Hacker News new | past | comments | ask | show | jobs | submit login
Librem 5 USA Smartphone Provides Many Exclusive Security Features (puri.sm)
81 points by fsflover on May 10, 2023 | hide | past | favorite | 115 comments



I finally got my refund from these people. The solution was stop being nice and threaten to sue. Years and years (since 2017) of bullshitting me about "processing queues" with no answer as to when if ever I'd see a refund was solved in two weeks after I talked about filing paperwork with the state.

Purism has burned me too many times for me to advocate for them and it's a shame because we really need a better mobile hardware and software ecosystem.


I ordered early on, it took a long time, but I got the phone and I was satisfied. It wasn't an iphone. But I could hook it to a keyboard and mouse.

I later got a pine but it wasn't as good, sluggish. don't know about the pinephone pro.


You're comparing a $1300 phone versus a $150 phone. I'd like to see a more recent Librem 5 video review, because in the past it used to be sluggish as well. Whereas PinePhone doesn't pretend to be anything else than an Linux ARM phone for developers of that platform.

I personally considered the PinePhone at some point to hack on, and UBPorts looked rather fluid on it from video reviews I've looked at the time.


I'm not sure what $1300 refers to?

I think I paid $599 for the librem 5 (2017), and $299 for the pinephone. Neither had the fit and finish of an iphone, even the iphone se.


The Librem 5 (non USA) is $1300[0] today with an advertised 52 week lead time.

The $599 price point you paid does not exist today and buying a PinePhone usually nets you a phone inside of a couple weeks where your Librem 5 probably arrived on the scale of years. It's quite the tenuous comparison.

0: https://shop.puri.sm/shop/librem-5/


The interface on Librem 5 is quite smooth. Also, it can be smooth on Pinephone, if you use a light OS like SXMo.


Is being assembled in the USA a positive thing for security? The USA is the only country I'm aware of for which there's publicly visible evidence of sabotage committed by the state [0].

Wouldn't it be better to be assembled in a friendly country with a better track record? Maybe somewhere in Europe?

[0]: https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa...


It depends on your threat model. They say China is also spying on everyone they can. Also, it's not just made in USA: it's made on Purism's own factory, so they can ensure that nobody else can tamper with it.


I thought that I read (not too long after the snowden stuff) that the US government sometimes intercepts parcels of electronic equipment then will tamper with it so that they can spy on the recipient of the equipment. Not sure how librem can prevent that or how one would know. Also, if somebody places an order and US government asks librem to place some spyware on it via a court order (because say that have a phone tap on the individual), would any customers know about it? Now if one can go the factory and pick up it, then that cuts one avenue of attack by the government.


Purism has thought of this and offers an "anti-interdiction" service to counter it [0]. This includes tamper evident seals and glitter paint on the screws (for laptops).

[0] https://puri.sm/posts/anti-interdiction-services/


Thank you; good to know that they have that. My assumption would still be that if the intelligence services want access to your private information or communication on the device that they will get it (without it be evident); whether it is a OS zero day or other means. I also read through the link you provided on the anti-interdiction server, it only says laptop. I assume that this has expanded to the phone. (Did not go through the phone order process to find out.) Also, looks like one negotiates via PGP email on what one wants; so that is why I assume that there is no pricing on it.


You can do anti-interdiction for phones as well. It costs $199 at checkout.


It's a bullshit claim that only buries the sensible ones; but it's a popular one, so they probably figured it would help the sales pitch.


Looks promising. I'd like to be able to switch, but I'm not sure it's practical.

Is there anyone here who has used or is using the Librem 5 smartphone? I have a few questions about it:

* How is the the mobile version of PureOS? Do you like it?

* How responsive are apps on the phone? Do they feel snappy?

* Are you able to sync your email and calendar on either Google Apps or Outlook for offline access?


> How is the the mobile version of PureOS? Do you like it?

Personally I like it. Phosh is pretty and snappy.

> How responsive are apps on the phone? Do they feel snappy?

Reasonable by Linux phone standards. Sometimes an app can take 2 or 3 secondds to load, but it shows a splash screen instantly so it still feels like its working. A mobile CSS firefox tweak (preinstalled) makes it work and it is very responsive and snappy.

