Feathers McGraw | # 131 | 2018-04-25, 22:46 | Report

Could it also be related to sentiment about the new owners and not having the benefit of the doubt any more?

And also the fact that purism's librem5 is the "new hope"?

gerbick | # 132 | 2018-05-02, 02:33 | Report

Is it stupid of me to ask whether or not this move will produce products that are trustworthy? Too early to tell?

pichlo | # 133 | 2018-05-02, 04:42 | Report

Not sure if I would call it stupid but certainly unattractive. That question is what this thread is all about

gerbick | # 134 | 2018-05-02, 05:23 | Report

And yet no definitive answer. Imagine that.

JulmaHerra | # 135 | 2018-05-02, 06:03 | Report

It's certainly doesn't generate much trust to have Kremlin involved in any way in anything. However, Jolla's licensing practice AFAIK gives the licensee full access to the source code of Sailfish OS. In that regard hiding some backdoor in the product would be more or less stupid idea in the first place. However, because manufacturer can add their own stuff, it boils down to question whenever do you trust either Jolla or the device manufacturer.

tortoisedoc | # 136 | 2018-05-02, 06:28 | Report

there's no stupid questions; just stupid answers

tortoisedoc | # 137 | 2018-05-02, 06:29 | Report

This also explains the reason for them to rename the OS; perhaps they will use the MER middleware as a basis for something else.

jenix | # 138 | 2018-05-02, 07:28 | Report

That is the big elephant in the room after this deal. The thing is: no one can tell by now.
From a technical point of view, Jolla's licensing model allows it's partners to access the SFOS source code, make adjustments and then use the resulting product. Some of those improvements can be backported into SFOS. So it is possible to implement backdoors unnoticed since a big part of SFOS (Silica) is not open source, meaning you can't review new changes for such implementations.
On the other hand, there is a big difference between Jolla Oy (which develops SFOS) and the Jolla Ltd which is the business construct for licensing SFOS and from which Russia Telecom now owns the majority of shares. If they get any influence (and if they do, how much of it) over the SFOS development with this deal is hard to tell. Only Jolla can tell, but probably won't. That's why there are all those wild speculations here.

Let's look at that matter from the perspective of motivation:
The first licensing deals in Russia for SFOS were to obtain an independent mobile operation system for governmental use which is not associated with the USA or China. With this motivation, you're target probably isn't to implement backdoors, but to make the system more resilient and safe to be protected against foreign intelligence services.
Now with the Russia Telecom deal and the focus towards consumer market, this changes. Seeing Russia's tendencies towards internet censorship and crackdown on privacy-friendly tools, I'd say there is a fair chance for adding backdoors as surveillance measures. This would probably affect the russian SFOS at first, but unfortunately it's not infeasible to find it's way back into SFOS itself (and be it unintended when someone forgets to remove it from a backport).
Again, only Jolla can tell about possibilities or countermeasures (if they are not bound by some kind of NDA). So in the end, all we can do now is wildly speculating and maybe look for (in-existent) alternatives.
From my point of view, the best way for Jolla to counter all those wild speculations and fears about russian influence would be to finally move all SFOS components to an open source license, so everybody can check the changes.

One final thought: We are arguing here about possible privacy violating implementations to our operation system in the future while it contains the unaudited closed source security sh*thole called Broadcom baseband from the very beginning.

pexi | # 139 | 2018-05-07, 08:17 | Report

I was under the impression that these guys want to make their own downstream version. I think that should not affect sfos itself other than help it have money / dev resources.

jenix | # 140 | 2018-05-07, 16:09 | Report

I brought this topic into the last Community Meeting. As expected, Jolla can't really comment on these speculations, since they are only speculations (what can they really say about it?). But James pointed out that the backports (improvements to SFOS components) from their licensing partners usually affect packages from the MER project, so they are already open source and can already be tracked and reviewed.

Regarding publishing the code of the yet closed parts of SFOS, Jolla's argument seems to be that they won't be able to handle additional stuff like reviewing commits and pull requests from the community. They also seem to be afraid of forks being made when they release the code.

You can read all in the Log of the meeting here, starting at around 08:08.
http://merproject.org/meetings/mer-m...08.00.log.html