Linux phones will lock down users (vnunet) [LWN.net]

vnunet warns us that Linux phones will not be as hackable as we might like. "Consumers who run Linux on a PC are used to having full control over the operating system, but should not expect that same level of control on a Linux powered mobile phone, warned Mike Kelley, senior vice president of engineering at PalmSource".

to post comments

Linux phones will lock down users (vnunet)

Posted Aug 17, 2006 16:16 UTC (Thu) by ajross (guest, #4563) [Link] (8 responses)

Is there any authoritative reasoning behind why this is not in violation of section 3 of the GPL, which requires object code distributions to include "[...] scripts used to control compilation and installation of the executable". The language of the license talks only about software components, but surely the intent is to force the distribution of the development environment also? Distribution of a missing or non-functional build environment would seem, to my eyes, to be a pretty clear violation.

Linux phones will lock down users (vnunet)

Posted Aug 17, 2006 17:10 UTC (Thu) by pbardet (guest, #22762) [Link]

As long as they don't include their locking software in the kernel, and they ship a non modified version of the kernel, there is no violation. It's just proprietary software shipped on top of a GPL kernel. You just need to provide the kernel source.

Linux phones will lock down users (vnunet)

Posted Aug 17, 2006 17:12 UTC (Thu) by AJWM (guest, #15888) [Link] (5 responses)

I disagree. The GPL does not require you to, for example, distribute the compiler along with the source, although that is unquestionably part of the "build environment". Makefiles, install scripts, and so on are typically part of the project; they modify and control the build environment, but they are not the build environment itself.

The license verbage is "scripts used to control compilation" (emphasis added). There is no requirement that a hardware vendor make it possible to load recompiled binaries on the system -- it could be in ROM, for example, or in the case of soem of these phones, the applications run on a separate processor from the OS.

Or to look at it another way, if IBM distributes an S390/zSeries distro of Linux, they are under no requirement to supply you with the environment -- which would necessarily include a zSeries computer -- to (re-)build it on.

Linux phones will lock down users (vnunet)

Posted Aug 17, 2006 17:58 UTC (Thu) by bfields (subscriber, #19510) [Link] (2 responses)

Or to look at it another way, if IBM distributes an S390/zSeries distro of Linux, they are under no requirement to supply you with the environment -- which would necessarily include a zSeries computer -- to (re-)build it on.

I think you can argue that at least the spirit of the license is to require you to be able to run the modified versions if you could run the original version, and that this argument doesn't require you to (for example) give the user hardware that would have been required even just to run the original version.

Linux phones will lock down users (vnunet)

Posted Aug 18, 2006 10:40 UTC (Fri) by job (guest, #670) [Link] (1 responses)

"Hello... I'm calling regarding this space shuttle control system device driver software I downloaded from the Internet, which was licensed under the GPL..." I know one or two that would love that! :-)

Linux phones will lock down users (vnunet)

Posted Aug 19, 2006 1:17 UTC (Sat) by ibukanov (subscriber, #3942) [Link]

GPL allows to charge a reasonable price for obtaining sources. Thus it would be in a spirit of GPL to ask you to pay for the second shuttle witch you can load with your software and launch into space ;)

Linux phones will lock down users (vnunet)

Posted Aug 17, 2006 18:24 UTC (Thu) by ajross (guest, #4563) [Link] (1 responses)

Makefiles, install scripts, and so on are typically part of the project; they modify and control the build environment, but they are not the build environment itself.

I'm not sure which way you are arguing here. Clearly the intent of the GPL is that Makefiles and the like are part of the required distributable; what other sane interpretation of "scripts used to control compilation" can there be? So shipping a missing or unusable Makefile should be a violation, no?

I mean, I'm sure we all agree (don't we?) that the spirit of the license is being violated. I was just curious as to whether any serious legal arguments had been made as to whether this constitutes a real violation or is perfectly permissable, and basically whether the PalmSource guy had any real clue about the license issues or was just talking out of his ass...

Linux phones will lock down users (vnunet)

Posted Aug 18, 2006 15:56 UTC (Fri) by AJWM (guest, #15888) [Link]

So shipping a missing or unusable Makefile should be a violation, no?

Right, the makefiles, etc, are part of what's required to be included along with the GPL'd source. That doesn't necessarily mean that everything that makes up the build environment is required. What is not (under GPLv2) required is that compilers, etc, also be included.

This is significant for something like a phone which may use some non-standard processor, and the vendor has his own proprietary compiler or tweaked version of GCC. You can have the source and the build scripts, you just have no way to compile it. (GPLv3 looks like it would require the vendor to ship the compiler, etc, too in this case.)

The simpler version of this is just to modify the loader to require signed binaries. GPLv2 allows this (under the usual interpretation; some might argue that the signing key should be considered part of the install script), GPLv3 explicitly doesn't.

