Sailfish OS: Clarifying claims about open/closed source, security and privacy

General
1

Actually Jolla say that “Sailfish OS is partially open source, but not fully open source in the sense of “every part of the OS is free/open-source.”

After digging deeper and discussing I found GrapheneOS comments:

Jolla is a for-profit company misleading people about what they providing. Their OS has extraordinarily poor privacy and security compared to the Android Open Source Project or iOS. Their own OS code is mostly closed source and there isn’t an open source subset that’s usable. Jolla has spent years falsely claiming the Android Open Source Project isn’t Linux and misleading people into believing a largely closed source distribution is more open than an open source one.

They’ve mislead people about privacy and security to an extreme, convincing people that a device lacking a proper sandbox, permission model, exploit protections, widespread use of memory safe language and many modern security features is more private and secure. They have their own invasive services too.

Companies selling phony privacy products which do not provide basic privacy or security patches, do not have a modern privacy/security model and do not have modern exploit or privacy protections aren’t above being criticized due to portraying themselves as part of open source. They’ve put massive effort into misleading people about the Android Open Source Project and OSes

How secure my data will be using Jolla phones with SailfishOS?

4 Likes
2

Indeed, Sailfish OS is unfortunately not totally open-source. Most closed part are the UI, like the compositor (lipstick) the homescreen UI (lipstick-jolla-home), QML components (silica) and other apps still closed-source. Last weeks, Jolla started to open-source more and more components like the weather app, all components related to Netxcloud. Check their repository for more open-source components. I’m not sure there is a complete list of closed sourced components. Ther

For further information, I invite you to watch this presentation of Jolla by @abranson a Jolla employee: https://www.youtube.com/watch?v=OSNtmT_ITvc
The event was at the hackerspace FIXME in Lausanne, Switzerland.

11 Likes
3

At least part of the statements about security made is outdated or just untrue. There is a sandbox and permission model nowadays, and I have no idea what inversive services they might be talking about

13 Likes
4

Relating the security, Sailmates got a grant from NLnet to study various aspects of the OS. Check these pages for more information:

Edit: If you don’t have the time to read the audit, here is the conclusion.

Section 6 – Conclusion
Sailfish OS has encryption features, thanks to
its sailfish-secrets, to provide confidentiality and
integrity to it’s operating system. Although not
thoroughly tested by vulnerability researchers
the operating system has already built in
security methods that can prevent past
vulnerabilities that were discovered on other
operating systems.

12 Likes
5

I found this very old table from 2016 listing all closed-source components: SailfishOSS - Mer Wiki

There is a command listed in the upon link, here is an actualised list of proprietary components on Sailfish 5.0.0.72:

Package Version Licence
apkd8-l10n-all-translations 1.88.2 Proprietary
sailfish-content-graphics-default 1.4.2 Proprietary
jolla-settings-accounts-extensions 0.4.86 Proprietary
jolla-clock-all-translations-pack 0.8.2 Proprietary
ofono-modem-switcher-plugin 1.0.2 Proprietary
patterns-sailfish-consumer-generic 1.1.32 Proprietary
buteo-sync-plugins-sailfisheas 0.1.4 Proprietary
libjollasettingssailfishos 0.3.1 Proprietary
sailfish-content-ambiences-default-origami 1.0.14 Proprietary
jolla-keyboard-layout-western 0.9.10 Proprietary and BSD
jolla-settings-networking-plugin-vpn-vpnc 1.0.52.1 Proprietary
sailfish-content-ambiences-default-silent 1.0.14 Proprietary
apkd-plugin-mobiledata-qofono 1.1.0 Proprietary
jolla-settings-accounts-extensions-onlinesync 0.4.86 Proprietary
jolla-ca 0.11 Proprietary
sailfish-content-ambiences-default-glacial 1.0.14 Proprietary
transferengine-plugin-bluetooth 0.4.5 Proprietary
connman-configs-sailfish 0.11.17 Proprietary
store-client-common 1.4.0 Proprietary
harbour-dungeon 1.1.1 Proprietary
jolla-email-settings 1.1.50.1 Proprietary
apkd-plugin-permissions-sfos 1.3.0 Jolla Proprietary
patterns-sailfish-xt9 0.1.1 Proprietary
sailfish-devicelock-libs 1.2.0 Proprietary
libappsupportaudio 1.27.0 Jolla Proprietary
sailfish-tutorial-default-data 0.2.35 Proprietary
buteo-sync-plugin-nextcloud-images 1.0.12 Proprietary
sailfish-components-calendar-qt5 1.1.17 Proprietary
jolla-settings-system-brightness 1.2.50.2 Proprietary
jolla-settings-system-presence 1.2.50.2 Proprietary
jolla-startupwizard 0.6.5 Proprietary
qmf-notifications-plugin-all-translations-pack 0.8.2 Proprietary
sailfish-content-graphics-default-z1.75 1.4.2 Proprietary
jolla-email-all-translations-pack 0.8.2 Proprietary
sailfish-upgrade-ui-resources-logo-z1.75 0.1.18 Proprietary
sailfish-audiorecorder 0.1.10 Proprietary
jolla-xt9 0.5.22 Proprietary and Nuance
libsailfish-eas-common 0.6.11 Proprietary
mtp-vendor-configuration-sailfish 0.11.17 Proprietary
jolla-contacts 0.6.42 Proprietary
transferengine-plugin-core 0.4.5 Proprietary
sailfish-content-ambiences-default-community 1.0.14 Proprietary
sailfish-device-encryption-unlock-ui-resources-z1.75 0.11.13 Proprietary
patterns-sailfish-sdk-client-tools 1.1.32 Proprietary
jolla-settings-networking-plugin-vpn-l2tp 1.0.52.1 Proprietary
appsupportkeyboardservice 1.0.3 Jolla Proprietary
jolla-settings-networking-cellular 1.0.52.1 Proprietary
jolla-keyboard-layout-chinese 0.9.10 Proprietary and BSD
apkd8 11.0.0.151.1 Jolla Proprietary
sailfish-components-secrets-ui 0.1.9 Proprietary
sailfish-content-ambiences-default-default-ambience 1.0.14 Proprietary
libjollasignontrampolineservice-qt5 0.4.22 Proprietary
jolla-settings-accounts-extensions-twitter 0.4.86 Proprietary
jolla-settings-accounts-extensions-memotoo 0.4.86 Proprietary
patterns-sailfish-core 1.1.32 Proprietary
jolla-gallery 1.1.10 Proprietary
jolla-developer-mode-tools 0.6.23 Proprietary
jolla-settings-accounts 0.4.86 Proprietary
feature-alien 0.5.1 Proprietary
jolla-clock 1.1.26 Proprietary
jolla-gallery-extension-nextcloud 1.0.12 Proprietary
sailfish-components-telephony-qt5 0.2.8 Proprietary