> Are you able to sync your email and calendar on either Google Apps or Outlook for offline access?

Yes. Well Imap email works and CalDav calendars. I think Google calendars work. I use a generic Imap email provider and Nextcloud for contacts / email.

But the battery life is abysmal. I got between 4 and 8 hours battery life. Apparently suspend is now working so that should be fixed. The camera app wwas awful (but that is now fixed).

But the biggest problem was that the modem constantly dropped out meaning I would miss calls and messages makimg the phone useless.

I now use a OnePlus 6 with postmarketOS and I haven't looked back.


> But the biggest problem was that the modem constantly dropped out meaning I would miss calls and messages makimg the phone useless.

Also fixed now. Fun fact: it turned out to be a deficiency of USB 2.0 spec (race condition between a suspending hub and a device signaling remote wakeup) and it's in no way specific to the phone - it may happen on any USB host with similar topology.


Good to hear! I'll break mine out and try it again.


Is the OnePlus 6 a phone someone could buy today or is it an older phone you’d have to buy used?


The OnePlus 6 is no longer maunfactured. However there are a great many in existence that can be purchased.


Probably from eBay and the like though? I can’t go somewhere and buy a dozen of these, new in box?


Personally I recommend buying pre-owned eleectronics on Swappa, a marketplace for lightly-used, non-junk electronics.


The OS feels just like desktop Ubuntu or something, but has a few tweaks to work better with a touchscreen. It's quite usable. I haven't dug much into customization because I don't feel like I need to, and that's awesome.

Apps are fine, performance feels more than adequate. It's not Android so most of the apps I'm used to aren't available, but the ones that do exist are snappy enough. That's kinda the point, though, so that's not a complaint, just an observation.

I haven't poked at either of those emails, sorry. Regular POP/IMAP email works just like you'd expect.

My main complaint is battery life. It gets warm just sitting there, and it charges really slowly even using my best PD-compliant charger. If I forget to plug it in tonight, it'll be dead by morning, and I can't put enough charge back into it briefly during breakfast for it to be useful tomorrow daytime. As long as I'm fanatical about making sure it's plugged in every night, it's fine.


I never did get my hands on a Librem despite preordering it and waiting, but I have a PinePhone from Pine64. It can use the same Phosh launcher UI used in Librem's PureOS (depends on which OS you have installed). Phosh is nice enough, though some of the UI decisions do feel a bit weird.

The Pinephone (not pro) I got was slow and the software was very alpha, but I've heard it's better now. Again, not sure about the Librem as I got stuck in the queue and gave up eventually. I heard there were Librem5 overheating issues and I'm not sure if that's been adequately addressed.

Phosh on the Pinephone definitely wasn't snappy. Maybe it will be snappier with Pro and a new update since I haven't tried it out again in years. I never got around to syncing things too much, but there are definitely email clients on Linux that'll work though how "mobile" their UI is, I'm not sure. Purism created libhandy[0] that's now managed my GNOME to mobilify these things and again I'm not sure about the status, but I'm sure Email was a high priority.

[0]: https://gitlab.gnome.org/GNOME/libhandy


> I heard there were Librem5 overheating issues and I'm not sure if that's been adequately addressed.

I have no troubles with overheating on my phone, I can even compile things on it. Some people living in warmer climates report that it may be challenging to charge the phone when it's on as it has a thermal threshold where it stops charging. Should get better with system suspend, which was very experimental until now (still not enabled by default, but it got reliable enough to actually use it on a daily driver).

When it comes to perceived performance, Librem 5 is definitely closer to PinePhone Pro than the original PinePhone, which was very slow.


> people living in warmer climates report that it may be challenging to charge the phone

This phone is being sold for $1300 and whether you can charge it consistently depends on your latitude and experimental software.

> Librem 5 is definitely closer to PinePhone Pro

The PinePhone Pro is $399 and I can have it next week. I could buy three PinePhone Pros and wear them out a year before one Librem 5 with difficulty charging ships.


Do it then. But don't come back crying that you had to do some kernel hacking in order to make it usable, that's a part of the deal at this price ;)


yes, daily driving for 2 years now.

* it's good. works well, apps reflow nicely, can run a lot of stuff simultaneously without memory issues. There is a nasty kernel bug relating to suspend and the wwan modem, but that's not pureos specific.

