james

August 13, 2021 by james

The Secure Mobile Phone

How secure is secure?

I was installing GNU-Guix Linux operating system the other day and pondering on the FSF ideology of only using free and open software. Almost all the hardware of the machine I was installing on was made by Intel, and Intel has released a lot of their software as open source and free. So good so far, except for the WIFI module which to get going I have to use a closed source software. The problem with closed source software is that the code cannot be checked and so a degree of trust is involved. Also, with AMD as well as Intel, there are design flaws in their hardware that can only be mitigated through software, such as the microcode for their processors. These are always closed source and therefore not available to truly open source systems, leaving them venerable to problems if you stay true to open source - catch 22!

Onto the mobile.

Can a mobile phone be truly secure? Probably not, because as soon as you connect to the telephony service, a triangulation of your position is fairly easy. In all other aspects it's quite possible depending on the hardware you use. At the moment is appears like the Pinephone has the best chance as the telephony modem has been "reverse engineered" to run off open source software. Everything else in the phone can (and does) use open source software. Other phones may be open too as there are several Linux phones available.

Onto the practical.

Which phones are or can be made secure in a general sense?
The Apple iPhone security is unknown as it's hardware and software are proprietary and therefore by definition, cannot be trusted, no matter what their marketing may say.
Android phones are a bit of a mixed bag. The Android system itself is open source, which is good news. However, Google have added their own proprietary software which is not so good. This is placed in the system and is difficult to remove, although it can be done. Many of the Android phones have closed source hardware, the software for the modem, for wifi/bluetooth etc are proprietary. Sometimes these have to be taken on trust. So far there have not been any reports of these being infected with mal/spyware.
Linux phones are few on the ground, and some Android phones can be converted to run Linux. See PostmarketOS and TouchOS (Ubuntu based).

Which phones

This depends on many factors ranging from personal to how secure. So, I'm not going to recommend any phones (or at least not here). If you want to be at the forefront for secure technology, then a Linux phone would probably be your go to. Other than that, and Android phones can be made fairly secure with a little technical knowledge.

There are many "how to's" out on the net for your phone to unlock the bootloader and to "root" the device, so I'm not going to go into detail. Maybe check xda-dvelopers.com/forum for info on your device. The "why" is a different matter. One or both are needed to change things on the phone to make them more secure or less insecure.

The bootloader

Unlocking the bootloader enables different systems to be installed and run (booted). So to change from Android Motorola to LineageOS, the bootloader must first be unlocked and a recovery flashed across, then LineageOS installed and booted.
LineageOS is an independent Android built off Googles open source ASOP. It comes with a few basic apps to get you going. LineageOS does use proprietary software from the manufactures for some of the hardware to function. Most of the other ROMS (Android systems) are based on, or from LineageOS.

Rooting

Rooting the phone will allow system files to be modified, removing google and vendor bloat.

Other aspects

I mentioned LineageOS as a alternative to the makers version of Android. There are 2 others I'd also recommend: GraphenOS & Replicant OS however both are limited on the number of devices they support.

Applications

Almost all of Googles app track you in some way, and with the Google software installed, almost every app usage some detail goes back to Google. Google is an advertiser and will therefore use all this info to target ads at you through all aspects of the net. There are open source alternatives for virtually everything that Google does, the one thing that Google has done is made things very convenient for the user, which makes it difficult to move away.
Here is a list of alternative open source apps that don't track you or sell your data for profit:

Maps - OsmAnd
email - K9
Browser - ungoogled-chromium
Calendar - Etar
Notes - Carnet
Drive - Nextcloud

Those are the main ones. To opt out of Google completely would mean moving email to an encrypted email service like Protonmail, Nextcloud can hold your calendar, tasks, photos, Carnet note, sync to your desktop and more. De-googling your life I've already written about. Other browsers offer different protections, like Brave browser, firefox, private browser, and Tor browser.

Fdroid

Once LineageOS is installed and running, installing apps is done through a service from F-Droid and their app as Google play store won't be available. F-Droid hosts all the above apps except for a few of the browsers.

