There aren't a lot of recent devices supported.

That's alright though. Recent devices still have manufacturer's support. LOS is a godsend for the older devices, often not as powerful as the new ones, that really need the lightweight, bloat free Android for smooth operation.

Yes, but note that very old devices will need mainline kernel support before newer AOSP/LineageOS releases can be ported to them. (Of course, this is also desirable as a way of supporting non-AOSP mobile Linux releases there, which are by far the most exciting development in the custom modding scene.) Old downstream kernels don't cut it any more.

Yeah, I kinda want to install on my LG V60, which no longer gets updates. But it breaks the dual screen on the phone, which is one of the unique features about this phone.

Why is this?

Takes time to bring up devices, LOS is a volunteer project, and manufacturers don’t send them devices like they used to. Finally, no matter what they rely on the manufacturers releasing kernel source for a release and some take months and ship squashed and/or incomplete source. Availability of bootloader unlocking is a factor but what I just said is the bigger reason for the delay.

Most modern manufacturers disallow unlocking the bootloader and flashing unsigned firmware, which is a requirement for this kind of thing.

LineageOS isn't unsigned, it just happens to be signed by keys that are not "trusted" (i.e., allowed - thanks for the correction!) by the phone's bootloaders.

not allowed is a clearer language here.

thats effectively the same thing.

The whole point of the majority of PKI (including secureboot) is that some third party agrees that the signature is valid; without that even though its “technically signed” it may as well not be.

I disagree. If LineageOS builds were actually unsigned, I would have no way of verifying that release N was signed by the same private-key-bearing entity that signed release N-1, which I happen to have installed. It could be construed as the effective difference between a Trust On First Use (TOFU) vs. a Certificate Authority (CA) style ecosystem. I hope you can agree that TOFU is worth MUCH more than having no assurance about (continued) authorship at all.

If the owner of a device can't sign and install their own software, then your definition of PKI doesn't "work" at all.

The first party must be able to entirely decide that "some third party" for it to be anything more than an obfuscation of digital serfdom.

The difference between “PKI” and “just signing with a private key” is the trusted authority infrastructure. Without that you still get the benefit of signatures and some degree of verification, you can still validate what you install.

But in reality this trustworthiness check is handed over by the manufacturer to an infrastructure made up of these trusted parties in the owner’s name, and there’s nothing the owner can do about it. The owner may be able to validate software is signed with the expected key but still not be able to use it because the device wants PKI validation, not owner validation.

I’ve been self-signing stuff in my home and homelab for decades. Everything works just the same technically but step outside and my trustworthiness is 0 for everyone else who relies on PKI.

Did I misunderstand or HN is much stupider than I thought?

My definition of PKI is the one we’re using for TLS, some random array of “trusted” third parties can issue keys that are then validated against.

If you’re not in that list then signing can be valuable for other reasons, but PKI is not among them any longer as theres no distinction between self-signed and a semi-trusted entity: things will break.

If you expect your website to work with keys issued from your internal company CA; you would be surprised to find that random browsers distributed on the internet wouldn't trust it.

Wow, shocker.

> My definition of PKI is the one we’re using for TLS, some random array of “trusted” third parties can issue keys

Maybe read the actual definition before assuming you're so much smarter than "HN". One doesn't need third parties to have pki, it's a concept, you can roll out your own

“read the actual definition”;stellar contribution there, mate. I checked and sure enough its exactly in line with my comments.

I’ve been discussing the practical implementation of PKI as it exists in the real world, specifically in the context of bootloader verification and TLS certificate validation. You know, the actual systems people use every day.

But please, do enlighten me with whatever Wikipedia definition you’ve just skimmed that you think contradicts anything I’ve said. Because here’s the thing: whether you want to pedantically define PKI as “any infrastructure involving public keys” or specifically as “a hierarchical trust model with certificate authorities,” my point stands completely unchanged.

In the context that spawned this entire thread, LineageOS and bootloader signature verification, there is a chain of trust, there are designated trusted authorities, and signatures outside that chain are rejected. That’s PKI. That’s how it works. That’s what I described.

If your objection is that I should have been more precise about distinguishing between “Web PKI” and “PKI generally,” then congratulations on missing the forest for the trees whilst simultaneously contributing absolutely nothing of substance to the discussion.

But sure, I’m the one who needs to read definitions. Perhaps you’d care to actually articulate which part of my explanation was functionally incorrect for the use case being discussed, rather than posting a single snarky sentence that says precisely nothing?

EDIT: your edit is much more nuanced but still misses the point; https://imgur.com/a/n2VwltC

The snarky tone and sarcasm are not helping your case in this thread.

Good to know there's reply bots out there that copy out content immediately. I rarely run into edit conflicts (where someone reads before I add in another thing) but it happens, maybe this is why. Sorry for that

Besides the "what does pki mean" discussion, as for who "misses the point" here, consider that both sides in a discussion have a chance at having missed the original point of a reply (it's not always only about how the world is / what the signing keys are, but how the world should be / whose keys should control a device). But the previous post was already in such a tone that it really doesn't matter who's right, it's not a discussion worth having anymore

Or its collective ignorance, can’t be sure.

Public key infrastructure without CAs isn’t a thing as far as I can see, I’m willing to be proven wrong, but I thought the I in PKI was all about the CA system.

We have PGP, but that's not PKI, thats peer-based public key cryptography.

I don't know what's going on in this thread. Of course PKI needs some root of trust. That root HAS to be predefined. What do people think all the browsers are doing?

Lineage is signed, sure. It needs to be blessed with that root for it to work on that device.

Because it is more profitable for smartphone makers if you need to buy a new one.

Unless there's legislation to force them to allow enrolling new keys or otherwise disabling secure boot, the abuse will continue.

This is true; there is additionally a valid argument that there is security benefit to locking down the bootloader. I don’t like locked down bootloaders, but I get the argument.

Third party roms also do not include all the bloatware and spyware they are loading into the phone, they aren't a fan of losing control.

>Somehow 90% of these posts don't actually link to the amazing projects that their author is supposedly building with AI.

Maybe they don't feel like sharing yet another half working Javascript Sudoku Solver or yet another half working AI tool no one will ever use?

Probably they feel amazed about what they accomplished but they feel the public won't feel the same.

If you use Cursor or Claude, you have to oversee it and steer it so it gets very close to what you want to achieve.

If you delegate these tasks to OpenClaw, I am not really sure the result is exactly what you want to achieve and it works like you want it to.

For me is not interesting because it fits in 512 bytes, it's interesting because it's very simple. I think it would be a great introduction to learning about compilers.

I got a Mac only because of the excellent battery life. But I dread Os X. Not only it is dumbed down and it is harder to accomplish what is trivial in other operating system, but I have to actively fight against it if I want to run software that is not downloaded from the app store or I want to open files with apps I downloaded from elsewhere. And the UI is broken.

You can do that if it is still legal.

AI didn't know we are not interested in 20 year old fires.

If people don't find their preferred language on top, they will claim the benchmark is flawed. They will find a condition that is not satisfied by the benchmark. But if we operate outside of the benchmarks assumptions, all benchmarks are flawed since they cannot satisfy all possible conditions.