* depending on the app, ranging from snappy to so-so. Especially flatpaks tend to stutter...

* I don't use those services but it should be possible via gnome-accounts. I do sync a caldav and carddav and that works flawlessly.

written from librewolf on my librem5


Thanks!

I may run a test this summer to see how it goes.


Battery life?


Not great. With suspend enabled and if I don't use it much, about 8 hours to 0%. If I leave it on (i.e. disable suspend), about 3 hours.

I'm honestly almost always near a charger, which I also realize is just a cope.


This is not normal for this phone. I think you should ask for help on the forums or by email. Examples:

https://forums.puri.sm/t/modem-draining-the-battery-very-fas...

https://forums.puri.sm/t/current-l5-idle-battery-life/14772


You're probably right, and battery life varies a bit day-to-day. I haven't done a formal test to double check my statements above, more just a feeling.

I've had the phone for a while and the battery has gone through many cycles. It has definitely lost some capacity.


When you say suspend, what does that look like in terms of receiving a phone call or SMS?


The modem asserts a wake pin when you receive an SMS or phone call, causing the SoC to wake up. Services that rely on data (IM, e-mail etc.) don't wake the phone up (they will rely on periodic wakeups in the future, but there's no infrastructure for it yet).

An update that makes communication with the modem after resuming from system suspend reliable has been deployed today (previously it would often fully reenumerate and cause various troubles in the process, now it's instant).


OMG I got this update and modem resume has been flawless since!!!

Thanks for your hard work to get this fixed!



Those forum posts are from more than a year ago, a lot has improved since.


About 12 hours without suspend. Its still experimental, but very close: https://source.puri.sm/Librem5/community-wiki/-/wikis/Freque....


When did the battery life suddenly get 3-4 times better?


It didn't jump up suddenly; there were many software improvements in regard to battery life deployed through the years which together sum up to a pretty significant change.


It's explained in my above link.


It’s not obvious what terms like Evergreen mean?


Evergreen is the latest hardware revision: https://source.puri.sm/Librem5/community-wiki/-/wikis/Freque...


There's not much difference in battery usage between hardware batches, the improvements were mostly in software. The battery capacity has changed though - the earliest batches that some early backers opted to receive had a 2000mAh battery, while later ones had 3600mAh one. The mass produced version ended up with 4500mAh.

The early batches shipped with early software, and that was actually the biggest contributor to bad battery life and (now long solved) overheating issues.


Okay so some people don’t even have the latest hardware revision so they’re stuck with a phone that will never support suspending and will have terrible battery life forever?


No? Where did you even get this idea from?

Early backers who explicitly opted in to receive early batches from before mass production have smaller capacity batteries, and that's about it.


Can those users buy a new battery that’s a higher capacity?


No, the new batteries don't fit. Those specific people knew what they opted in for though. Everyone who didn't received the final version.


So there are people out there with a phone with a 1-2 hour battery life? Ouch.


2 hours of active use, or about 10 hours in suspend.

Not sure what's so "ouch" about it. People also bought devkits which didn't come with any battery at all. Only some people were presented with the opportunity to receive a phone from the earliest revisions and only some of those people chose to - presumably those who cared more about getting a platform to hack on as early as possible than things like battery life.


It’s an unacceptable amount of time for a phone. Devkit is one thing, but if you’re buying a phone you should expect more than few hours of usage.


You're completely out of touch. If you're explicitly choosing to receive an early pre-mass production batch with unfinished battery, you already know what you expect.


Have any non-early phones shipped yet? Where are the all-day battery versions of these phones?

It sounds like they’re still not ready.


They've been shipping for two years now.


And yet people in this thread are talking about garbage battery life, phones not showing up, etc?


So maybe read what they're writing more carefully, you've already got all the answers here.

The mass produced phones that started shipping mid-2021 have 4500mAh battery and, with current software, reach about 20h in suspend with modem on and connected. Due to component shortages and other delays it's still shipping through backorders, although the queue is near its end right now.


Not everyone is saying that though. People are saying the battery life is atrocious and this phone is now $1300?


I get about 3-4 hours of active usage (like Web browsing), about 8-12 hours of idle time and about 20-22 hours of suspended time. More with modem off, but then it's not exactly a phone:)


> Looks promising.

