371–380 of 444 posts
Earlier quoted context omitted.
You can't because a lot of apps check that the phone is controlled by Google with Play Integrity. Google thought about this, don't worry. They learned their lesson after CyanogenMod tried to compete by offering an alternative. Non-Google Android are now dead except in China.
Well for me I use Lineage without even MicroG and everything I need works - yes even banking
Earlier quoted context omitted.
There are quite a few people from Europe on HN saying that you can find banks not forcing the duopoly apps on you, in different countries.
You can. Thats why I said most. However at that point you'll likely pay for the privilege.
Earlier quoted context omitted.
Everyone else mentioned the app support which is true, but for graphene specifically, they do not like desktop Linux at all because they don't like its security. They would much rather build on AOSP than desktop linux.
[flagged]
Long term in the future, surely the open source community forks AOSP itself and maintains it. The worst option would be giving up and trying to focus on Linux (desktop) imo.
Earlier quoted context omitted.
It's not impossible, no, but it's not the default, and the different models tend to have various different issues.
I think the disagreement mainly lies between whether one should be able to use their devices as they wish, like a desktop/laptop, or whether all devices should be restricted so as to have a good baseline level of security. As far as I understand, the Linux phone enthusiast's POV is that we should start seeing the phone as another general purpose computer that can be set as per one's needs and can be suitably hardened…
Earlier quoted context omitted.
> Android has existing apps. Android has a massive app ecosystem including the largest open source mobile app ecosystem. Those apps are nearly entirely available for GrapheneOS. Very few apps are unavailable for GrapheneOS. It's nearly entirely banking and government apps, but as we said 90% of those work on GrapheneOS. AOSP and GrapheneOS have hardware-based virtualization usable to run desktop Linux software. It ev…
>> Android has existing apps. > Android has a massive app ecosystem including the largest open source mobile app ecosystem. Those apps are nearly entirely available for GrapheneOS. Very few apps are unavailable for GrapheneOS. It's nearly entirely banking and government apps, but as we said 90% of those work on GrapheneOS. > AOSP and GrapheneOS have hardware-based virtualization usable to run desktop Linux software.…
20% of apps from the Play Store not working as opposed to less than 1/10000.
> Could you describe the "fundamental issues"?
Many Android apps use functionality such as the hardware keystore APIs and other hardware APIs.
> My impression is that they just run the whole Android userspace in a container, which seems like a reasonable approach.
Using namespaces in the way they do is not a reasonable approach since they're running it with SELinux disabled which means most of the privacy and security model is disabled. It also isn't set up to run that way and requires very problematic hacks. It also ends up not being possible to run more than one instance of it due to those hacks.
> Again, I know security/privacy is your talking point, but this isn't actually the argument at hand.
It is not a 'talking point' and is very relevant in all cases. You may not care about it but most people reading this thread do.
> So, yes. > > Which is a lot of words to agree that yes, many apps only allow stock and therefor block you just like any other OS.
GrapheneOS has better app compatibility than plenty of Google certified devices. In practice, the only issues are with apps going out of the way to ban other operating systems and GrapheneOS does better than anything else. Apps are increasingly permitting it since it exceeds all their requirements and it's just a little bit of extra work for them to not solely depend on Google's API.
> I'd like evidence for "drastically", but again we mostly agree.
It's easy to check and other people have done so.
> Right. So it's 90% AOSP. Old AOSP with worse security properties, but for compat purposes that's not important.
No, you're wrong. It's very important for compatibility. Apps can and do detect large parts of the security model being disabled. A far larger portion of banking and government apps won't run on it. Having 90% compatibility with those is certainly better with 30% or less.
> You and I have different impressions of how apps approach attestatoin.
You don't have the experience and data we do. We have a large number of users and reports from them. We also have conversations ongoing with numerous banking apps about it and have seen multiple apps permit GrapheneOS. Revolut is currently talking to us, although the app works on GrapheneOS since we worked around how it was being banned in January 2025. We're also talking to Square (Cash App, etc.) and others. It is a problem which can be solved and these companies are largely not against solving it or even actively want to solve it, it just isn't something they've gotten to yet. The GrapheneOS userbase growing has begun to make this problem solve itself.
> And most apps work on waydroid. Of course the apps that go out of their way to block non-stock are the pain point.
No, a large portion of Android apps do not work with it because they use APIs unavailable or broken with it. Many banking and similar apps check that the security model is intact which it clearly isn't so they ban it but they would happily run on a non-stock OS which appears to have it intact.
> You've carved out 3 words in a way that doesn't make sense alone
What we wrote makes sense.
> 90% of the time, it works 100% of the time. Anyways, you aren't 100% compatible, so my point stands.