If this proves to be an issue for vendors, there are a couple of options. One of course is all-proprietary software. Better might be that where regulatory requirements place restrictions on what the hardware is allowed to do, and that hardware is in part emulated by the software (as with software-controlled frequency-synthesized radio), we may see more movement to "split-brain" hardware, as some of these phones already seem to be. The regulatory-critical part would run (proprietary?) locked down software on one processor (the brainstem?), and the UI and apps could run open source on a second processor (the cerebrum).

Linux phones will lock down users (vnunet)

Posted Aug 18, 2006 14:41 UTC (Fri) by paulpach (guest, #20903) [Link]

they will have to distribute the source and scripts and everything you need to run the software. You can make your own phone and run the software on it, you can run it on a computer, you can modify it and run it in your toaster. They do not limit your ability to run the software (arguably), they are limiting the PHONE's ability to run your code, therefore, they do not violate the GPL v2.

This is something that bugs some developers and leaders (RMS comes to mind) and is perfectly ok with some others (Linus). This would not be possible with software licensed under GPL v3. Currently, it appears the kernel will not be licensed under GPL V3.

The way I see it, cell phones will never be hackable (too much headache for providers and loss of revenew). The question is wether they will run linux, If esencial tools move to GPL V3, the answer will be: no.

Linux phones will lock down users (vnunet)

Posted Aug 17, 2006 17:56 UTC (Thu) by grahammm (guest, #773) [Link] (3 responses)

This looks like a good example of the behaviour which GPL v3 would prevent.

Linux phones will lock down users (vnunet)

Posted Aug 17, 2006 18:34 UTC (Thu) by pbardet (guest, #22762) [Link] (2 responses)

If I remember correctly, Linus is not very interrested to move Linux to GPL v3... And even if he did, GPL v3 only covers modules, not software running above the kernel layer which can be as proprietary as the vendor wants.

Linux and GPL3

Posted Aug 26, 2006 23:53 UTC (Sat) by giraffedata (guest, #1954) [Link] (1 responses)

And that's of academic interest only, since Linus couldn't move Linux to GPL v3 if he wanted to. He has a lot of clout, but he'd never be able to get all the copyright owners to agree to that, or ship something not containing their code.

Linux and GPL3

Posted Aug 28, 2006 4:33 UTC (Mon) by Arker (guest, #14205) [Link]

He couldn't do it by fiat, but if he wanted to, he could do it, over time.

Just specify new contributions to be dual licensed, at the rate of code turnover the project shows most of it would be GPL v3 ready in what, 3 years? At that point rewrite anything left that couldn't be relicensed.

"Phones are noy PCs"

Posted Aug 17, 2006 20:07 UTC (Thu) by alextingle (guest, #20593) [Link] (4 responses)

> "Phones are not PCs"

I think the real point is that phones ARE like PCs, the phone manufacturers are simply scared of opening up. Sooner or later some newcomer to the phone market will produce an open platform, and a critical mass of community support will coalesce around it. All the mutually incompatible handsets that we see today will eventually be just quaint bit of early phone history.

Arguments about radio frequency regulations are utterly spurious. Regulatory requirements could be trivially implemented in hardware. What's really stopping the market moving forward are the huge subsidies paid by phone networks to buy handsets for their customers. The networks want their customers locked in, so they can reap huge rewards when the long hoped-for mobile data revolution arrives.

"Phones are noy PCs"

Posted Aug 17, 2006 20:56 UTC (Thu) by iabervon (subscriber, #722) [Link]

Sooner: Trolltech is supposed to ship such a device in September. It's not actually the phone manufacturers who are afraid of shipping open devices. And you can already get Danger Hiptops that aren't locked down if you're actually willing to buy them, or the same hardware locked down from T-Mobile for less. I'd guess that this will be the most common situation, even with Linux phones; the phone providers will subsidize locked phones, and people who care can buy open phones for full price, with identical or practically identical hardware.

Phones suck!

Posted Aug 18, 2006 10:54 UTC (Fri) by job (guest, #670) [Link] (1 responses)

Regulatory requirements could be trivially implemented in hardware.

Not only could they be, most often they are. The RF part is developed more or less independently from the user interface, computer-like, by different engineering groups. You just can't bother the radio engineering types with flashy animations...

Sooner or later some newcomer to the phone market will produce an open platform, and a critical mass of community support

Yeah. There's a whole lot of stuff I could trivially do much better than todays phones. They have lots of issues with syncing between phones and between phone and computer (everyone has their own way despite a standard protocol, and all have quirks), the data split between phone and SIM which isn't obvious, calendaring features that plainly suck, badly implemented IM, etc... I could go on forever.