Communication

Now this is an important topic. The standard phone calls and sms can be tapped into. For sms there's Signal, not fully open source but it is encrypted and so far has a good reputation. Other form of text communication involve other platforms and services. Xmpp/Jabber is a good and safe system when encrypted. Matrix platform is another good system that is open source, private and like Xmpp is very reliable. Worthy of note is telegram, although again like Signal is not fully open source has a good reputation and is very popular.

Social platforms

These are a pain as they are built to extract info from you. So as soon as you login, they are gathering info. So the main thing here is to reduce what they get to a minimum, if you want of need to use their services. There are "wrapper" apps that access the mobile website of the social platform and restrict what it has access to on your device, like blocking location, camera and microphone.

Other notes

Once a device is free of Google and the manufactures bloat (and spyware - yes it does happen) then the insecurity of the device is down to how YOU use it.
Many years ago I used to remove spyware from Windows machines. After removal I'd lock the machine down and show the customer and they'd be well please. Quite often I'd get a call a couple of week later say "somethings gone wrong, can you check" and sure enough they switched off the protection and visited some dodgy website.
So it doesn't matter it your phone is the most secure in the world if you don't use it right. Security is an inconvenience, and only discipline will keep it that way. If you value your privacy, you'll keep it secure.

Final Note

Security is as srong as th weakest link. It doesn't matter how secure your phone is, if you're commincating with an insecure phone, the security is compromised.

Good luck!
Stay safe.

And a site that covers some apps, what to avoid, what to use: https://github.com/pluja/awesome-privacy

July 3, 2020 by james

Thinkpad R61 to Thinkpad E595

Brothers from the same stable

A review, going from R61 to E595. This isn't strickly a comparision because they are very different laptops and there's about 14 years between them! However to see how far the laptop has come, what new, what's been left behind etc. In a way I've come to see them as brothers.

The ThinkPad E595

These are the basic specs:

The basic spec for this laptop I have here is:
CPU: AMD Ryzen 7 3700U with Radeon Vega Mobile Gfx (8) @ 2.300GHz
GPU: AMD ATI 05:00.0 Picasso
AMD Radeon Vega graphics
16Gb ram
500Gb ssd NVME
A 15.1" display res 1920x1080 60hz
USB3, HDMI, USB C power in, Micro sdcard reader, ethernet & headphones.

Note: Battery internal and not unplugable, no CD drive (However space for second drive internally).
Comes with Windows 10 preinstalled.
Overall the build quality is good.
The screen has a metal (aliminium?) frame which makes is sturdy. The screen is bright and clear with the matt finish, which i prefer.
The keyboard is good, although not as good as the R61, but this could be that I'm not used to the feel of this one yet.
The main body is plastic which feel solid enough and doesn't really flex. It does get warm when used on your lap but not burning hot. I haven't opened it up, yet.
The presentation overall is quite plain and minimal, with only the iconic "ThinkPad", subtle "Lenovo" branding and few stickers. Comes in the usual matt black.
One thing I'll mention here is that after using a macbook pro with the back lit keyboard, this is something that should be here as standard and in this case lacking. If I can get one tht would word, I would definately upgrade, as there is no feature for dim lighting use.

The ThinkPad R61

The basic spec (upgraded from orignal)

CPU: Intel Core 2 duo T8100 (2) @2.101Ghz
Graphic : Intel mobile GM965/GL960
4Gb ram (original 2Gb)
500 Gb SSD
disply 14.1" Res - 1270x 780 50hz
USB2 Firewire, Powerin, pcimie, sdcard reader, cd/dvd player/burner (now not working), ethernet, headphone socket, mic socket, wifi no/off switch, mic on/off switch.
Replaced battery with larger one.

