<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
Very nice expose. Thank you. I'll adopt style of quoting particular
thing to discuss it, one per message.
<blockquote type="cite"
cite="mid:ad2fd09a-9631-44ea-a9b5-943d73b68ab0@www.fastmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<title></title>
<style type="text/css">p.MsoNormal,p.MsoNoSpacing{margin:0}p.MsoNormal,p.MsoNoSpacing{margin:0}</style>
<div>After researching cell phone OSes and installing Graphene, I
suddenly have a lot of opinions about privacy and security in
cell phone operating systems. I now have a fully degoogled
Android phone, and I'll talk about that.<br>
</div>
<div>...<br>
</div>
<div><br>
<div>[*Footnote: Interestingly, locking my phone would violate
the GPL 3 (by denying an adversary with temporary possession
of my phone the right to hack it and insert malware), but only
if Graphene used GPL 3. Graphene uses a permissive licence
specifically to ensure my right to protect myself.]<br>
</div>
<div>...</div>
</div>
</blockquote>
We are so used to someone else locking out our devices, that I think
we might be throwing a baby with the bath water here.
<p>You take some blank slate device, put os on it, locking out
everyone else. And you use this device yourself. It sounds like
what we wanna do, and what you have done by placing Graphene onto
your device.</p>
<p>This is different from provider/manufacturer locking a device
without your ask, and giving it to you with software on it, which
makes it "conveying a (software) work". Manufacturer/provider
conveys work in locked form. And when you lock your own device for
your own use, you are not conveying it.</p>
<p>Quote from GPL 3, section "3. Protecting Users' Legal Rights From
Anti-Circumvention Law.", start of the second paragraph:</p>
<p>"""</p>
<p>When you convey a covered work, you waive any legal power to
forbid circumvention of ... blah, blah, blah.<br>
</p>
<p>"""</p>
<p>You aren't conveying your locked phone/data, hence this doesn't
apply.</p>
<p><br>
</p>
<p>Now. May be we should create an explicit flow for user to
understand what and who is locking things, to have a visceral
impression of who owns what:</p>
<p>- Explicitly blank slate device with an option to lock it.</p>
<p>- User locks it. Not the vendor, not the provider.<br>
</p>
<p>Done.<br>
</p>
<p><br>
</p>
</body>
</html>