Instead they give us features such as PTT and to some extent MMS which nobody wants but the carriers can charge money for. Give me the Trolltech phone already and I could do so much better. What a pity that one lacks wifi, which makes it a bit substandard today.

Phones are phones

Posted Aug 20, 2006 0:29 UTC (Sun) by sepreece (guest, #19270) [Link]

"Regulatory requirements could be trivially implemented in hardware."

This is clearly attainable (the ATcommands already expose a reasonably safe interface for accessories and attached devices). However, the phones available today may not be designed to make that separation in a way that protects the network adequately. Just having the RF software on a separate processor doesn't mean the APIs don't allow the application processor to flood the network with requests or otherwise operate in an unsociable manner. Dealing with carriers and the FCC requires more than letter-of-the-law compliance.

Manufacturers have to meet the needs of carriers, consumers, and the FCC. In the US, at least, there is simply no market for direct sales to consumers, so the carrier is unavoidable (and the FCC as well). Even if there were a direct-to-consumer market, the market impact of hackability is negligible - the huge majority of phones are sold to people who have no interest in modifiying them (or even in using all the features built into them). Hackability, like user customizability, is very low on the manufacturers' totem pole of priorities.

Will this change? Don't know. Manufacturers like Linux because it's not only capable and free, but is the development base of lots of technology developers. However, the manufacturers are also generally happy to negotiate dual license access to technologies they need and probably could switch to BSD pretty easily, if they felt they needed to. For the most part, they really want to be good citizens and part of the mainstream, but they also have to deal with their customers and the marketplace...

"Phones are noy PCs"

Posted Aug 24, 2006 2:36 UTC (Thu) by pizza (subscriber, #46) [Link]

"Arguments about radio frequency regulations are utterly spurious. Regulatory requirements could be trivially implemented in hardware."

Actually... no, they can't, at least not "trivially".

Pop quiz -- have *you* ever had to get FCC certification for a transmitter? Have you ever designed a radio and written software to drive it? What research and qualifications do you have that enable you to issue this glib proclamation?

It's pretty damn tough even for so-called "unlicensed" bands, while Licensed bands each have their own quirks (==legal requirements). Cellular phones are perhaps the most complex and convoluted of the lot, to say nothing of non-RF regulatory requirements (wiretapping, non-encryptability (at least from the feds' perspective), non-tamperability, no "listening", etc...).

I agree with your statement that phone companies are scared of opening up.. but it's not "the market" they're afraid of. It's the government.

Linux phones will lock down users (vnunet)

Posted Aug 17, 2006 22:58 UTC (Thu) by dark (guest, #8483) [Link] (1 responses)

They're mixing radio spectrum usage concerns ("Developers could seek to improve a handset's reception by boosting the signal strength") with gaping security holes ("It could bring down the cellular network", "enable services such as roaming or wireless data to which they do not subscribe") and with plain old control freakery ("Developers could also break into the phone to change the user interface").

I think the first order of business will be to get them to admit which concern is which. Limiting the endpoint devices to cover up security problems in the network is what the phone companies tried in the '70s and '80s; ask the kids of that age how well that worked.

Linux phones will lock down users (vnunet)

Posted Aug 18, 2006 16:11 UTC (Fri) by AJWM (guest, #15888) [Link]

Right. I think it's partly a perspective issue: originally, all the processing capability of a mobile phone went into making it work as a phone -- frequency and power issues, cell tower negotiations, etc, etc. As processors became more powerful and memory became cheaper, the vendors starting using some of that as more a general purpose computer for phone lists, calculators, games, digital cameras, etc, etc. But at it's heart they still consider it a phone.

When the perspective changes to realize that it's really a multipurpose pocket computer that can also do phone, they move the phone functions (the regulatory or cell infrastructure critical functions) off to a separate processor which becomes just a built-in peripheral of the pocket computer, just as wi-fi is a built-in peripheral on a laptop. This is already starting to happen.

At this point the main OS can be opened to allow whatever apps the user can squeeze into available memory, and all the radio spectrum and cell network control stuff can be buried in the driver for /dev/phone.

(And yes, there'll still be phone phreaks who want to hack the latter. I just don't think it should be made too easy for them.)

Linux phones will lock down users (vnunet)

Posted Aug 18, 2006 22:50 UTC (Fri) by Stavros (guest, #36829) [Link] (4 responses)

Here's a scenario to consider: An open source software phone hits the market. All the hackers love it, because they can play with it to their hearts' content. All the kids love it because they can get all sorts of cool individualizations free by download. All the business people love it because they can customise the applications and tools to their business needs. Organized crime loves it because it allows them to trivially encrypt all their conversations, and correspondingly the government hates it because they can't listen in wherever they want anymore.

Guess what happens? Yes, the government outlaws the phone and that's the end of the story.

