Discovering sailfish through the fairphone 2

What do you think is wrong with the categories defined in android ? while I agree that android is not going far enough to enforce app permissions, I don't see why they would not work... just see what the xprivacy app allows to do on android, to me that is a quite valid protection against malicious apps. Yes I don't read the 3 pages permissions list, but if I see that a cat videos app requires my location, I can block it, uninstall it or choose to keep it without the location feature (no, I would not install a cat videos app).

I would be interested to have your sources about Google lowering their security verifications in the play store. Were there checks they did that could not be made automatically by improving their scan ?

Finally, I don't fully agree with what you are saying about "perverted" package management; some of the "important features" you cite would never be of use for most users... I can understand why a linux user would want to download the previous version of a compiler to build sources depending on it, but I really don't see a normal user downgrading their version of the gmail or facebook app on their phone...

Not naive, perhaps, but an interesting alternatve viewpount from somebody coming to SF from an OS like Android. Perhaps folk 'brought up on' Android, coming to Sailfish, will think that the unix security model (which I assume SF has - I've still not seen it) is seriously insecure. Just as I, coming to Android from Linux, think Android is seriously inconvenient. But then, I too don't install random stuff on my computers. Perhaps, for people who do, the Linux security model really isn't good enough!

I get the idea behind having action based permissions, and It would be nice to have a user friendly way to verify what the app does and doesn't access.

But the problem is what you see in Android world is that apps start asking for quite a lot of permissions, and people still want to use them anyway.

Well, to me both linux and android default behavior regarding apps is not what I think it should be.

As a user, what I think would be a very good model is what I have using XPrivacy on Android (also possible using the cyanogenmod rom I believe): you are aware of the permission requested by an app when it first request it. You can allow or reject, once or permanently.

When you reject a permission, you are aware that the app might not work as expected (but hey, you just refused it a resource it needs so don't blame the app !).

The linux model does not seem right for smartphones to me because:

• I don't have as much personal information locally in my computer as I do in my phone (mostly using cloud-based services while I have my contacts, location, sms messages etc in my phone).

• I don't install on my computer a lot of software, for example I don't install a travel app or an offline gps app when I travel.

  • Installing apps from untrusted sources in linux is quite uncommon and even not so easy to do (add a repo etc), while on a smartphone it is always 2 clicks away.

On Sailfish OS, for now I feel like I have to install untrusted apps for what I consider daily usage tools, so not having a strong way to control what they do is a problem...

I think we should no longer differentiate between phones, tablet, laptops, etc. all too much. In the end they are all computers and actually I expect from all my devices more or less the same. Of course another display size and usage scenario requires a different UI, but the phones and tablets are powerful enough to just attach a bigger screen, keyboard and mouse and you'll practically get a regular office PC (see the Ubuntu tablet).

That said, I agree that there should still be modern permissions concept; just have a look at the large amount of ransom ware these days..! But the concept should be developed for Linux in general and then used by Sailfish OS. I don't think that Jolla should develop their own concept and I also don't think they would have the resources for that.

wow, I had not think about it this way, you have a very interesting point ! Could indeed be very interesting to have software permissions control in any linux system. And I can imagine the work related to implementing that on top of the existing...

However, while I don't feel the need to install untrusted software on my desktop, I really do on sailfish currently.

It feels a bit "irresponsible" (the word is too strong) to let users put their privacy and security at risk just by clicking "install from untrusted sources" when your official software offer is so small (you basically push the user to do it), and when anyone can so easily push fake apps to a store and be a click away.

I think the linux communities might not consider that kind of work as the official "stores" seem to have everything...

PS: so I understand the sailfish community is made of linux users ? interesting !

Yes, it's ridiculous. And almost every OS had this problem in the beginning. iOS had it in early version. Meego had it in first version and even Android had it in an early version AFAIK. Unfortunately it was not implemented yet. But you can always copy from a mail within the client by using "forward" or "reply" on the message and then copy from there.

There has been a patch for stack browser that enabled copy but that's not working anymore with SFOS 2.0, the patch must be "repatched".

It's just that I regard the present situation as not being the beginning anymore. What's ridiculous is not that the feature was missing in the beginning (also applies to Windows Phone, and probably more others), but that it hasn't been fixed in two years of existence of the OS. 'Thanks for the hint with reply/forwarding e-mail tho.

yes, that´s true of course, but there have been quite a few strange decisions lately. And Jolla seem to have lost focus or lack a focused roadmap now. Maybe it has been caued by their financial struggles due to the tablet disaster, but maybe they are just too small for this kind of business. Microsoft or Google both have many more developers and even more resources, it´s hard to keep up with. Anyway, that shouldn´t be an excuse, just an explanation. IMHO a focused roadmap and a "trueee north" could help.