@eloy that's why we're cooking up EU Citizens Initiative, in which we explain to politicians:
1. What's the current problem with Google/Apple duopoly:
- Data collection, including very personal information
- Upcoming "developer verification" on Android thanks to Play Protect
2. Device manufacturers playing dirty:
- Most phones only getting 3 years of support (if that)
- Lackluster security, delayed patches (or not applied at all)
- Security patches being leaked to threat actors like NSO, which can easily exploit devices
- Unremovable, preinstalled bloat/spyware (like Facebook or TikTok, plus crust from every manufacturer)
- Manufacturers spying on users (on top of GSF) with examples like Xiaomi sending browser history to their servers in plaintext
- Taking away the option to unlock the bootloader for "muh security" (and why it's a bad thing with examples of creating more e-waste, opening devices to attacks - possibly even from adversary nations)
3. Problems with Android ecosystem:
- Geoblocking in appstores, good luck installing applications for public transport if you're traveling internationally
- Integrity checks that make it impossible to use apps (banking, public transport and much more) on "untrusted" devices
- Notifications handled by Google/Apple servers, which is a security/privacy concern
- Basically 95% of applications requiring Google Services Frameworks, which is a privacy nightmare
- AOSP development being taken private, which makes it a lot more difficult to create alternative Android builds or audit the source code
4. What we want to change:
- Manufacturers are mandated to release the source code (technically they're obligated to anyway, but they violate GPL2 licensing and nobody does anything about it)
- Every device sold in EU has to have the ability to easily unlock the bootloader and install alternative operating system build of user's choosing
- After the device reaches EOL from manufacturer, manufacturer is required to release bootloader signing keys to allow replacing firmware and providing further security updates by the community
- Force banks (and other developers) to warn users about potential security risks if OS isn't "trusted" rather than blocking access altogether
- Introduce support for UnifiedPush, so that users won't have to depend on GSF to have working notifications
5. Rationale:
- Contrary to what corporations like Google or Samsung will say, this will make phones MORE secure
- Will allow for easier development of Android alternatives (i.e Mobile Linux)
- Makes sure that people actually own their devices. Current state is frankly unacceptable
- Allows for European companies to develop alternatives to proprietary OS components, which will make us more independent