Regardless of whether the market or the free/open source community could push the manufacturers and network providers to open Linux based phones, and regardless of how carefully one could design the radio components to make FCC violations impossible, there is one overriding issue that will prevent anything from being opened:

All telecom providers by law must give the government the ability to tap into communications for law enforcement purposes. If all you need to make an encrypted handset is reflashing the phone's OS, the government will immediately get locked out of all the communications they want to eavesdrop on. Does anyone really expect organized crime to not already be drooling over the prospect of cutting the FBI out of all eavesdropping and forcing them and the courts to limit their evidence to traffic analysis?

And think of the midwestern soccer moms' outrage if they think this gives the evil terrorists an advantage in perpetrating evil. They are even more difficult to trace by traffic analysis than organized crime.

Whatever OS the phone suppliers choose, they will have to lock the systems down to keep from getting in trouble with the government over enabling eavesdropping.

And this is all beyond the "legitimate" concern of breaking DRM and the like. That just puts Hollywood and the RIAA on the side of the government. Does anyone really thing that much opposition will be overcome by the ideals of information freedom?

-- Stavros

Encryption and eavesdropping

Posted Aug 20, 2006 11:44 UTC (Sun) by man_ls (guest, #15091) [Link]

All of your arguments trivially apply to email encryption. For all we know drug dealers, mob leaders and terrorists may be using encrypted mail for all their communication needs. Despite this, mail servers with "unbreakable" ciphers are available all over the net from reputable sources; they can be setup with minimal trouble. You also have encrypted channels, secure FTP servers or VPN's for the more sophisticated users.

Up to now information freedom has mostly won, not because "soccer mom" concerns are not valid but because there are practical difficulties with limiting it. Every law trying to limit this freedom has had terrible side effects, witness the DMCA which is being fought right now, to the point where it is not worth it. You try to protect movies and find yourself suing 16 year old kids who just want to watch their DVDs; try to foist big scale pirates and end up with garage opener manufacturers suing each other.

What makes you think that it will be different with phones?

Linux phones will lock down users - encryption

Posted Aug 27, 2006 0:05 UTC (Sun) by giraffedata (guest, #1954) [Link] (2 responses)

All telecom providers by law must give the government the ability to tap into communications for law enforcement purposes.

I don't believe that. In the US, at least, the government proposed and seriously pursued that (the "clipper chip") for several years, and failed. The people valued freedom from Government more than freedom from crime.

I suppose there are probably some countries where that's true, but probably not enough to affect the technology as a whole.

Oh yes, the US Government does get help in wiretapping us...

Posted Sep 2, 2006 20:41 UTC (Sat) by Baylink (guest, #755) [Link] (1 responses)

Take a look a the EFF's page on CALEA, giraffe.

Been the law for some number of years; I remember it being a fracas back mid-90s.

Oh yes, the US Government does get help in wiretapping us...

Posted Sep 2, 2006 23:03 UTC (Sat) by giraffedata (guest, #1954) [Link]

You're right; we lost some context here and I misspoke. US law has for decades (probably since the telephone was invented) given government help in wiretapping. For example, a phone company has to let the police splice into the phone wires if a court orders it to. In 1994, the law was strengthened (CALEA) to require a telecommunications carrier to design its system to make the modern equivalent of such splicing possible.

The original context in this thread was a suggestion that this means a telephone manufacturer/carrier could not make a phone that could be easily modified so as to encrypt calls, because then the telecommunications carrier could not provide such access to the police.

I've seen several movements to make that law, but I don't believe it is today. In fact, CALEA contains the clause:

A telecommunications carrier shall not be responsible for decrypting, or ensuring the government's ability to decrypt, any communication encrypted by a subscriber or customer, unless the encryption was provided by the carrier and the carrier possesses the information necessary to decrypt the communication.

It doesn't look to me like terminal design falls into the scope of CALEA anyway, but I suppose an expansive reading could say that the terminals, manufactured by other companies and owned by users, are actually part of the network the carrier deploys.

I also discovered my reference to the clipper chip debacle was wrong. Even that was not an attempt to prevent manufacture of untappable equipment. The proposal was for the tappable encryption chip to be made available, not for anyone to be required by law to use it.

All platforms will be hackable

Posted Aug 24, 2006 22:20 UTC (Thu) by bignose (subscriber, #40) [Link]

> Consumers who run Linux on a PC are used to having full control over the
> operating system, but should not expect that same level of control on a
> Linux powered mobile phone, warned Mike Kelley, senior vice president of
> engineering at PalmSource.

Senior vice presidents of device technology corporations are used to having full control over their customers and treating them like passive "consumers", but should not expect that same level of submissive acceptance of vendor lock-in in the future, warned free software hackers worldwide.