This is one solid workhorse! It has been bashed and dropped, tea & coffee split over it, and it continues to just get up and work. This little unit will become my backup just in case, and for some projects that require a long time computer usage, like compiling an android rom. Last time I tried that on this machine took 14 hours! I dread how long it would take now.
The build quality is solid with metal chassis in the base and metal frame for the screen. The screen, at the time was good and it still works well but a second screen of high deffinition and resolution is required for graphics or detailed work.
The keyboard - second to none. The R61 althgouh doesn't have the backlit keyboard (not around at the time) does have an led light in the screen houseing that shone onto the keyboard, making is usable in dim lighting conditions.
The overall presentation is again plain and minimal. The usual branding.

The R61 on top of the E595 shows size difference

Moving from the R61 to the E595

I was wondering how to explain the differences and I thought the best way is explaining the usage and how some little things I am going to miss. One thing I really liked about the R61 was a small set of LED icon notifications just below the screen. These are for useful things like caps lock, num lock, hard drive in use, wifi in use, battery charging/discharging, power plugged in and on, and sleep mode. The E595 Has a bright LED in the num losk & Caps Lock keys, a red LED on the screen lid to show sleep (pulsing on/off) and solid red for laptop on, an LED on the power button, and an LED when the power is pluged in. The difference is on the R61, they were all in one place, on the E595, they are scattered all over the place.

The power cables are different to and although the USB C plug is now a standard, the connector does feel fragile compared to the original.

One of the most notable differences is the size. The R61 is chunky while the E595 is bigger length and bredth, thickness is a lot slimmer. And being bigger means a bigger screen!
What I do like about the E595 though is the bigger screen, the numberpad on the side and a more powerful processor & larger RAM to match. It's also a lot, lot lighter. The finish is similar with the matt black styling, smooth on the E595 and grippy on the R61.

Software

Both machines came with Windows (R61 - XP & E595 Win10).
With the R61 I kep Win XP on it for a while as there were some apps I had/used that could only run on XP. However, one of the first things I did was to shrink the Windows partition and install Simply Mepis (a Debian based distro) which became my standard for a long time. My old laptop, a Toshiba Satalitte (P3 700Mz, 192Mb Ram) would run Simply Mepis easily and out performed many P4's with 2Gb ram & XP! Through the years The R61 Has had Debian, Ubuntu, Gentoo, and a few others, and has performed well in every case. Having the Intel hardware made it easy to find the drivers.
The E595 ws booted to Windows10 just to see, but only until it wanted my info. Then it was shutdown and MXLinux installed. Along side is Obarun (and arch based Distro without systemd) and Linux Mint (for running one app only that isn't available for Linux - details in another post later). The only drawback with this laptop at the moment is that it's too new and the graphics has caused problems with some distros - Linux Mint 19 with kernel 5.3 give a black screen yet 5.0 works fine. Others I've tried - Antix Linux has X-server crash, as does some others. Installed and deleted: Calculate Linux works well and does Ubuntu 20.04 (which I do not recommend - another time), Fedora & OpenSuse (live USB only) work well too.

Conclusion

If I can find a couple of 4gb ddr2 sodimm modules I'll upgrade the R61 to the 8Gb Ram that it should have had from the beginning.
I do like the E959 a lot and I'm already enjoing using it, and will continue to enjoy exploring its capabilities.
Now to find some more projects to utilise the power of this machine...

Have you recently invested in a new machine? What was it and was it a good choice?

July 1, 2020 by james

Linux Mint – Unofficial Upgrade

I wouldn't normally have a system with systemd on my hrdware, but this is a bit unusual, and Linux Mint is only istalled to run one application/program.

A back story.

Quite a few years ago I bought the Logos Bible Software to help with my studying of the bible and Christianity. They made only versions for Windows and Mac. Not for Linux, although many had requested in the forums, they refused. The Logos software was/is developed around the .NET framework. To put it on the Mac they used mono - the opensource version. So I bought a Mac (better than Windows) and dual booted with Linux.
I had tried to install it on Linux with Wine, but that didn't work.
Rcently though, some resourceful fellows (to whom I'm very grateful) have managed to install and to run well on Linux using a modified version of wine. This wine was developed on/for Ubuntu.

It will also work on Linux Mint, and although some have had success running it on Debian and Arch, I have not tried to hard to do the same as they all have systemd, I went for the easy option.
Why not Ubuntu? I snaped over snap. And that is for another time, just to say I'm grateful Mint has stopped snaps altogether. A wise move in my opinion.

So here we are with Linux Mint.

I have just upgraded Linux mint from 19.3 to 20 without any problems. Here's what I did:
Your mileage my vary and it is your choice. This worked for me, it may not work for you. I have a fairly stock install.

Downloaded Xfce 20 and made bootable USB.
Booted from usb, checked everything worked as it should. Copied /etc/apt folder to hardrive.
Booted into local Linux Mint 19.3.
Terminal "sudo thunar" to give elivated permissions, navigated to /etc/apt/ and replaced most of the files from version 20.
Closed Thunar & terminal.
Opened update manager.
Reloaded package info from new repos.
Updated update manager.
Checked for strange behaviour/upadtes and what's being deleted <= really important!
Hit update and waited (900+ packaged download & install).
Opened Teminal "sudo apt dist-upgrade".
Once complete, reboot and enjoy!

As an add

Because Chromium is not available in the repos, an alternative is "ungoogled-chromium" available here:
https://software.opensuse.org/download/package?package=ungoogled-chromium&project=home:ungoogled_chromium

Which works well.

Have fun 🙂

December 12, 2018 by james

Escaping From Google

In the wake of Facebook data fiasco and Googles collection for their own end, I thought it would be an interesting project to see if it's possible to go Google free on Android, and Google free completely for my business. A lot of people use Google for a lot of things ranging from email to maps, drive (storage) to music and of course search.

In the wake of the passing of the AA bill through the Australian parliament, i have updated, amended and added to, to take this into account.

What are the replacements for the most common apps used and how does it effect the work flow?

One of the biggest hurdles to overcome is th idea that nearly all of Googles apps are integrated, they are connected to each other, and on Android, many apps use the Play Store (Google) notification system. Some apps have reduced functionality without the Google connection.

The Apps

Google	Android	PC/Mac/Linux
Search	Duckduckgo/Smartpage
Maps	OSMAnd~	Openmaps
Gmail	Protonmail/Tutanota
Calendar	Etar	Lightning/Nextcloud
Drive	Nextcloud/Mega.nz
Chrome	Waterfox/Via/Orfox (requires Tor) Brave
Music	Blackplayer/VLC	VLC
Keep	Markor	Atom
Launcher	Nova/ Lawnchair
Message (SMS)	Signal
Photo	Nextcloud/ Smugmug
Doc’s	Nextcloud/polaris office/Andropen office	LibreOffice/ Openoffice
Password	Keepass2android	KeepassXC

And for Android itself: LineageOS is probably the most well known and has the most available supported devices. Mokee (needs some modding) or Resurrection Remix OS (more found on xda-developers.com) are also good and generally kept up to date. There are more specialised android remakes that are far more secure.
Replacing the Android system is the only way to take Google off your device. It is a lot easier to do now than before and some manufactures are friendlier than others with this.

As I've put a non standard (manufactures) Android on all my phones, for this review I use my Sony Xperia Z. It's not a new phone but still works well and the community support is outstanding.

The biggest part of Google is their free online apps that can sync across devices. It was revealed a while ago that they use AI bots to search through your email, docs etc for keywords so they can present you with more relevant advertising. I'm not keen on this. What to do about it? Well, most businesses these days have a website, which means they have a server. On my server I've installed an app called Nextcloud. Nextcloud can, with the aid of plugin and third party software do almost everything Google does, except look at your stuff, there is also an encryption plugin. Your calendars, photos, file storage, music and video streaming, encrypt it all, sync to all your devices and it's open source software (and it's free!).

Keepass is a password encryption storage system. Cross platform. Here will give you what is available https://keepass.info/download.html

Update:

As the new AA Bill is so invasive with it's powers (I'm not going to get political here) what can be done to protect yourself from spying eyes and keep your privacy?

