1. 50

Reddit. Hacker News.

  1.  

  2. 11

    Highlights:

    “Note that James Donaldson doesn’t have access to my signing keys and I have prevented that from ever happening in any scenario. By the infrastructure being compromised, I mean he registered http://copperhead.co domain on his personal account so he can take it over via DNS.”

    “I already prevented any possible compromise of the OS. I am not capable of compromising it anymore so no form of coercion can make me do that. It’s very unfortunate that things ended this way and now I guess the little money I earned from this will go to legal fees, etc.”

    Truly sad. Before this, the best thing going on in Android security, OK Labs, got acquired by a U.S. defense contractor, General Dynamics. That’s two, potentially-great options compromised so far.

    1. 8

      I had been vaguely aware of Copperhead OS but never looked into it or used it (I used Cyanogenmod before they imploded, and Lineage OS thereafter). I don’t know anything about the context for this other than the reddit and hacker news links here. Everything I’ve seen so far makes me feel inclined to be sympathetic to this Daniel Micay fellow, so I can’t help but wonder if there’s any information from his former business partner’s side of the story that would make me feel less sympathetic.

      1. 12

        He’s a fellow Arch Linux Trusted User. He seemed like a pretty ok dude in my interactions.

        1. 8

          I also chill in a few old irc channels with strncat post my major arch days, he has a lot of people in the open source community that respect his contributions. My bet is he’ll come out ahead of this if he can get untangled from the copperheados company.

        2. 16

          Daniel Micay was a prolific Rust contributor. (In fact, he is still in the top 20 even if he has been inactive since 2015.) In his Rust work, I found him to be a straight person.

          1. 2

            I have a good impression of Daniel Micay after talking with him om IRC. He’s also an unusually knowledgeable programmer.

          2. 12

            I am curious what happened. The situation reported so far is compatible with CEO receiving large monetary offer for NOBUS backdoor from NSA.

            1. 13

              Or a large offer from a company wanting their brand and I.P. whose values are inconsistent with the CTO’s. I wasn’t able to eliminate that possibility. So, there’s a few options which include questionable acquisitions and spy agencies. There’s also the possibility that the CEO is just an egomaniac asshole or something. On occasion, I read about people destroying their own careers or businesses for personal reasons nobody can follow.

              1. 17

                The situation is also compatible with the CEO being in the right. We’re only hearing one side of this dispute, and it’s from someone who’s admitted not signing agreements to have the company own the work they’re paid for.

                I developed most of CopperheadOS on my own time, including before Copperhead existed as a corporation. I have no employment agreement or copyright agreement with Copperhead. I own a substantial portion of the code, possibly most. Copperhead has no license to use it commercially.

                From this, it even sounds like Copperhead Inc doesn’t have a license to sell phones running CopperheadOS, which I think is its primary source of income. That’s an untenable situation.

                It seems most likely to me this is a typical personality or priority conflict that implodes small businesses regularly; an outside actor like a business or the NSA is unneeded to explain this, especially given the unflattering way either has acted in public about this.

                1. 1

                  The not signing agreements is shady as hell. The CEO showed up on HN here, later deleting some comments. That link preserved them. So, that should give you an idea of how he presents himself in this situation. I agree personality conflict is a good, default assessment. Happens all the time.

                  1. 2

                    The CEO controls the IRC channel. The sentiment there is in support of the CEO. But he also seems to be banning anyone who supports Daniel and has now made the channel moderated.

                    1. 2

                      Are there archives of that?

            2. 7

              I read Micay to say that he has irretrievably deleted the signing keys. I’ve asked for him to be explicit; we’ll see if there’s a response.

              1. 12

                Yup:

                I purged my Android signing keys which were used to sign CopperheadOS releases including all three offline backups of them. It’s not possible to create app or OS updates that will be accepted anymore. No one else ever had access to my keys.

                I poked around in my settings and it doesn’t appear possible to trust a new OS key or release channel. Even if this business dispute is solved, every CopperheadOS user would need to reinstall the OS for updates.

                Edit: and more detailed on reddit:

                They’re the keys that I used to sign my releases to prove that they were from me. The OS will not install updates not signed with those keys, so it’s no longer possible to create an update or app the OS will accept as valid and install. James hijacked all of the infrastructure but his control over the update servers, etc. doesn’t mean he can ship updates to people so he’s not capable of compromising their privacy / security. I did my best to fulfill my obligation to keep people secure.

                No matter what happens with Copperhead, they would need to made the explicit choice to unlock and flash another OS with different signing keys. I blocked receiving automatic updates from a compromised company. This is how the Android update system is designed / intended to work but I never expected that something like this would happen…

                1. 2

                  I’m guessing you’re a CopperheadOS user?

                  1. 11

                    I am. I don’t know what I’ll migrate to or when. I appreciated the focus on security and privacy. I know the security community loves iPhones for the secure enclave and other features, but I strongly dislike their closed ecosystem, prohibition of GPL software, mandatory Apple accounts, limited tinkering, etc.

                    1. 7

                      but I strongly dislike their closed ecosystem, prohibition of GPL software, mandatory Apple accounts, limited tinkering, etc.

                      I’m still on Android for that reason. My solution was to just modify my usage to be consistent with the truth: “there is no secure smartphone”. I’m also hesitant to trust the future of anything in that space that isn’t FOSS for at least core with ownership and distribution controlled by a long-standing, trustworthy non-profit. I mean, about every one of the strongest offerings is controlled by untrustworthy companies, got acquired by them, or in this case became one. The secure, affordable mobile situation is consistently bad to the point that is should just be a loss leader, maintained for its criticality, and supported by revenue from other things.

                      1. 3

                        @pushcx Not particularly security-oriented, but I’d recommend LineageOS. If you like to go the Google-less route (as much as possible, at least) and not install GApps, the microG project is worth checking out. They even provide builds on https://lineage.microg.org, but you can compile your own as well (see lineageos4microg/docker-lineage-cicd).