Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GrapheneOS is the only Android OS providing full security patches

grapheneos.social

Post reply on HN
Print view View original

31–40 of 467 posts

Re: GrapheneOS is the only Android OS providing full security patches

#31

Post by arcanemachiner »

ForHackernews wrote: post #26
nanomonkey wrote: post #5

As a LineageOS user, I'd be interested in the disparity between GrapheneOS and LineageOS.

GrapheneOS is a locked-down, security-hardened system that's good if you need absolutely maximal security (e.g. journalists, activists, folks targeted by state actors). LineageOS is a more of an open system for tinkerers who want to play outside Google's walled garden. You can have root to control your own device on Lineage, but not Graphene.

I believe you can root GrapheneOS. It just breaks the security model, so it's not recommended to do so.

Re: GrapheneOS is the only Android OS providing full security patches

#32

Post by masklinn »

SubiculumCode wrote: post #11

Why was it that in the early PC days, IBM was unable to keep a lid on 'IBM compatible', allowing for the PC interoperability explosion, yet today, almost every phone has closed drivers, closed and locked bootloaders, and almost complete corporate control over our devices? Why are there not yet a plethora of phones on the market that allow anyone to install their OS of choice?

> Why was it that in the early PC days, IBM was unable to keep a lid on 'IBM compatible', allowing for the PC interoperability explosion

IBM didn't think to lock it down, the BIOS was the main blocker and was relatively quickly reverse-engineered (properly, not by copying over the BIOS source IBM had included in the reference manual). They tried to fix some with the MCA bus of the PS/2 but that flopped.

> almost every phone has closed drivers

Lots of hardware manufacturers refuse to provide anything else and balk at the idea of open drivers. And reverse engineering drivers is either not worth the hassle for the manufacturer or a risk of being sued.

> Why are there not yet a plethora of phones on the market that allow anyone to install their OS of choice?

Incentive. Specifically its complete lack of existence.

Re: GrapheneOS is the only Android OS providing full security patches

#33

Post by ForHackernews »

arcanemachiner wrote: post #31
ForHackernews wrote: post #26

Earlier quoted context omitted.

GrapheneOS is a locked-down, security-hardened system that's good if you need absolutely maximal security (e.g. journalists, activists, folks targeted by state actors). LineageOS is a more of an open system for tinkerers who want to play outside Google's walled garden. You can have root to control your own device on Lineage, but not Graphene.

I believe you can root GrapheneOS. It just breaks the security model, so it's not recommended to do so.

Ah, you're right: https://github.com/schnatterer/rooted-graphene

I stand corrected. Still, as you say, less point in it since it breaks their security model.

Re: GrapheneOS is the only Android OS providing full security patches

#35

Post by subscribed »

mcsniff wrote: post #10
nanomonkey wrote: post #5

As a LineageOS user, I'd be interested in the disparity between GrapheneOS and LineageOS.

If you care about security above all else and you have a Pixel, GrapheneOS should really be your only consideration. LineageOS has a place for those who care less about security and more about features, "freedom", compatibility, community etc... I was a LOS user and maintained my own forks for devices, but switching to GrapheneOS was a good decision and I don't really miss anything.

It might be important to mention, that Lineage OS is available on a number of the devices abandoned by their original vendors, so sometimes it may be a much better solution to get a Lineage OS onto their former "flagship" which stopped getting updates 18 months after the release.

So if the bootloader can be relocked and not passing Play Integrity scam is not a problem, Lineage may be a better option. Better than nothing, that is.

Re: GrapheneOS is the only Android OS providing full security patches

#36

Post by cwyers »

cwyers wrote: post #30
SubiculumCode wrote: post #11

Why was it that in the early PC days, IBM was unable to keep a lid on 'IBM compatible', allowing for the PC interoperability explosion, yet today, almost every phone has closed drivers, closed and locked bootloaders, and almost complete corporate control over our devices? Why are there not yet a plethora of phones on the market that allow anyone to install their OS of choice?

Because the original IBM PC was designed to be cheap and built in a hurry. IBM had a mandate for the original PC to use off the shelf components as much as possible. They also neglected to secure an exclusive license from Microsoft for DOS. 95% of building an IBM PC clone was buying the same parts and getting a DOS license from Microsoft (which they were very happy to sell you). Everyone saw what happened to IBM and…

You can actually look at history and see what happens when IBM tries to wrest control of the PC platform back with the PS/2, which was a flop with consumers because it wasn't backwards compatible enough with IBM's own previous PCs or the wider PC market that developed. A bunch of PC clone manufacturers got together and came up with the EISA bus standard so they wouldn't have to pay IBM license fees for MCA, and made it backwards-compatible with ISA cards people already had. It was successful enough that IBM ended up adopting EISA for some of their PCs.