Purism has a long history of making grand promises and not delivering them.

They make sketchy things like promising a possibility to refund and then gaslighting customers that such promise did not happen.


Purism attempts to join the fediverse, refuses to moderate their instance, attracts some of the worst people they could, gets defederated by mostly everyone and eventually gives up all in a span of a few weeks to turn into spambot paradise is a very nice miniature version of the company's operating scheme.

(For clarity: It still runs, but Mastodon from 2019.)


Librem Social is moderated and has a CoC: https://librem.one/conduct/

It wasn't initially as the idea was to disable things like direct messages and rely on blocking (IIRC some blocking features were even improved upstream as part of the Librem One project), but that was quickly scrapped as it's not something that works with federation very well.


If you care, why haven't you patched in 4 years?

https://social.librem.one/nodeinfo/2.0


At least they've shipped devices resembling phones to some people. I've even held and used one, they exist and kind of function.

If they hadn't managed that, they would be indistinguishable from a LARP preying on FOSS enthusiasts' hopium and dollars in the phone context.


Librem 5 - Lead Time: 52 Weeks

Sounds like vaporware more than anything...


They do ship continuously, but its pretty slow. The ones who received there Librem 5's in the last days waited some 1270 days (180 weeks).

Have a look at https://forums.puri.sm/t/estimate-your-librem-5-shipping/112... that's a better prediction then Purism's 52 weeks...


3.5 years average wait time is pretty damn bad for a device that has a life span of not much more than 3.5 years.

I'd love to try one of their phones, but I can't convince myself to pull the trigger at the price/performance/delay triangle they've settled into.


Seeing the celebration from folks on receiving the items they paid for 1200+ days later was uhh, an experience.


> They do ship continuously, but its pretty slow.

This is what you get for "Assembled in the USA."


No. The ones that have a 1200 day lead time are the normal ones made in China. The "assembled in the USA" ones have a 10-day lead time (and a $2000 price tag).


I ordered mine back in August of 2019, and just received it a couple of weeks ago. I ordered it back when it was $699 and when I had regular cellphone service. Now instead of cellphone service I use jmp.chat (voice and SMS over XMPP). I never expect there to be an XMPP client that supports all the extensions needed for me to have phone service and to also not murder the battery life. So it'll sit around and be a curiosity like my PinePhone. The usability gap between my GrapheneOS Pixel 6 and either of those phones is just too wide to bridge right now and for the foreseeable future.


It's still shipping through backorders as it caught many delays across development and production (including the whole COVID supply chain disruption), but it's pretty close to the finish line now. Once the backorders are fulfilled, it will be available in stock with no lead time (the version produced in USA already is).


With several-year-old hardware designs? Who is actually interested in this thing?


The SoC that was initially supposed to be used was older when the crowdfunding started than the actually used one is now, so to answer your question - everyone who backed it, I guess?

It works fine and it's not like there are any significantly more modern alternatives out there anyway. And to put things in context, a few years ago there was not a single phone out there that had working 3D acceleration with open drivers, for example.


The switch to the i.MX 8M was already going to be a thing during the Kickstarter if I remember correctly. The chip was also intended for automotive use and is much worse than the snapdragon that was out at the time. Processors are now an order of magnitude faster than what the Librem 5 has at fraction of the price with a much better user experience, with a much bigger app ecosystem, and with a much less bulky form factor.

>everyone who backed it, I guess

That was 6 years ago before it had even released. The value proposition of it now, especially now that people can see what it's actually like has tanked its desirability.


And none of those processors are available or suitable for projects like these. You pretty much get to choose between i.MX, Allwinner or Rockchip. Although things do change in this regard, it happens very slowly.

I backed the project on the initial campaign and the switch to i.MX8M from i.MX6 has been merely mentioned as a big "maybe" back then.

(sent from my Librem 5)


They still haven't finished shipping all of the orders from 2019. It's practically a scam. They still are trying to trick people into buying this outdated hardware.

And they don't allow you to get a refund until your spot in the queue comes up (or if you report their business to the government and you get lucky).


The submission is about Librem 5 USA, which is shipped within 10 days.