90% compatibility with banking apps is far better than less than 30%. You're trying to make it seem black and white when it isn't. Google certified Android devices don't truly have 100% app compatibility in the first place. Apps have plenty of required features, minimum Android version requirements, requirements for specific models (some apps only work on Pixels, Samsung flagships, etc.) and a lot more. Some low-end devices have broken support for Camera2 and other APIs despite the CTS. GPU drivers are buggy and games are buggy so there are compatibility issues. Perfect compatibility never exists. Nearly every non-banking app working fine and 90% of the special case of banking apps working fine is very good compatibility.
> I'm not comparing to stock
Most people are using OEM Android forks or iOS.
> and you refuse to give apps root access so the shortcomings that they can fix are limited
A userdebug build of GrapheneOS has root access. It's not suitable for production builds used by the vast majority of users and isn't in those. It's also incredibly niche and not very useful. What you're actually referring to is using a rootkit framework providing app accessible root access where a huge portion of the OS has root access. You're not talking about the user having root but rather a framework for apps built with disregard and even disdain for security being granted root via a dialog which a user cannot truly ever revoke or undo the consequences of granting beyond a reinstall of the whole OS.
> I know your threat model demands that the stupid helpless users can never be allowed to control their device
The app accessible root frameworks you're talking about drastically reduce the privacy and security of the OS for all users including ones never using it to grant root access to an app. Granting root access to apps built with such disregard for following security best practices is also not somehow unproblematic because you think they're trustworthy since they're open source.
> but it does undermine the features that your OS can provide
No, it means we build features with proper implementations following security best practices instead of doing it with half-baked hacks via a massive portion of the OS having full root access and granting that to apps.
> I love pedantry as much as the next guy, but ROM has not meant read-only memory in like 20 years.
It means read-only memory in embedded, information security and in the context of GrapheneOS which is an overlap of both. GrapheneOS works on security including boot security where it's very relevant. When someone says ROM recovery in the context of GrapheneOS, that means the boot ROM recovery mode loaded when firmware on the SSD can't be loaded. It does not mean the OS recovery mode. It's not correct terminology to refer to GrapheneOS. It propagates unnecessary misconceptions and confusion.
> So, you're trailing, say, Debian, and have done for years, and have at most a plan for someday being able to compete.
No, it doesn't provide a similar backup system portable across devices and major OS versions.
> So when you wrote "GrapheneOS and other secure options", you just meant GOS because nothing else matches your definition of security. Again, I don't exactly mind that, but it's disingenuous to gesture at other options that don't exist.
No, our response said the apps should set a security standard and enforce it fairly. They should not enforce Google certification but rather define the standard security expectations and permit anything meeting them. GrapheneOS is much more secure than any Google certified OS, so it would meet actual security standards they set. Whether other alternate operating systems meet those standards depends on what the app developers set as the requirements. Many Google certified operating systems won't meet reasonable security standards and would need to be banned if the enforcement is fair.
Earlier quoted context omitted.
Because Android is miles ahead in terms of security, permission management, app separation, power management, privacy... Linux crowd can not even agree on compositor, and if systemd or sudo is a good idea.
I strongly disagree. The only reason I still use an Android phone is that countless third-party services (that are too useful for me to give up) require the Android/iOS ecosystem.
Especially in this political climate it’s insane to recommend people switch to a phone OS that can be pwned via hardware or software means in virtually zero time versus something like GOS + a Pixel or an iPhone.
Earlier quoted context omitted.
This is something that no Linux phone enthusiast seems to understand. Also if we use atomic distros with flatpaks and whatnot that mimic Android security the end user basically ends up having to essentially use Termux (but busybox or something similar) on their Linux phone as well
Atomic distributions don't provide the security of verified boot or the far better mandatory app sandbox and permission model on Android. Flatpak is catching up to Android from 15 years ago, but it isn't mandatory. Android continues making backwards incompatible privacy and security improvements via new target SDK versions on a yearly basis with apps forced to adopt it within around a year. It continues moving toward…
Earlier quoted context omitted.
[flagged]
> In the future, I'd recommend replying on your own account rather than an organization sockpuppet. Thanks! We're using a project account making it clear these responses are from the GrapheneOS project. That's the opposite of a sockpuppet account. We've moved to using this project account instead of individual accounts because of personal attacks directed towards our team. A community member created this account and…
Earlier quoted context omitted.
We should be able to support the next generation of the Razr Ultra. It will take longer for the lower end devices to meet our requirements for updates and hardware-based security features. We think folding devices are a lot more useful and likely to get more users but we already have those via Pixels so flip devices are compelling as a new form factor. We're also interested in having support for new tablets.
