Uncomfortable Questions About Android Developer Verification

  If you run a nonfree program on your computer, it denies your freedom; the immediate wrong is directed at you.
  
  That does not mean you're an “evildoer” or “sinner” for running a nonfree program. When the harm you're doing is mainly to yourself, we hope you will stop, for your own sake.
  
  Sometimes you may face great pressure to run a nonfree program; we don't say you must defy that pressure at all costs (though it is inspiring when someone does that), but we do urge you to look for occasions to where you can refuse, even in small ways.
  
  If you recommend that others run the nonfree program, or lead them to do so, you're leading them to give up their freedom. Thus, we have a responsibility not to lead or encourage others to run nonfree software. Where the program uses a secret protocol for communication, as in the case of Skype, your own use of it pressures others to use it too, so it is especially important to avoid any use of these programs.
  
  But there is one special case where using some nonfree software, and even urging others to use it, can be a positive thing. That's when the use of the nonfree software aims directly at putting an end to the use of that very same nonfree software.

Oh? From the "Finding the right bargain" section of this 2002 essay [0]

> So perhaps novels, dictionaries, computer programs, songs, symphonies, and movies should have different durations of copyright, so that we can reduce the duration for each kind of work to what is necessary for many such works to be published. Perhaps movies over one hour long could have a twenty-year copyright, because of the expense of producing them. In my own field, computer programming, three years should suffice, because product cycles are even shorter than that.

Has his opinion changed since then?

[0] <https://www.gnu.org/philosophy/misinterpreting-copyright.htm...>

Is it the lack of deep, DNA encoded morality? What are we going to do about this? What is the DNA of an organization anyway?

How, as a society can we take away these stimuli that make it so natural to consume individual freedoms when we grow our tribe-size?

Maybe we need more freedom, more freedom to say: "F-this I'm out of here, I just like the set of rule of this other society better." Maybe we are still too constrained. By our ways of generating income, by our countries, continents and ultimately our planet. We have 1 lifetime, we have to make do with what we find.

I was just saying that you can make the problem more narrow by not trying to support every device out there. Start small and pick your battles (which probably means using AOSP and using sandboxed AOSP).

I think the main issue of many previous attempts was what typically happens in the FLOSS community: there are N attempts rather than one coordinated attempt (Ubuntu Touch, Plasma Mobile, PostmarketOS, PureOS, etc.) and everybody is targeting different hardware. It's similar to how the Linux desktop got fragmented, though it's even more problematic for mobile, since the usage is probably 1/1000th of Linux desktop usage.

When was it? There are no complains from people daily driving both phones in the last couple of years AFAIK.

No, that's unnecessary. Nobody will be taking you that seriously.

> some new enrollments topped up their accounts and dropped off before the final step that makes it show up on the home page

Did they actually put money in?

Or using a bank that supports NFC payments (not using Google Wallet).

GrapheneOS Foundation raised this practice with European Commission because it unfairly penalises secure and safe competition giving instead a lie to the developers and banks that ancient, unsafe, vulnerable platforms are more secure.

And my bank's web app developer couldn't even fix their log in bug for several months. I realize, now, it's because they want to sunset their web portal.

Which is extremely annoying ... what if I don't have my mobile!!

Lazy, and greedy corporates, just trying to save their costing with shortcuts, never realizing security is never achieved by taking shortcuts.

Their developers usually understand security well enough.

The problem, especially for banks, is that they're zero-risk driven, their ideal world is the one where risk doesn't exist. So instead of mitigating it they chase risk elimination (!= reduction) at any cost, while middle management needs to report that they improved something for the quarter. This results in all these kinds of stupid policies, where a 6 year old mobile, unmaintained for 4, is considered more secure than the weekly build of the community-based custom ROM running with locked bootloader signed with user-managed keys with strong protection (these days it's almost infeasible).

EDIT: to be clear, it's normally not the developers thinking up these policies, I have worked in a bank.

The irony is that they'd rather suffer losses from fraud if the fraud is less than the cost of setting up App-based TOTP and a campaign to get customers to use the app. Yet they suddenly get all in a huff about PCI compliance as CYA so they don't have to pay an app developer to figure out how to check "is phone rooted? Yes. Which OS?"

Feel free to say you are a member of the Church of Cryptography and that installing proprietary corporate controlled apps is against your religion.

Never been asked to install an app for banking, but a health care clinic dropped me as a patient for not buying a phone that can install their app. I was the first case where a patient refused to conform. Found a new clinic who was willing to earn my business with phone and email correspondence. The original clinic escalated the case to corporate HQ when I filed a public medical malpractice complaint, and they ultimately responded by adding a webapp.

DEMAND the right to live your life without corpotech in your pocket. I am now 5 years without a smartphone working as an engineer and founder with an active social life who frequently travels and it can absolutely be done.

On the last change my bank made me call to their hotline (even though everything else is possible to be done online) to keep using a separate hardware device - which ended up being just "so, you don't want to do it on a phone?" - "yep" - "ok, should be with you in a week or so".

I nowadays consider my phones pretty much throwaway devices - I don't have full control, I can't fully trust them. Plus they could be stolen, break when I drop it into water outside, ... - so I think it's ridiculously stupid to tie anything important to a phone as main authenticator.

Overall the usefuleness of a phone has been declining steadily - the selling point of a smart phone originally was that I have an app, and because it's a reasonably trusted device it'll store credentials, and I can use the app without logging in every time. By now most of the apps are just repackaged websites, and because of that - and because they don't trust their backends - we now have quickly expiring tokens in use in the apps as well. Most of the apps I don't use every day - and over the last few months every single one wanted me to log in again next time I used it.

Adding to that the nonsense of "there's a new app available, download that first before using" which typically doesn't add anything of value to me, and we're now at a state that not only does the typical smart phone app not offer a benefit over just using a website - it now often is even worse than just using a website.

I barely use my bank's website and could easily not use it at all and still have all the functionality that a bank provides.