jolla-settings-system 1.2.50.2 Proprietary
jolla-settings-system-location 1.2.50.2 Proprietary
jolla-calculator-all-translations-pack 0.8.2 Proprietary
ngfd-settings-sailfish 0.11.17 Proprietary
sailfish-content-graphics-closed 0.7.0 Proprietary
sailfish-content-profiled-settings-default 0.16.2 Proprietary
sailfish-office-all-translations-pack 0.8.2 Proprietary
libsailfishkeyprovider-data-jolla 0.1.0 Proprietary
sailfish-components-media-qt5 0.9.17 Proprietary
sailfish-components-store 0.0.14 Proprietary
jolla-settings-accounts-extensions-dropbox 0.4.86 Proprietary
sailfish-device-encryption-service 0.11.13 Proprietary
jolla-vault-units 1.1.46 Proprietary
jolla-gallery-ambience 0.2.41 Proprietary
jolla-messages-settings 1.1.74 Proprietary
jolla-messages 1.1.74 Proprietary
jolla-settings-networking-multisim 1.0.52.1 Proprietary
jolla-settings-accounts-extensions-jolla 0.4.86 Proprietary
sailfish-content-ambiences-default-airy 1.0.14 Proprietary
jolla-keyboard-layout-russian 0.9.10 Proprietary and BSD
apkd-plugin-wifi-connman 1.0.0 Proprietary
jolla-settings-networking-tethering 1.0.52.1 Proprietary
jolla-settings-accounts-extensions-onedrive 0.4.86 Proprietary
jolla-keyboard-hwr 0.9.10 Proprietary and BSD
apkd-plugin-launchers-fdo-ext 1.4.3 Jolla Proprietary
sailfish-policy 0.4.20 Proprietary
jolla-keyboard-layout-all 0.9.10 Proprietary and BSD
apkd8-android-settings 11.0.0.151.1 Jolla Proprietary
sailfish-homescreen-services-libs 0.1.10 Proprietary
jolla-settings-accounts-extensions-fruux 0.4.86 Proprietary
jolla-keyboard-settings-xt9 0.9.10 Proprietary and BSD
sailfish-components-timezone-qt5 0.2.5 Proprietary
jolla-email 1.1.50.1 Proprietary
csd 0.16.50 Proprietary
sailfish-account-nextcloud 1.0.12 Proprietary
patterns-sailfish-ui 1.1.32 Proprietary
eventsview-extensions-nextcloud 1.0.12 Proprietary
sailfish-account-nextcloud-features-all 1.0.12 Proprietary
jolla-notes-settings 1.0.25 Proprietary
jolla-calendar 1.1.17 Proprietary
sailfish-components-contacts-qt5 0.4.56 Proprietary
jolla-settings-system-nfc 1.2.50.2 Proprietary
jolla-camera-settings 1.2.30.3 Proprietary
sailfish-aml-data 1.0.5 Proprietary
patterns-sailfish-customer-content-default 1.1.32 Proprietary
sailfish-audiorecorder-l10n-all-translations 1.25.2 Proprietary
lipstick-jolla-home-qt5 1.26.66.1 Proprietary
all-translations-pack 0.8.2 Proprietary
jolla-calculator 1.0.11 Proprietary
jolla-xt9-cp 0.2.15 Proprietary and Nuance
qmf-eas-plugin-all-translations-pack 0.8.2 Proprietary
qmf-eas-plugin 0.4.6 Proprietary
jolla-settings-layout 1.2.0 Proprietary
sailfish-components-pickers-qt5 1.0.29 Proprietary
jolla-settings-accounts-extensions-email-crypto 0.4.86 Proprietary
sailfish-device-encryption-unlock-ui 0.11.13 Proprietary
sailfish-upgrade-ui 0.1.18 Proprietary
sailfish-content-ambiences-default-salamander 1.0.14 Proprietary
apkd-sharing-sfos 1.4.3 Jolla Proprietary
jolla-settings-networking-plugin-vpn-openvpn 1.0.52.1 Proprietary
sailfish-content-ambiences-default-rolling 1.0.14 Proprietary
sailfish-secrets-ui 0.1.9 Proprietary
sailfish-content-ambiences-default 1.0.14 Proprietary
