Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GrapheneOS says Pixel 11 has MTE support after all

grapheneos.social

Post reply on HN
Print view View original

121–130 of 175 posts

Re: GrapheneOS says Pixel 11 has MTE support after all

#121

Post by Itoldmyselfso »

toast0 wrote: post #80
iamnothere wrote: post #24

It’s absurd that a small project like Graphene is able to run rings around a giant like Google in the security sphere. Almost makes you wonder if some of those vulnerabilities are intentionally allowed to exist. Vulnerabilities in the world’s most popular (by volume) mobile OS could provide a plausibly deniable global espionage backdoor.

Elsewhere in the thread, someone reports that with MTE enforcement enabled, there are lots of crashes. And app and system service developers don't seem responsive to them. That's not something that's really acceptable on a $500+ phone... so if you're Google, you're not going to turn that on by default and you're not really going to be interested in keeping it as a feature that users can turn on. Graphene has a differ…

That was partially true a couple years ago that there were some crashes related to it. It is absolutely not the case anymore.

Re: GrapheneOS says Pixel 11 has MTE support after all

#122

Post by chasil »

infogulch wrote: post #77
chasil wrote: post #21

"Aside from MTE, Google downgraded the Pixel 11 series GPU compared to the Pixel 10 series in addition to reducing RAM for base Pro models." I will make a note not to buy this model. Is this the worst quality control lapse since the Huawei Nexus core failures?

This isn't a quality control issue, but a beancounter-chooses-cheaper-parts issue.

One must believe that MTE was intended for use on this device, as it is present on everything down to the Pixel 6.

Everything else is in the realm of bean counters, I would think.

Re: GrapheneOS says Pixel 11 has MTE support after all

#123

Post by mirashii »

bitpush wrote: post #91
striking wrote: post #70

Earlier quoted context omitted.

If they're just some "niche use case" then why would Motorola partner with them? The way they see it, > By combining GrapheneOS’s pioneering engineering with Motorola’s decades of security expertise, real‑world user insights, and Lenovo’s ThinkShield solutions, the collaboration will advance a new generation of privacy and security technologies. In the coming months, Motorola and the GrapheneOS Foundation will contin…

[flagged]

They’re the second largest manufacturer of Android smartphones in the US, and 10% of the global market. Seems a bit unreasonable to dismiss them out of hand on that basis.

Re: GrapheneOS says Pixel 11 has MTE support after all

#125

Post by armadyl »

loufe wrote: post #27

I am almost certainly going to live with whatever drawbacks in terms of camera quality, battery life, etc. Come with their Motorola phone when it's time to upgrade. MTE is such a non-negotiable for modern digital security on phones it's crazy Google would be so okay with this regression. What's especially stuck in my mind lately is how insecure basically all desktop OS' feel. In at the point of buying a second and th…

> What's especially stuck in my mind lately is how insecure basically all desktop OS' feel.

I ended up switching away from using my Mac to using an iPad M5 + Magic Keyboard as my sole computing device for the security benefits, and it’s been working pretty well and in retrospect I don’t miss anything from macOS aside from a chromium-based browser. However I’ve said it before that switching back to using a Mac after using iPadOS for so long feels like a serious regression, for all it’s faults the iPad + iPadOS feels like a futuristic technology preview of macOS.

For development work I use GitHub Codespaces (and self-host Coder in the future hopefully). I was moving towards cloud/container-based development already and it works nicely. Plus NPM vulnerabilities are no longer a serious issue. Again the only thing I miss is Chromium, but I’ve altered front-end development planning to target Safari/Firefox since websites shouldn’t be implementing non-standard Chrome-exclusive features anyway imo (I’m saying this as someone who highly prefers chromium lol).

Re: GrapheneOS says Pixel 11 has MTE support after all

#126

Post by eptcyka »

bitpush wrote: post #91
striking wrote: post #70

Earlier quoted context omitted.

If they're just some "niche use case" then why would Motorola partner with them? The way they see it, > By combining GrapheneOS’s pioneering engineering with Motorola’s decades of security expertise, real‑world user insights, and Lenovo’s ThinkShield solutions, the collaboration will advance a new generation of privacy and security technologies. In the coming months, Motorola and the GrapheneOS Foundation will contin…

[flagged]

Neither is google.

Re: GrapheneOS says Pixel 11 has MTE support after all

#127

Post by eptcyka »

matheusmoreira wrote: post #84
MostlyStable wrote: post #74

Earlier quoted context omitted.

[flagged]

[flagged]

I am sympathetic to GrapheneOS, but I have also worked with them and they are not easy to work with. Google is in no way required to take on criticism from OSS community- GPL and MIT do not actually require the rights holder to not be an asshole. In such a social dynamic, one will find greater success using language that appeases instead of repels the asshole.

Re: GrapheneOS says Pixel 11 has MTE support after all

#129

Post by bjustin »

OneDeuxTriSeiGo wrote: post #53
Yokolos wrote: post #49

Earlier quoted context omitted.

I've read that there's a significant performance cost to MTE on Android (or on Tensor). It might just be that.

There's only a significant cost to synchronous MTE. MTE ships two modes. synchronous mode and asynchronous mode. SYNC is slower but gives you far better traces and throws an SEGV_MTESERR as soon as violations happen. ASYNC however is async so there's a bit of a delay between a violation and the "catch" that throws SEGV_MTEAERR. Strictly speaking async is worse for security because there's a brief window of time where…

Given the current use of AI tools I would think that SEGV_MTESERR crashes would be low hanging fruit to fix. AI tools do ok with identifying memory corruption issues, given a smoking gun, in my experience.

Re: GrapheneOS says Pixel 11 has MTE support after all

#130

Post by iamnothere »

toast0 wrote: post #119
iamnothere wrote: post #95

Earlier quoted context omitted.

Why not force it on an API change? It wouldn’t be the first time there was a breaking change.

Because it (anecdotally) crashes too much, but only on $$$ devices with cool CPUs that can use it. People buy expensive phones because they're supposed to work better. They should really do some sort of sampling thing to generate crash dumps and find big offenders and increase the coverage over time. For Google employee devices, 0.1% of background execution starts while charging in an idle period (overnight bedtime c…

I wonder what causes the crashes. Is it a buggy MTE implementation (or buggy hardware), or are app devs doing something that would only cause crashes under MTE? Maybe it’s something they are using like a library or framework?
Post reply on HN