How is the crease on the flip? On some of the foldables like the samsung's, the crease is pretty noticeable and for me it bothers my OCD a little bit. I love the idea of a foldable though
Earlier quoted context omitted.
Software for poorly isolating software on a desktop without a viable approach to containing arbitrary desktop software with a case-by-case consent model for access is not comparable to a mandatory app sandbox with yearly backwards incompatible privacy/security improvements. The whole app ecosystem has to support it and adapt to gradually improving privacy and security. Desktop applications are not written to work tha…
[flagged]
No, it's not a bold claim. It's a strong consensus among people working on privacy and security engineering or research.
> Care to elaborate?
We did in our response to you at https://news.ycombinator.com/item?id=49366321 and posted more elsewhere. Others have posted far more details about it in articles and papers.
> I think you are somewhat conflating the needs of desktop/laptop/mobile users.
No, we aren't. Desktops need far better privacy and security than they have today. That does not require giving up functionality. Development can be done in contained hardware accelerated virtual machines specific to projects. It doesn't require running an OS where anything goes and software doesn't run in a sandbox on the host. QubesOS could have a far more secure OS as the one people interact with despite running far less secure operating systems in many of the guests. It would not prevent people getting work done. It can also be done with far higher usability than is currently provided.
> Hardware security tied to unlocking modes makes little sense on desktops.
Verified boot and hardware support for disk encryption is very valuable to a desktop and laptop.
> I can lose my phone, or possibly my laptop, but my servers and workstation are at home, guarded by a dog and a shotgun.
Servers and workstations being in a trusted location doesn't mean the security of those against physical attacks doesn't matter. It also doesn't address remote attacks.
> Disk encryption already covers a realistic threat model such as a break-in.
You do not have comparable disk encryption. You have it in a form that only truly works when the device hasn't had the encryption passphrase entered since boot. It's wide open to data extraction via a bunch of debugging interfaces. There's incredibly poor security against physical attacks at both a hardware and OS level.
> I don't expect protection against apps, and don't want to pay the performance tax that comes with "enhanced" memory allocators and memory-safe languages/runtimes.
The performance cost of exploit protections can be determined in a granular way. GrapheneOS has a toggle to use the standard allocator for any apps. Memory safe languages do not imply inherent overhead and can be faster for some uses. Rust is very high performance and even Java can be higher performance for certain uses where there are lots of short lived allocations.
> The irony is that Android is practically designed to run commercial malware. The sandbox you have in mind does very little in practice.
Android's sandbox provides enormous benefits and the permission model gets significantly better ever year. Android has heavily focused on improving a lot of what you're talking about itself upstream and GrapheneOS improves it much more.
Android can force backwards incompatible changes on the whole app ecosystem to improve privacy and security which it does with each new major target SDK version for the major yearly releases. They limit how much they do this in each major release and aren't as focused on privacy and security as us so we wish they did more, but no other mainstream platform has made such substantial improvements to the privacy and security model for apps. Android has improved drastically more than iOS since it had a much worse starting point and had to catch up. It has caught up in most areas and surpassed iOS in some but still needs improvements in others. GrapheneOS is heavily focused on those areas where it's still behind iOS and has done a lot to improve it.
> Users consent to sharing files, contacts, locations, photos, when asked to because they want to use some app, and all of that is sent straight to Facebook, Google, or others.
GrapheneOS has Contact Scopes and Storage Scopes to choose which contacts and files/media are shared with the app seeing it as the permissions it requested being granted. This is an extension of Android's standard approach built on the infrastructure it provides for this. It's already heavily moving in this direction and has increasingly forced apps to use a case-by-case consent approach. Location, Microphone and Camera access in Android can be granted on a one-time basis. It heavily pushes apps to using the system file picker, media picker, contact picker, etc. and store policy is increasingly used as a deterrent against requesting bulk access. GrapheneOS does much better and it's able to do much better because of the infrastructure Android provides.
> Android apps can also communicate in some obscure and unexpected ways to discover each other and share information behind the user's back
Communication better apps is possible within profiles where both apps want to engage in it. Users do have the ability to prevent apps seeing each other and communicating via profiles (Private Spaces, work profiles and secondary users). GrapheneOS will be providing finer-grained nested profiles beyond a single Private Space per user or a single work profile along with it being more convenient.
Apps getting access to user data in the first place is what's most relevant rather than whether they can communicate regardless. They could also send it to a service rather than another app. Android is focused on preventing apps getting access to sensitive data including data from other apps or the user's profile data (files, media, contacts, etc.) which GrapheneOS greatly enhances. We do have things like a Network toggle but it's not intended as a substitute for the main approach of avoiding apps getting access to sensitive data. Android is currently phasing in a standard local network access permission for apps will provide one of the main benefits of our Network toggle.