I researched most of this a while back. Besides the above, if you have a server for your website, move it to a safe country like Switzerland. Then for your finance and communication, I'd suggest using an operating system from a USB stick. There are a number around, one that is most recommended is Tails (https://tails.boum.org/) as it comes with almost everything you need to stay safe. On their website they even have an installer to take the hassle away. I've used Tails and can recommend them. Along with ProtonVPN, you'd be good to go. This is a bit of a hurriedly finished post, so I'll be updating it over the next few weeks just to make sure I've covered everything.

Any questions or suggestions that I've missed are most welcome.

Stay safe 🙂

September 12, 2018 by james

Eating Well

A friend of mine was having trouble loosing weight, yep the same old story. Count the calories, reduce the plate size, do more exercise and still nothing really happening.

So we looked at how it was done in the olden days. And that was very different. It basically boiled down to reducing certain food types, namely sugar, bread, biscuits, cake, chocolate etc. We saw the connection, sugar and carbohydrates. My friend hunted out some books from the library, on of which was the Real Food Revolution by Prof Tim Noakes, which is based on the finding of Dr Banting.

She starting on this lifestyle choice and lost 20kg in 9 months without extra exercise or plate size reduction!

I will be going into more detail in another post and referencing some science to back this up.

If you want to feed you body the propper stuff for healthy living, my suggestion is to go onto the Banting diet, do your research and enjoy life. The minimum you could do is to cut out all the processed food that's on the market and reduce/stop your sugar intake.

More later - eat well 🙂

September 25, 2014 by james

Linux for the Macbook?

I have a Macbook Pro, which I enjoy using. Credit where credit is due, it is a good machine. I'm in two minds as to whether I'd get another, but this one ain't broke so I don't have to answer the question just yet! I also like OSX, mostly. There are some things I'm not keen on, but like my windows machine before, there are some things I cannot do on Linux, such as Logos Bible software.

On to the question of Linux for the Macbook. Which flavour to go for and why? I cut my teeth on Red Hat 7.1 (which I still have!) and moved to Debian via SimplyMepis. I have tried many others including Ubuntu. For those who are not sure about what I'm talking about there are some websites that go into more detail than I care to here, like Distrowatch.com. Fedora was first on the list so I tried that. It worked well and Fedora 20 is a great improvement over previous versions as this time it felt spritely and the update and package manger were also improved (compared with Fedora 17). But then came "systemd". This is the new init (basically boot up) system developed by some Red Hat developers to replace the existing aging init system. The problem with systemd is its mission creep. Its slowly becoming the "start" system for everything, and there are some things becoming dependant on it which (in my opinion) shouldn't be. The Unix philosophy is for lots of small bits to do things exceptionally well, so if one bit falls over or fails it doesn't take everything else with it. If any part of systemd falls over, it'll take the whole OS with it. Not good for mission critical systems.

Unfortunately most of the Linux distros are moving this way, which is a real shame. So if not fedora then what? Of the main Linux flavours it would appear that Debian and Ubuntu offer long term support versions which don't have systemd, so I've gone for Xubuntu LTS (14.04). This will use upstart init system for its lifetime and hopefully by then the mess of systemd will be sorted and Ubuntu might see sense and open source upstart! Even with this I noticed there were "systemd" patches installed to allow apps dependant on systemd to work with upstart. Sort of leaves a bad taste in my mouth.

Ubuntu and therefore Xubuntu installs easily along side OSX. The only thing to remember is OSX likes to have space between partitions and without these OSX wont upgrade, but it appears the Xubuntu install takes this into account - a nice touch. Once installed it just remains to reconfigure "refit" so Xubuntu can boot. Proprietary drivers are required for the Broadcom wireless connection and Nvidia for the graphics which Xubuntu has you covered - just install and go! Easy.

And as far as the work I do on the Macbook is concerned, I use mainly Linux and then only OSX when I have too. Its good to have it around. I would love to go fully open source but some of the stuff just isn't ready yet. I don't think its too far away now.
Next: to configure Xubuntu for developing Android roms for the Asus TF201.