The other notable thing about the situation is that three companies ended up simultaneously responsible for a large part of the PC platform, originally -- IBM, Microsoft and Intel. They all worked in various ways to encourage competition to each other -- the reason we see OS competition on the PC platform is that IBM and Intel both found it in their interests to allow other OSes on the platform to reduce Microsoft's leverage over them. IBM in fact created one of the competing PC OSes out the gate, OS/2, which was originally an IBM/Microsoft joint project until they started feuding. Now, OS/2 is dead, but IBM's interest in being able to support their own OS instead of Microsoft's is a big reason the PC platform was built in an OS agnostic way. People criticize UEFI for locking down the PC platform more than the previous BIOS implementations, but UEFI is still _way_ more open than basically any other platform, most of which don't have a standard for bootloaders at all. It's really the absense of a standard for bootloaders that keeps most Android phones locked down. Two Android phones from the same OEM might have different bootloaders, much less two phones from different manufacturers. We've yet to see an alternate OS with the resources to support implementing their own bootloaders for a majority of Android phones.

Re: GrapheneOS is the only Android OS providing full security patches

#37

Post by mcny »

mattmaroon wrote: post #23
SubiculumCode wrote: post #11

Why was it that in the early PC days, IBM was unable to keep a lid on 'IBM compatible', allowing for the PC interoperability explosion, yet today, almost every phone has closed drivers, closed and locked bootloaders, and almost complete corporate control over our devices? Why are there not yet a plethora of phones on the market that allow anyone to install their OS of choice?

The only thing proprietary in the early PC architecture was the BIOS. Everything else was pre-existing architecture from third parties, there was nothing to keep a lid on. Since a PC was a big box of parts anyone could manufacture one. A modern phone is much more complicated. As to why there aren’t a plethora: the market doesn’t demand it that much. The people doing it aren’t wildly successful. Perhaps that’s changin…

Even the batteries are not interchangeable on phones. You'd think all phones should have the same exact battery, that this kind of standardization is beneficial for phone manufacturers as it helps them bargain with their parts suppliers but no for whatever reason we can't have that.

Edit: I am not saying just user replaceable. I mean standardized so the same cells in a 2024 phone also works on 2025...

Re: GrapheneOS is the only Android OS providing full security patches

#38

Post by cons0le »

SubiculumCode wrote: post #11

Why was it that in the early PC days, IBM was unable to keep a lid on 'IBM compatible', allowing for the PC interoperability explosion, yet today, almost every phone has closed drivers, closed and locked bootloaders, and almost complete corporate control over our devices? Why are there not yet a plethora of phones on the market that allow anyone to install their OS of choice?

You're getting a lot of indirect responses. If you've ever tried to mod your android phone the answer is simple. Its google play services and hardware attestation for things like banking websites.

Its really easy to make a custom rom but hard to do serious "real life" stuff; companies don't want to make it easy. To most regular users, if they cant download apps from the google play store, and they can't use venmo\cashapp, then the OS is dead in the water from day 1

Re: GrapheneOS is the only Android OS providing full security patches

#39

Post by Yokolos »

subscribed wrote: post #19
piyuv wrote: post #18

Earlier quoted context omitted.

Cory Doctorow answers this in his book “The Internet Con”. IBM fought with DoJ for years. Today, it’s a felony to mess with anything locked down (anti circumvention)

I don't think it's a felony to root/jailbreak one's own phone.

The problem is doing it as a company. IBM wasn't defeated by hobbyists building their own PCs. They were defeated by other companies reverse engineering their BIOS and selling their own IBM compatible systems. This isn't possible anymore. It just means you get buried in lawsuits until you go bankrupt.

Re: GrapheneOS is the only Android OS providing full security patches

#40

Post by rolandog »

worldsavior wrote: post #7
nanomonkey wrote: post #5

As a LineageOS user, I'd be interested in the disparity between GrapheneOS and LineageOS.

https://eylenburg.github.io/android_comparison.htm

Nice! Thanks for the link. I noticed they didn't mention MOCOR OS (for the new Nokia 3210), but then I remembered that that's not an Android version. I'll see if they can add it somewhere else.

Unrelated, but this led me to find gnuclad, which may be somewhat externally maintained and is used to create the cladogragms.

Post reply on HN