Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GrapheneOS says Pixel 11 has MTE support after all

grapheneos.social

Post reply on HN
Print view View original

141–150 of 175 posts

Re: GrapheneOS says Pixel 11 has MTE support after all

#141

Post by yaro330 »

timschmidt wrote: post #139
yaro330 wrote: post #136

Earlier quoted context omitted.

> Hmm... Let's try reframing this: "as much as it seems beloved here, people that install their own operating systems on PCs are the very definition of niche users" I mean yeah, 99% of people never installed an OS and never will, what's your point here?

> 99% of people never installed an OS and never will, what's your point here? That the 1% who do build visicalc, Linux, the internet, Google, and every application and innovation that happens outside the corporate wall. The entire ecosystem everyone else ends up using. And that calling that niche is ridiculous, shortsighted, and shooting oneself as a platform owner in the foot.

What are you talking about? You're making zero sense. I've been in the niche of modifying and installing my own ROMs, then to kernels, and now doing the same things commercially.

It is a niche, it always was. There was never a mass community of users, the most installs you used to see on any given AOSP based project is maybe 20-30K for the most popular devices like Redmis, Pocos or Google Nexus phones.

It's still a niche, and things that users do and used to do to their phones are fundamentally incompatible with Android's security model. Root access, magisk, xposed, overall zero or near zero security validation from the security perspective on all ROMs but Graphene (maybe some others, I haven't followed the sphere for a while).

Re: GrapheneOS says Pixel 11 has MTE support after all

#142

Post by Cider9986 »

yaro330 wrote: post #137
Cider9986 wrote: post #54

Earlier quoted context omitted.

You might not like their style of speech, at least they care about their users. Maybe Google uses nice flowery language that makes the reader feel nice—IDC—actions speak louder than words. Stock Pixel is an awful experience. So many useless notifications, popups, ads, privacy not by default. Company: "We care about your privacy" meanwhile 1400 corporations they share data with GrapheneOS: "There's zero telemetry in G…

> Stock Pixel is an awful experience. So many useless notifications, popups, ads, privacy not by default. Huh? What pixel are you on? You only get notifications from stuff you install after the initial setup is done. And even then you can outright mute applications, completely.

I was on stock recent pixel A17 for a few hours before flashing GrapheneOS. They took over the power button for Gemini, there's gemini in Messages, there's 50 apps you don't need. Yeah you can disable notifications but it was constantly giving tips and tricks and other bullshit. The OS feels super bloated compared to GrapheneOS.

Re: GrapheneOS says Pixel 11 has MTE support after all

#143

Post by yaro330 »

Cider9986 wrote: post #142
yaro330 wrote: post #137

Earlier quoted context omitted.

> Stock Pixel is an awful experience. So many useless notifications, popups, ads, privacy not by default. Huh? What pixel are you on? You only get notifications from stuff you install after the initial setup is done. And even then you can outright mute applications, completely.

I was on stock recent pixel A17 for a few hours before flashing GrapheneOS. They took over the power button for Gemini, there's gemini in Messages, there's 50 apps you don't need. Yeah you can disable notifications but it was constantly giving tips and tricks and other bullshit. The OS feels super bloated compared to GrapheneOS.

I hate the power button change myself, but 1. It was turned into the Assistant button by default for many years now. 2. Can be switched back easily in settings.

> there's 50 apps you don't need Where are you getting your pixels? Mine came with all the essentials, I don't remember disabling anything in particular. No game demos, no preloaded meta cancer, just the normal google suite.

> The OS feels super bloated compared to GrapheneOS.

When was that ever not the case? When was a stock OS lighter than a custom flavour on any phone? You can't ship Android in the state that custom OS-es do, you won't pass the certification to get Google's goodies like OTA service and preinstalled play store. Don't quite get the Gemini argument either. You're buying a Gemini phone that touts AI everywhere on its promotional page. What do you expect?

Re: GrapheneOS says Pixel 11 has MTE support after all

#144

Post by timschmidt »

yaro330 wrote: post #141
timschmidt wrote: post #139

Earlier quoted context omitted.

> 99% of people never installed an OS and never will, what's your point here? That the 1% who do build visicalc, Linux, the internet, Google, and every application and innovation that happens outside the corporate wall. The entire ecosystem everyone else ends up using. And that calling that niche is ridiculous, shortsighted, and shooting oneself as a platform owner in the foot.

What are you talking about? You're making zero sense. I've been in the niche of modifying and installing my own ROMs, then to kernels, and now doing the same things commercially. It is a niche, it always was. There was never a mass community of users, the most installs you used to see on any given AOSP based project is maybe 20-30K for the most popular devices like Redmis, Pocos or Google Nexus phones. It's still a n…

> It is a niche, it always was.

Again, only because the platforms are locked down and there is no single standardized target for universally bootable ROMs in the way a Linux ISO can boot on any PC.

Kinda sounds like you might be younger and didn't live through the 8bit micro -> PC transition. Standardization of the platform led to a cambrian explosion.

https://en.wikipedia.org/wiki/Influence_of_the_IBM_PC_on_the...