The price point is daunting. I'll probably switch to Apple. I mean governments are going to track you one way or another, so Apple's tight software policies are good enough. If that's not good enough I'll use an old Nokia phone.


Non-USA version is a bit cheaper: https://puri.sm/products/librem-5.

> I mean governments are going to track you one way or another, so Apple's tight software policies are good enough.

https://news.ycombinator.com/item?id=27897975


This seems to be much closer to a general-purpose computer than any other smartphone I've seen.

For anyone not clicking through to the article, here is the feature list:

Secure supply chain centered on made in the USA electronics at Purism’s facility located in the USA

Device assembled in the USA

Publicly available schematics

The Liberm 5 USA is designed for security and privacy rather than for consumerism

Hardware isolation of components

Bootable from SD card

Removable radio modules

Replaceable lithium battery

Secure cryptographic removable smart card

Hardware kill switches put the product owner in full control over device

Private and secure operating system, PureOS

PureOS is fully open source and auditable for better security and privacy

No intrusive mystery proprietary code supporting surveillance and data mining apps or technologies

PureOS supports private and secure apps developed with fully auditable source code

Purism supports decentralized application developers centered on providing secure apps

Security and privacy protection by default

Librem 5 USA is supported by secure and private cellular service provided by Librem AweSIM

Purism offers anti-interdiction services to ensure devices are not altered in transit

Librem 5 USA supports true convergence with PC apps using a lapdock or mouse, keyboard, and monitor


Does it have a something like Apple’s Secure Enclave to protect cryptographic keys? Are apps strongly isolated?

Do you know what the anti-interdiction services are? I’m guessing that the each of the separate components are cryptographically paired so that third parties can’t replace the modem or touchscreen (for example).


> Do you know what the anti-interdiction services are?

https://wp.puri.sm/posts/anti-interdiction-services/

> Does it have a something like Apple’s Secure Enclave to protect cryptographic keys? Are apps strongly isolated?

https://source.puri.sm/Librem5/community-wiki/-/wikis/Freque...


This wiki is out of date. It has lots of [comparisons to the PinePhone](https://source.puri.sm/Librem5/community-wiki/-/wikis/Freque...), but none regarding the PinePhone Pro.

The Pro has a much better hardware situation than the original PinePhone.


AFAIK PinePhone Pro is still far from being a daily-driver-ready, so a comparison with it is almost irrelevant. It has no paid developers, so I don't expect it to be ready very soon.


This is a bad take.

Pine has a far more vibrant and treaded software ecosystem than Librem[0] at this point and many or most of the userland UI is using Purism's Phosh launcher anyway. Hell, if you want, you can build PureOS for the PinePhone too [1].

Pine has more real users with real devices and possibly more developers too since it's more Bazaar and less Cathedral in its approach to development.

You can have preferences, but this just reads like sour grapes.

0: https://wiki.pine64.org/index.php/PinePhone_Software_Release...

1: https://gist.github.com/mozzwald/3104aadf2cc8f567a72b6b78371...


It's pretty clear that you have never seen these devices next to each other - and that you never attempted to actually use the thing you posted instructions for.

There's a huge difference in maturity between PinePhone/Librem 5 and PinePhone Pro.


Ah, bummer.

Thanks for the links.


For me, the appeal of a Librem phone is less about security and more about ability to use the phone freely, e.g. filesystem access, ability to install my own software, and developing right on the device.


Who codes the baseband for this phone & is that open-source? $2k is a steep price but the features are pretty nice.


The modems are sourced from a couple companies and no they definitely do not run open source firmware.


The baseband modem is a replaceable M.2 card connected over USB 2.0 and I2S for audio. No, it's not open source (the whole GSM stack on the phone itself is, but the modem's firmware that runs on the modem is a closed blob).


I hate to continue being the lazy end-user on this, but it comes up in my mind every time that Purism or a Librem phone comes up. I don't know how to set it up as an actual phone, and it's expensive for a miniature tablet. I've never seen a thing that says, "do this to get it working on Tracfone".

Until there's an easy guide for end-users to interact with so they can use it on a BYOD plan, it's of little value.


What kind of guide do you need? I have just put my SIM card into it and it works fine as a phone ever since. I'm certainly a power user though, so maybe I'm missing something obvious.