jolla-notes-all-translations-pack 0.8.2 Proprietary
jolla-gallery-extensions-onedrive 0.2.17 Proprietary
store-client 1.4.0 Proprietary
ofono-vendor-qti-radio-plugin 1.0.3 Proprietary
appsupportaudio 1.35.0 Jolla Proprietary
feature-sailfish-eas 0.1.1 Proprietary
jolla-settings-system-about-product-license-jolla 1.2.50.2 Proprietary
patterns-sailfish-core-device 1.1.32 Proprietary
jolla-settings-homescreen 1.2.50.2 Proprietary
jolla-mediaplayer-all-translations-pack 0.8.2 Proprietary
patterns-sailfish-cellular-apps 1.1.32 Proprietary
sailfish-wayland-libs 0.1.4 Proprietary
sailfish-silica-background-qt5 0.9.16 Proprietary
sailfish-content-tones-default 0.16.2 Proprietary
sailfish-archive 0.1.2 Proprietary
sailfish-components-gallery-qt5 1.2.23 Proprietary
jolla-alarm-ui-all-translations-pack 0.8.2 Proprietary
libsailfish-eas 0.6.11 Proprietary
sailfish-content-browser-default 0.1.7 Proprietary
jolla-contacts-settings 0.6.42 Proprietary
jolla-settings-accounts-extensions-email 0.4.86 Proprietary
jolla-actdead-charging 0.13.13 Proprietary
sailfish-content-ambiences-default-about 1.0.14 Proprietary
qmf-oauth2-plugin 0.1.0 Proprietary
systemd-config-sailfish 0.11.17 Proprietary
sailfish-installationhandler 1.0.14 Proprietary
sailfish-content-ambiences-default-work 1.0.14 Proprietary
jolla-settings-networking 1.0.52.1 Proprietary
harbour-apk-org.fdroid.fdroid 1.20.0 Proprietary
jolla-settings-networking-plugin-vpn-openfortivpn 1.0.52.1 Proprietary
jolla-settings-networking-vpn 1.0.52.1 Proprietary
jolla-keyboard-layout-kazakh 0.9.10 Proprietary and BSD
apkd-plugin-notifications-fdo-ext 1.0.8 Jolla Proprietary
sailfish-content-ambiences-default-sailfish3 1.0.14 Proprietary
jolla-xt9-server 0.5.22 Proprietary and Nuance
aliendalvik 2.3.0 Proprietary
sailfish-content-ambiences-default-sailing 1.0.14 Proprietary
jolla-vault 1.1.46 Proprietary
sailfish-device-encryption 0.11.13 Proprietary
jolla-developer-mode-profile 0.6.23 Proprietary
jolla-settings-sailfishos 0.3.1 Proprietary
jolla-gallery-extensions-dropbox 0.2.17 Proprietary
jolla-email-crypto-gnupg 1.1.50.1 Proprietary
feature-xt9 0.1.1 Proprietary
apkd-plugin-geo-qtpositioning 1.0.1 Jolla Proprietary
sailfish-fpd-slave-binder 1.5.6 Proprietary
appsupportaudio-plugin-pulseaudio 1.26.1 Jolla Proprietary
jolla-settings-system-about-eula-sailfish 1.2.50.2 Proprietary
obexd-contentfilter-helper 0.0.2 Proprietary
eventsview-extensions 0.1.11 Proprietary
buteo-sync-plugin-nextcloud-posts 1.0.12 Proprietary
jolla-camera 1.2.30.3 Proprietary
jolla-settings-system-orientation 1.2.50.2 Proprietary
jolla-settings-system-developermode 1.2.50.2 Proprietary
sailfish-content-graphics-closed-z1.75 0.7.0 Proprietary
obexd-calldata-provider 0.1.5 Proprietary
lipstick-jolla-home-qt5-components 1.26.66.1 Proprietary
sailfish-utilities-all-translations-pack 0.8.2 Proprietary
jolla-handwriting 0.1.7 Proprietary and Nuance
jolla-common-configurations 0.11.17 Proprietary
sailfish-content-ambiences-default-flow 1.0.14 Proprietary
appsupport-config-generator 1.13.1 Proprietary
aliendalvik-configs 11.0.183 Proprietary
