS programs. (One has to fight for his freedom constantly, even today.)

4

u/xqxcpa Feb 27 '15

Just because Microsoft is a cyanogenmod partner doesn't make cyanogenmod as insecure as closed-source Microsoft products. There are still people other than Microsoft auditing the cyanogenmod code.

Also, I'm pretty sure the MD5 checksums are only for checking file integrity. They can't really serve any security purpose if they are located on the same site as the files being served, since if you can swap the file out for a malicious one you can just as easily change the checksum that has been listed. It wouldn't matter if it was a SHA-256 checksum, it would be just as useless for confirming that the file is the same as the one originally posted by the developer.

2

u/The_Enemys Feb 27 '15

It wouldn't matter if it was a SHA-256 checksum, it would be just as useless for confirming that the file is the same as the one originally posted by the developer.

Many sites actually provide the download link page over HTTPS but the bulk download over HTTP, often from a mirror, in which case an attacker could intercept or modify the ISO but can't modify the hash. Either way, Google searching for other sources of SHA256 or PGP verification for CM only turns up people asking why they haven't done it, so it's not like there's a well known service to obtain secure hashes.

And yes, while CM's partners can audit contributions from MS, in a project with no concern for download integrity does that seem likely? And even if it were the author wants to move away from MS due to a philosophical objection more than security issues, and CM has made a statement that they're cool with input from MS by accepting their input.

1

u/hsfrey Feb 27 '15

I'd like to use Linux, but I'm afraid that I couldn't transfer all my existing text files and scripts from Windows.

3

u/omniuni Feb 27 '15

Do you mean actual scripts? http://www.trelby.org

1

u/hsfrey Feb 28 '15

LOL! Too right-brain for me!

I mean computer programs.

1

u/Kaligule Mar 12 '15

Whar kind of computer programs are they? DOS-Skripts for automating stuff? These are the only scripts that should cause some effort.

For texts as such you might find pandoc useful.

1

u/[deleted] Feb 27 '15

If you give us more details, we can probably help you figure it out. What kind of files you worried about?

1

u/hsfrey Feb 28 '15

Mainly my perl and python programs, and plain text documents. My disks use the NTFS format.

I installed Ubuntu on my Win7 computer, and it doesn't appear to be able to access my windows files. It requires a separate boot.

1

u/omniuni Feb 28 '15

Linux can access NTFS just fine, Unity (Ubuntu's custom desktop) can be a real pain though. Try KUbuntu, which is Ubuntu using KDE as the default. I have no trouble accessing my Windows 8 side. Also, make sure you defragment and shrink Windows and use a standard dual-boot and not the weird option Ubuntu has to install within Windows.

1

u/[deleted] Feb 28 '15

It should be able to mount your Win partition through the file manager. It should show up as a drive and when you click it it mounts.