Well, unless your carrier supports 2G calls (in the USA thats just T-Mobile), this phone won't work for you. Some progress is being made on VoLTE but it didn't work for me.


Very nice!

I've been wanting to move to something like Graphene or e/OS but they seem set on only supporting most of their security features on Pixel hardware.

I don't want a Pixel because I don't want anything Google. This seems like a fantastic alternative, and eventually Graphene will support it - in the meanwhile there is DivestOS.

I barely use my phone for making calls via the cellular network anyway, and I'm always in a big city with good reception, so not too worried about some of the issues people are talking about. Everything's a compromise anyway.


I sympathize with your desire steer clear of Google products, but I doubt Graphene will support any Linux phones anytime soon. GrapheneOS is Google Android's AOSP with security and hardening sauce on top plus a couple apps Google has neglected/omitted from AOSP, like a camera and pdf reader. There's some opt-in glue to make it interop as gracefully and securely as possible with Google's software ecosystem, but it's still heavily dependent on Google for hardware-level fixes and Android in general.

The jump from AOSP to Linux/Phosh would be an entirely new codebase. Graphene deciding on Pixel as a foundational device wasn't because of a love for Google, but because of a need for security and hardware updates on a well-worn device platform that has actual traction in the market... as optimistic as I would like to be about the Linux Phone, we're just not there nor will be we for many tomorrows.


You know, I actually mixed this phone up with the FairPhone which is only really in Europe (mixed reports about it working in the US). That's what I am still planning to get. Not sure about this Librem phone, I may still consider it...but probably not.

Graphene I think could work on Fairphone without too much tweaking, not sure if it's worth the effort though.


Ah, yes that's far more likely. Graphene might support Fairphone at some point, but I kind of doubt it. I do think it'd be far more easy to fork/retrofit though, if you sincerely had the gumption.

Personally, I was bummed they removed the headphone jack on their latest model[0]. If people are going out of their way to avoid the Apple/Google antics of the world, give them a damn headphone jack. Just bogus IMO, but not a deal breaker for many in 2023 I guess. They parroted a lot of Apple's (marketing) points around it and even sell their own adapter...

[0]: https://support.fairphone.com/hc/en-us/articles/983618898804...


Does it actually reliably make calls yet?


Kind of. For me (Deutsche Telekom, Germany) VoLTE does not work, so when receiving/doing a call the phone needs to drop back from LTE to 2G/GSM.

Nowadays I understand the other side always pretty well, but often they don't understand me well when calling from L5.

Apart from that calling is depending on modem connectivity which is still pretty bad. I don't have a stable connection at work, where an iPhone in the same mobile network, is always fine. I'm even unsure if that aspect has improved really since I received it in March 2022.

Then there are some smaller bugs, like your phone hangs and keeps vibrating when you receive a call, while the L5 is locked.

Edit: forgot to add that while moving fast, e.g. in a train, I would say calling is almost impossible. You just loose connection too often.


Yes, for years now. Some carriers allowlist the devices that can use VoLTE on their networks though, so beware of that, especially in areas where 3G and 2G are being sunsetted.


VoLTE is not supported. But it can reliably place 2G calls if your carrier supports it.



In the US, 3G has been entirely phased out and 2G is only supported by TMobile (and that’s getting turned off early next year)


I just need the uber app to work, I don't need a smartphone for anything else.


It should work on Librem 5 with Waydroid.


Thank you, might just get it then.


The Uber app probably won't work in Waydroid (it requires location and Waydroid doesn't support location yet). If you only need to boom rides, you can do that from the website. I booked an Uber from Firefox on my OnePlus6 running postmarketOS recently and it worked great.


Uber works from a browser.


Will have to try it but it needs good location data else it won't let you book a ride, but if so, game changer for me.


I use Uber from the website in a browser and I don't give it location. It works for me.


Any word on battery life for these devices?


For me it's something between 4 and 12 hours, depending on the usage. I have the modem always enabled, but WiFi usually disabled, because it drains your battery even faster.


Thanks! That seems similar to what Pinephone users are mentioning too.

Really wonder what is happening for a linux device to use that much power, plenty of progress to be made on that part.


PinePhone gets longer battery time when suspended, but Librem 5 wins on active usage time. But yeah, they're both in pretty much the same order of magnitude.




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: