Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GrapheneOS says Pixel 11 has MTE support after all

grapheneos.social

Post reply on HN
Print view View original

101–110 of 175 posts

Re: GrapheneOS says Pixel 11 has MTE support after all

#101

Post by drnick1 »

abdullahkhalids wrote: post #79
surajrmal wrote: post #38

Earlier quoted context omitted.

The perception that they are able to run rings around Google is not necessarily an accurate one. There are tradeoffs in any engineering situation and GrapheneOS devs make different ones based on different requirements. Google is one of the reasons MTE even exists. I don't think GrapheneOS devs would be capable of helping push forward that technology in the same capacity.

Do we know if Google is operating on the frontier of the trade-off curve? What do we lose from Pixel Android when GrapheneOS security changes are made?

Google's spyware (Play Services) ceases to work normally and Graphene had to patch it to run as an unprivileged app. So that's one "loss."

I personally don't bother with Google dependencies at all. If an app requires them to work, I will do without it.

Re: GrapheneOS says Pixel 11 has MTE support after all

#102

Post by drnick1 »

stephbook wrote: post #76
iamnothere wrote: post #24

It’s absurd that a small project like Graphene is able to run rings around a giant like Google in the security sphere. Almost makes you wonder if some of those vulnerabilities are intentionally allowed to exist. Vulnerabilities in the world’s most popular (by volume) mobile OS could provide a plausibly deniable global espionage backdoor.

Since GrapheneOS is building on something that Google is giving away for free, I do hope that they release something better. Everything else would be.. kind of weird, no?

What do you mean? Graphene is also free software and everyone including Google can use it and learn from it.

Re: GrapheneOS says Pixel 11 has MTE support after all

#103

Post by fph »

MostlyStable wrote: post #74
drewfax wrote: post #72

Earlier quoted context omitted.

So other projects are not supposed to critize Google? Graphene's focus is on security and they complain about lack of security in your products. Seems valid to me. Also security and using non-Google OS are not niche usecases. I'm not sure how you are working on Android, the most popular OS while claiming security is a niche usecase. In fact, I have less confidence in security of your work.

[flagged]

[flagged]

Re: GrapheneOS says Pixel 11 has MTE support after all

#104

Post by gib444 »

Cider9986 wrote: post #54
moonshot5 wrote: post #26

[flagged]

You might not like their style of speech, at least they care about their users. Maybe Google uses nice flowery language that makes the reader feel nice—IDC—actions speak louder than words. Stock Pixel is an awful experience. So many useless notifications, popups, ads, privacy not by default. Company: "We care about your privacy" meanwhile 1400 corporations they share data with GrapheneOS: "There's zero telemetry in G…

[flagged]

Re: GrapheneOS says Pixel 11 has MTE support after all

#105

Post by drnick1 »

moonshot5 wrote: post #26

[flagged]

Maybe if Google did not shove their spyware down people's throats and actually allowed users control of their phones, there wouldn't be a need for projects like Graphene and Lineage. Until then, complaints are more than justified.

Re: GrapheneOS says Pixel 11 has MTE support after all

#106

Post by scheeseman486 »

mmooss wrote: post #30

My strong instinct is that GrapheneOS's plan could be problematic: Generally, do not to invest in features that the upstream vendor isn't fully committed to. It might work today, but tomorrow or next year, etc., it might not. They might even deploy other things that are incompatible or do other things that assume the feature is disabled. In fact, plans to do those things might be the reason they disabled MTE. Also, n…

Their plan is to seemingly comprehensively test MTE on the Pixel 11 to see if it's usable for them. I'm not sure how that's "problematic", in fact it seems like it's exactly what they should be doing.

Their real focus is on their Motorola partnership, anyway.

Re: GrapheneOS says Pixel 11 has MTE support after all

#108

Post by ysnp »

Borealid wrote: post #57
Iolaum wrote: post #33

Earlier quoted context omitted.

Even in the EU spyware use is prevalent (and i 'd guess everywhere else in the world). There have been many scandals of government authorized commercial spyware been deployed against journalists. Is it really that niche a mobile OS that tries to not be exploitable by them?

[flagged]

GrapheneOS have mentioned wanting to expand the logging/intrusion detection capabilities of their Auditor app but contend with the need to include it as a system app which is against their philosophy (PoLP). It is not accurate to say they don't want to do anything about spyware.

They are also completely against Play Integrity as implemented on principle.

Re: GrapheneOS says Pixel 11 has MTE support after all

#109

Post by dzaima »

kccqzy wrote: post #62
delta_p_delta_x wrote: post #39

Earlier quoted context omitted.

MTE is essentially hardware-accelerated AddressSanitiser[1]. [1]: https://clang.llvm.org/docs/AddressSanitizer.html

No MTE and AddressSanitizer are implemented completely differently under the hood and catch different kinds of memory bugs. MTE tracks provenance of pointers which means it catches bugs where a valid pointer derived from one allocation is used to access another allocation. Provenance is indicated by a fixed number of tags available. So there’s a 7% chance of not detecting an occurrence of a memory bug. ASan is implem…

Heh, you can kinda think of MTE as ASan except instead of a small range of a guaranteed redzone around heap pointers, it's a massive `2^56 * (random number, ≥0, on average 15)`-byte "redzone" (and some padding up to a multiple of 16 bytes which can predictably hide a bug, though at least such a bug won't corrupt unrelated heap). Stack handling is a significant difference though.

Re: GrapheneOS says Pixel 11 has MTE support after all

#110

Post by microtonal »

worldsavior wrote: post #41
protimewaster wrote: post #20

Unfortunately, the headline is somewhat optimistic compared to the reality, I think. The thread makes it sound like it could have been disabled due to errata or performance issues. Basically, it looks like the software Google is shipping intentionally doesn't use MTE on the Pixel 11 hardware. That raises the question of...what does Google know is wrong with MTE on the Pixel 11?

Nothing is wrong. They just don't use MTE yet, they probably have other priorities. They wanted to save some costs until they will use MTE, so they removed some hardware acceleration and downgraded the GPU. Simple as that.

And axed 4GB of RAM. In many ways, the Pixel 10 Pro is the better device for running GrapheneOS (and maybe even Pixel UI). Well done Google!

The thermometer was nice too if you have kids.

Post reply on HN