Re: GrapheneOS says Pixel 11 has MTE support after all

#145

Post by DannyBee »

kccqzy wrote: post #62
delta_p_delta_x wrote: post #39

Earlier quoted context omitted.

MTE is essentially hardware-accelerated AddressSanitiser[1]. [1]: https://clang.llvm.org/docs/AddressSanitizer.html

No MTE and AddressSanitizer are implemented completely differently under the hood and catch different kinds of memory bugs. MTE tracks provenance of pointers which means it catches bugs where a valid pointer derived from one allocation is used to access another allocation. Provenance is indicated by a fixed number of tags available. So there’s a 7% chance of not detecting an occurrence of a memory bug. ASan is implem…

This is all true but it also is true that MTE was in part built to accelerate address sanitizer.

Kostya/et al who pushed for and designed the extension, was trying to accelerate address sanitizer so it could be on all the time. Among other things.

In fact, most presentations presented it literally as a way to do hardware accelerated ASAN (again, among other things), so the post you responded to is correct in that sense.

(I was there at the time, helping him figure out how to push for it)

Re: GrapheneOS says Pixel 11 has MTE support after all

#146

Post by Cider9986 »

Cider9986 wrote: post #114
gib444 wrote: post #104

Earlier quoted context omitted.

[flagged]

> If they happen to overlap, that's a happy coincidence. I can't know what the developers of any OS are actually thinking, but based their actions, GrapheneOS does more for their users than any other OS. Therefore I assume that doing good things for users equals care for users. It's probably stupid to try to guess about care.

Care: https://xprivate.lol/GrapheneOS/status/2094974844639068534#m

Re: GrapheneOS says Pixel 11 has MTE support after all

#147

Post by Iolaum »

Borealid wrote: post #140
Iolaum wrote: post #97

Earlier quoted context omitted.

Graphene puts a HEAVY emphasis on security. Also your argument about a user inspecting and editing application files feels like a strawman argument. For example many spyware use malicious links to infect the devices, not malicious apps.

[flagged]

Let's say you are a Graphene OS user. Why are you even using such an app?

Also you are misrepresenting the threat model. The problem is not an app deleting it's own legitimate data.

P.S. On GrapheneOS you can block apps from getting Internet access to limit their bad ideas.

Re: GrapheneOS says Pixel 11 has MTE support after all

#148

Post by Eufrat »

wat10000 wrote: post #60
delta_p_delta_x wrote: post #39

Earlier quoted context omitted.

MTE is essentially hardware-accelerated AddressSanitiser[1]. [1]: https://clang.llvm.org/docs/AddressSanitizer.html

To expand a bit: 16-byte chunks of memory can be associated with a four bit tag. Then you steal four unused high bits from your pointers to store a tag value. When memory has a tag, a pointer used to access it must have the matching tag in its high bits. Your malloc implementation can then assign a different tag to adjacent allocations and any overflow into an adjacent allocation will have a mismatched tag and will t…

Implementing MTE is mostly another step in Apple’s efforts towards memory safety. There are bunch of things they’ve done to try to make this work a little better, but for obvious reasons, this is never going to be turned on by default for user apps and is only enabled for specific pathways.

> Because EMTE tag checking imposes a performance cost, we designed Memory Integrity Enforcement to take advantage of our secure allocators first and use EMTE to protect only smaller individual allocations within a type bucket, which software allocators can’t defend on their own.

Which seems to imply that outside of Apple’s targeted use in the kernel, the developer use of MTE on Apple platforms requires that you migrate your code to use their typed allocators…which I don’t know how many people are going to do that (and it is clear their answer is going to be to point people to Swift since it makes these types explicit for the compiler and even then, I am sure there are bugs in Swift in certain cases). Memory tagging is neat tech, but I don’t know if it’s going to gain all that much traction. It requires a burden that I suspect most app developers are not willing to take on and given that the user interaction is a crashy app. This is a path to nowhere except those of us who understand the trade-off.

Re: GrapheneOS says Pixel 11 has MTE support after all

#149

Post by Borealid »

Iolaum wrote: post #147
Borealid wrote: post #140

Earlier quoted context omitted.

[flagged]

Let's say you are a Graphene OS user. Why are you even using such an app? Also you are misrepresenting the threat model. The problem is not an app deleting it's own legitimate data. P.S. On GrapheneOS you can block apps from getting Internet access to limit their bad ideas.

[flagged]

Re: GrapheneOS says Pixel 11 has MTE support after all

#150

Post by gib444 »

Cider9986 wrote: post #146
Cider9986 wrote: post #114

Earlier quoted context omitted.

> If they happen to overlap, that's a happy coincidence. I can't know what the developers of any OS are actually thinking, but based their actions, GrapheneOS does more for their users than any other OS. Therefore I assume that doing good things for users equals care for users. It's probably stupid to try to guess about care.

Care: https://xprivate.lol/GrapheneOS/status/2094974844639068534#m

https://xprivate.lol/cryptofyre/status/2093880623005880440#m
Post reply on HN