Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Original GrapheneOS responses to WIRED fact checker

discuss.grapheneos.org

Post reply on HN
Print view View original

141–150 of 343 posts

Re: Original GrapheneOS responses to WIRED fact checker

#141

Post by HybridStatAnim8 »

Avamander wrote: post #68
DANmode wrote: post #65

Earlier quoted context omitted.

From the story you’re commenting on: > From Wired: > We understand that Daniel's recollection was not that James wanted to know more information about how the signing keys were stored, but that he wanted direct access to them. > Did you suspect his request was tied to a deal he was brokering with a large defense contractor? Did you believe this would put the entirety of CopperheadOS’ user base at risk? > Yes and yes.

[flagged]

They were compromised. Greed overtook the principles on which the project was founded and put the project at risk. They agreed from the start that Micay would own the project and hold the keys. They explicitly accepted those terms. Despite this, they tried a hostile takeover anyway.

Forking and building a separate build isnt dual signing, its just forking. You can do that right now with GrapheneOS and its build guide if you want.

Im not sure what you mean by the last part, GrapheneOS has been quite upfront with all of this from the start.

Re: Original GrapheneOS responses to WIRED fact checker

#142

Post by HybridStatAnim8 »

Avamander wrote: post #93
lostmsu wrote: post #84

Earlier quoted context omitted.

From a security-minded user perspective it makes sense to destroy keys when instead of a single entity I receive updates from I get another entity that is not equivalent, and half of my previous entity thinks that the other half is sus.

[flagged]

It wasnt intelligence agency compromise, it was a business partner compromise, who intended to violate the privacy and security of their users. Nothing about this is done out of spite. Im not sure where youre getting that from. You just seem to be attacking peoples character for making the right choice given the circumstances.

Re: Original GrapheneOS responses to WIRED fact checker

#143

Post by HybridStatAnim8 »

margalabargala wrote: post #28
Avamander wrote: post #18

Earlier quoted context omitted.

> They "handle the business" while someone else does 99% of the actual work, then ask to split 50/50. As a response, Micay decided to destroy the update signing keys for all the CopperheadOS devices out in the wild. Resulting in financial damages to Donaldson. Hardly a level-headed response, even if you disagree about the financial share of something.

[flagged]

Deleting the signing keys for the sake of protecting ones users is the mature and responsible thing to do.

Re: Original GrapheneOS responses to WIRED fact checker

#146

Post by HybridStatAnim8 »

amalcon wrote: post #56
dmbche wrote: post #42

Earlier quoted context omitted.

If you own something you can do what you want with it including rendering it useless

If you own all of it, yes. If you only own most of it, the minority owners do have some rights -- just fewer than you do.

Micay owns the whole project. Ownership of the project was not exchanged or divided, part of the explicit terms of the agreement were that Micay would hold the keys and ownership of the project just as they always have.

Re: Original GrapheneOS responses to WIRED fact checker

#147

Post by HybridStatAnim8 »

Avamander wrote: post #45
dmbche wrote: post #42

Earlier quoted context omitted.

If you own something you can do what you want with it including rendering it useless

[flagged]

Thats a characteristic all modern OSs and modern apps have. You need to trust the key holders, always. Some people make their own builds for this reason. Depends on the threat model.

Re: Original GrapheneOS responses to WIRED fact checker

#148

Post by microtonal »

neilv wrote: post #107
Cortex5936 wrote: post #14

I love GrapheneOS and I use it daily for more than 2 years. However, and as Louis Rossmann pointed out in one of his videos, they really need to work on the "defensiveness" and "rants" of their communication. Even when they are 99% right most of the time, they sometimes don't come as mature and professional.

My gut feel is that Micay is genuine, and obviously also very defensive. At least some of the defensiveness is warranted. Maybe most of it. Regardless, it comes across in most GrapheneOS communications, and it's sometimes counterproductive. A related issue, which I'm sure Micay can appreciate, is that users of GrapheneOS tend to be cautious, and increasingly will want to know why the project should be trusted, now th…

I agree that this is an issue, but it is impossible to prove a negative. The same could be said for Apple's or other manufacturer's signing keys. Who guarantees that the US government hasn't required access to the iOS signing keys? Or China in exchange for access to the Chinese market? They probably wouldn't even want to reveal that the signing keys were leaked if they were allowed to, since it would undermine their security story.

With a non-profit project of highly principled security experts, there is at least a high probability that they'd rather blow up the project than compromise. People elsewhere in the thread criticize Micay because he deleted the CopperheadOS keys, but to me it increases trust in the GrapheneOS project, since he clearly puts the security of his users over money, fear, and whatnot.

In the end trust arises from running a project or company long-term without evidence that you somehow compromised security.

I wonder in general how this situation could be improved. Second or third independent reproducible build + confirmation signing?

Re: Original GrapheneOS responses to WIRED fact checker

#149

Post by busterarm »

Matl wrote: post #101
Cortex5936 wrote: post #14

I love GrapheneOS and I use it daily for more than 2 years. However, and as Louis Rossmann pointed out in one of his videos, they really need to work on the "defensiveness" and "rants" of their communication. Even when they are 99% right most of the time, they sometimes don't come as mature and professional.

> However, and as Louis Rossmann pointed out in one of his videos, they really need to work on the "defensiveness" and "rants" of their communication Not that I disagree but Louis Rossmann giving someone advice to tone down the rants is ironic.

[flagged]

Re: Original GrapheneOS responses to WIRED fact checker

#150

Post by HybridStatAnim8 »

kennywinker wrote: post #33
margalabargala wrote: post #28

Earlier quoted context omitted.

[flagged]

> Immature maybe Yeah, that’s the issue. I don’t want people who behave immaturely, impulsively, or vindictively, having a key role in something as important as my phone os. I want stability, maturity, and thoughtfulness.

That is what CopperheadOS, and now GrapheneOS, provides. Its a level of "battle tested" that most OS and app devs never have the opportunity to have. Deleting the signing keys during a hostile takeover attempt rather than submitting to pressure or greed is an amazing quality that is rare to find.
Post reply on HN