sailfish-version-variant 5.0.0 Proprietary
jolla-developer-mode-preload 0.6.23 Proprietary
sailfish-content-apps-default-configs 0.11.17 Proprietary
os-update-service 1.4.0 Proprietary
sailfish-devicelock-fpd 1.2.0 Proprietary
sailfish-fpd 1.5.6 Proprietary
ambienced 0.29.37 Proprietary
sailfish-tutorial-default 0.2.35 Proprietary
jolla-calendar-all-translations-pack 0.8.2 Proprietary
libjollasignonuiservice-qt5 0.4.22 Proprietary
sailfish-upgrade-ui-resources-z1.75 0.1.18 Proprietary
jolla-settings-accounts-extensions-jabber 0.4.86 Proprietary
jolla-keyboard 0.9.10 Proprietary and BSD
jolla-settings-networking-plugin-vpn-openconnect 1.0.52.1 Proprietary
sailfish-content-ambiences-default-favorites 1.0.14 Proprietary
libapkd 1.22.0 Jolla Proprietary
jolla-keyboard-layout-indian 0.9.10 Proprietary and BSD
appsupport-configs-user 11.0.183 Proprietary
sailfish-aml 1.0.5 Proprietary
jolla-mediaplayer 1.3.19 Proprietary
jolla-settings-bluetooth 0.2.19 Proprietary
sailfish-version 5.0.0 Proprietary
jolla-settings-accounts-extensions-3rd-party-all 0.4.86 Proprietary
jolla-developer-mode 0.6.23 Proprietary
sailfish-content-vpn-default 0.0.1 Proprietary
sailfish-ca 0.2 Proprietary
patterns-sailfish-mw 1.1.32 Proprietary
transferengine-plugin-nextcloud 1.0.12 Proprietary
appsupportaudio-plugin-sailfish 1.7.0 Jolla Proprietary
jolla-alarm-ui 0.2.24 Proprietary
sailfishsilica-qt5 1.2.145 Proprietary
jolla-ambient-sound-theme 0.1.0 Proprietary
jolla-settings-system-flashlight 1.2.50.2 Proprietary
sailfish-homescreen-services 0.1.10 Proprietary
libjollamediaplayer 1.3.19 Proprietary
sailfish-components-textlinking 0.1.6 Proprietary
sailfish-settings-networking-vpn 1.0.52.1 Proprietary
patterns-sailfish-applications 1.1.32 Proprietary
sailfish-eas 0.6.11 Proprietary
jolla-settings 1.2.0 Proprietary
jolla-settings-accounts-extensions-google 0.4.86 Proprietary
libjollasignonuiservice-qt5-plugin 0.4.22 Proprietary
sailfish-settings-networking 1.0.52.1 Proprietary
apkd-plugin-display-mce 1.0.0 Seafarix Proprietary
jolla-settings-networking-plugin-vpn-pptp 1.0.52.1 Proprietary
jolla-keyboard-layout-tatar 0.9.10 Proprietary and BSD
apkd-plugin-media-mpris 1.0.4 Jolla Proprietary
sailfish-device-encryption-settings 0.11.13 Proprietary
sailfish-components-bluetooth-qt5 0.2.31 Proprietary
sailfish-content-ambiences-default-party 1.0.14 Proprietary
sailfish-mdm 0.4.23 Proprietary
jolla-settings-accounts-extensions-yahoo 0.4.86 Proprietary
sailfish-content-gallery-default 0.32.0 Proprietary
jolla-gallery-extensions 0.2.17 Proprietary
appsupport11-system-unprivileged 11.0.0.76.55 Proprietary
ssu-vendor-data-jolla 1.1.3 Proprietary
jolla-settings-system-about-product-trademark-jolla 1.2.50.2 Proprietary
transferengine-plugins 0.4.5 Proprietary
buteo-sync-plugin-nextcloud-backup 1.0.12 Proprietary
jolla-notes 1.0.25 Proprietary
eventsview-extensions-twitter-posts 0.1.11 Proprietary
voicecall-ui-jolla 1.16.1 Proprietary
jolla-settings-system-sideloading 1.2.50.2 Proprietary
jolla-camera-lockscreen 1.2.30.3 Proprietary
patterns-sailfish-app-blacklist 1.1.32 Proprietary
5 Likes
6

In addition to what has been said, please back up your claim that about someone

“mislead people about privacy and security to an extreme”.

This is, like almost all of that quote, is an opinion which is not backed up by arguments.
I know it’s not your claim, but you repeat it here, again without context or arguments.

claiming the Android Open Source Project isn’t Linux

What a load of bullshit. Again, sources please.

10 Likes
7

open source

privacy

security

How secure my data will be using Jolla phones with SailfishOS?

These are largely separate topics, one does neither go with, nor necessarily depend on the other.

Open Source guarantees neither security nor privacy.

One thing is true: there can be no privacy without security.

6 Likes
8

“This is the first time Zilvinas has posted — let’s welcome them to our community!”

Well with this kind of a post you are not getting a warm welcome :slight_smile:
Please provide sources and links and evidence for your text …

The tone and your massive generalisation could use an improvement

3 Likes
9

Nice to see that the new phone has generated such a response that someone feel the need to write out such a toxic and FUD laden tirade. Must be doing something right.

Btw, lipstick is open source. It’s the homescreen UI on top that’s closed (lipstick-jolla-home)

19 Likes
10

It sounds like it comes from this thread: sailfish OS - GrapheneOS Discussion Forum

3 Likes
11

The graphene guys like to smear other distros/OSs to make themselves look better. I decided to stay away from their OS due to the incessant drama going on around it.

16 Likes
12
  1. First they ignore you.
  2. Then they laugh at you.
  3. Then they attack you. :left_arrow: we are here
  4. Then you win.

:smiling_face_with_sunglasses:

22 Likes
13

Well, there is also some truth in it. Some flaws exists, we should not be blind about them. For instance one attack vector - all Sony phones with SFOS do not have a verified boot process (unlocked bootloader). Also, the encryption layer does not use LUKS2 with PBKDF2 iirc.

6 Likes
15

Zilvinas, who doesn’t know much about SailfishOS, had read these lines from the Graphene guys. He asks whether it is true. No need to attack him and demand him to reveal his sources. It was a question. Rather give him an answer.

14 Likes
16

I believe it is not me who has to refute (IMO largely baseless) claims, it it up to the one making them to support them with arguments and facts/sources.

I also do not believe it counts as an “attack” to say so.

3 Likes
17

People from GrapheneOS reacted to me on Bluesky several times after I posted something about alternatives to G and A. They quite aggressively try to turn you towards their view. Once they were stalking so I had to mute one of them. Their focus is privacy and there they shine with sandboxed apps. Yet Graphene is not an independent OS like Sailfish because it is entirely based on Android. Graphene exclusively makes use of Google Pixel devices because of certain chips in these devices. These devices are not conform the new European rules for sustainability: everything in it is glued.
The discussion about Android being linux is not relevant. Android is often called linux too but linux is a family tree. Since Google Almighty bought Android in 2005 it is part of the duopoly. Personally I find Android boring and not intuitive and sometimes even confusing. It’s not elegant either.
Open source in Sailfish is a mixed bag. I would like to see more sandboxing in apps, but I don’t know if this is possible. Until now we trusted Jolla and the developers. Yet, when the company grows more guarantees will be needed. Some of the linux adepts say linux always has to be open source. Others are more tolerant. It depends on how dogmatic you are. Jolla’s Sailfish is based on a license. This is Jolla’s ‘crown jewel’. A kind of copyright. GrapheneOS seems to be jealous but it is a fact that you never can be a serious alternative without creating your own OS and that is what Jolla did: Sailfish is different.

18 Likes
18

Hello Zilvinas,

A few days ago GrapheneOS reacted on me again. They want to lure you in a discussion about privacy and about open source. Subjects where they have strong opinions on. Yet being based on Google is not an advantage and Graphene was not able to create their own OS and their own devices. It’s obvious that they fear competition.

8 Likes
19

In case of graphene they go against each other (see their main dev promoting play store over fdroid), since they rely on google so much (hw, drivers, signing…) privacy took the backseat (they somehow advertise gapps sandboxing as a privacy feature, as meta has real problems linking your sandboxed fb/insta/whatsapp accounts), we’ll see what happens now that they will rely on an 3rd party oem, might be a funny Sony Open Devices like fiasco

2 Likes
20

It will be pretty secure, sfos has all the standard features like home partition encryption and sandboxing (sailjail), it’s not going crazy overboard though to treat enduser as an attack vector, you can get full root through a checkbox in settings, the OS is aimed at tinkerers, linux enthusiasts etc, the extra safety comes from being a niche linux phone using libhybris that breaks 99% of android malware, exploits aimed at aosp won’t work, the lxc container will take a sh*t in most cases as emulation adds an extra layer, you’d need to target sfos+appsupport specifically and with few K users it’s just not feasible (if russians bought appsupport that would be a totally different story, now you have a valuable target etc)

10 Likes
21

@emva I’ve putted it to quote because it’s not mine thoughts and in this case I don’t have backed up arguments. I took it from Graphenes Mastodon post and came here with question to hear another opinion, facts, trooth - not attacking and bulling.
Thanks @rhampf for understanding and support.

P.S. I don’t use GrapheneOS myself
P.S.S. made a pre-oder for new Jolla phone

16 Likes