Live data from Hacker News

GrapheneOS is the only Android OS providing full security patches

grapheneos.social

181–190 of 467 posts

Re: GrapheneOS is the only Android OS providing full security patches

#181
post #60

Earlier quoted context omitted.

I'm not knowledgeable enough -- what would it take to escape the Apple/Google duopoly? I'm imagining a future where you buy a smartphone and when you do the first configuration, it asks you which services provider you want to use. Google and Apple are probably at the top of the list, but at the bottom there is "custom..." where you can specify the IP or host.domain of your own self-hosted setup. Then, when you downlo…

Any one of us here could learn the skills to design a smartphone. It won't necessarily be good, but I remember that years ago, someone made one with a touchscreen hat and GSM hat atop a Raspberry Pi, rubber-banded to a power bank. I'm sure any one of us HN users could do this. And it worked. Quality only goes up from there. The problem is it won't run any apps, so you'll need to carry this open-source secure phone in…

> Any one of us here could learn the skills to design a smartphone.

Unless you're Fabrice Bellard who literally created a 4G softmodem - no. It takes a whole lot of people (or, again, one genius Fabrice Bellard clone) to design a smartphone. You'll need AT THE VERY LEAST:

1) a SoC that has reasonably open device drivers and specifications - without that, all attempts are moot

2) a hardware engineer to deal with the PCB

3) a low-level system engineer to deal with the initial bringup (aka, porting u-boot and maintaining it)

4) an RF engineer to deal with the black magic that is designing ultra high performance PCBs that deal with the RF stuff (2G-5G phone networks, BT, WiFi, NFC, GPS) and high-frequency buses (storage, RAM, baseband, USB, PCIe, CSI/DSI)

5) a GPU driver engineer of the class of Alyssa Rosenzweig to get the GPU drivers to behave (she literally provided better-compliant drivers than Apple)

6) a battery engineer to ensure you don't end up with something like the ill-fated last Galaxy Note (that had to be fully recalled due to battery issues)

7) a ton of software engineers to get the basic things running that people expect from a smartphone (e.g. phone calls, 911, SMS, MMS, a browser and enough userland libraries so that third-party developers can begin to port games)

8) hosting engineers that deal with reliably delivering OS updates, application updates and A-GPS data

9) a skilled purchase and finance department to acquire all components as well as skilled QA people to make sure you don't get screwed in your supply chain by someone cutting corners or trying to engage in outright fraud

10) plastics and metal design engineers for the housing and other related engineering, and you'll probably also need engineers specializing in mass production and assembly as injection molding is a skillset on its own

11) engineers specializing in low power domains to get something that doesn't eat through the entire battery in a matter of hours

12) UX, UI designers to get something people can actually use (partially, that's also compliance stuff - think of accessibility laws)

13) testers to test your device against an insane load of other things - headsets, headphones, consumer and enterprise wifi, car head units, mice/keyboards, game controllers, USB hubs, monitors, projectors, adapters, dongles, IPv6 in its various abominations, phone network-side vendors, how devices behave in trains, cars, airplanes, cruise ships, in temperature and humidity extremes, under water, in back pockets (bending!), in dirt, dust, rain, being drenched in all kinds of beverages, muck, snow, fog, right next to extremely powerful broadcast radio transmitters, high magnetic/electric fields, teeth both human (toddlers) and animal (cats and dogs)...

14) logistics experts to deal with shipping, returns, refunds, recalls

15) customer support

16) psychoacoustics and acoustics engineers to make sure your device doesn't sound like shit (both what you hear, and that includes safeguarding the speakers from burning out, and what others hear from you, aka the beamforming stuff that the Asahi people reverse engineered)

17) video/colorspace engineers to make sure the whole darn thing isn't off color

18) camera/optics engineers, even if you acquire camera units these need to be integrated properly

19) lawyers and domain experts to deal with the compliance crap: RoHS, CE, FCC, India's regulatory authority, licensing, binary blobs, video codecs, audio codecs, carrier compliance testing, HDMI, HDCP, the RF compliance crap that's needed for US compliance [1], tariffs, sanctions laws... the list is endless

20) advertising (although admittedly, word-of-mouth could be sufficient), and PR in general (including websites, print media, AtL/BtL marketing)

21) deals with app developers, lest you end up like Windows Mobile

22) security testers/experts to make sure your devices don't get 0wned by cellebrite, mossad, nsa, cia, ...

23) human resources experts ("people engineers") to herd all the cats

24) packaging engineers to make sure the product arrives at the customer's hands both looking appealing and undamaged (tbh, that's at least four distinct skillsets as well)

You're looking at a minimum of 2-4 million $ for the engineers alone, another 4-5 million $ for the compliance crap, many millions for the app deals and way more in upfront cash for components and logistics chains.

That's why every attempt at a reasonably open source phone design has either failed or is many years behind the mass market. And the list of organisations attempting to do so include household names of the likes of Mozilla. And that is also why/how ODMs exist... they all have figured out some "minimum viable design" that gets tweaked a bit for the customer brand, and that's it. Everyone else went bust. Including, as mentioned, Microsoft. Including former powerhouses such as HTC. It's simply too complex to keep up.

On HN, we could probably drum together people of all these skillsets, no doubt (it took me half an hour to think of all these people and I'm pretty certain I've missed important aspects still!), and even ones with enough money to burn. But even then: the competition are the richest companies on the planet: Apple, Google, Samsung. Good luck...

(And yes: a minimum viable phone - probably a lot of people here including myself could whip that up using a COTS 5G modem, a Raspberry Pi and a power bank. But that's a MVP, not something you can sell to anyone less nerdy than Richard Stallman, and it's based off of the work of a lot of the people I just spent 58 minutes to think of and write down)

[1] https://github.com/lenovo/lenovo-wwan-unlock

Re: GrapheneOS is the only Android OS providing full security patches

#182

Graphene has really caught my eye in the last several months, but unfortunately I couldn't find a good deal for Pixel phones (>128GB storage), used or new. That's the biggest bottleneck for adoption it seems. I just finally switched from an S10E to a S25Ultra (black friday deal brought down to $820), but not being able to use Graphene in the future hurts a bit for sure.

Just wait for the new OEM to drop their phones with GrapheneOS support. Pixel hardware is garbage tier.

Re: GrapheneOS is the only Android OS providing full security patches

#184

Earlier quoted context omitted.

They have partnership an OEM who provides them with sources. Currently they're only permitted to release binaries of the patches due to the embargo, this is why these patches are in the parallel stream/optional (so people unhappy with being unable to see the sources won't have them shoved down their throats). I don't have URLs at hand at the moment but all these questions have been asked many times and explained exte…

> It's quite surreal how unsafe the standard Android Well that's untrue. I'd even venture to say that with how many OEMs there are it's insane how safe Android is. Google for one updates their devices for 7 years since Pixel 6, they can't control OEMs who might have ~10 people working on their devices.

> Google for one updates their devices for 7 years since Pixel 6

Pixel 8 https://endoflife.date/pixel

Re: GrapheneOS is the only Android OS providing full security patches

#185

Earlier quoted context omitted.

This is excellent news. Google doesn't sell Pixels in my country for some reason. Hopefully the new phones will be easier to obtain.

Have you considered using mail forwarding, or sites like Swappa.com with forwarding built in? Hoping this helps you get your hands on a cheap Pixel!

That's not only adding to cost but also doesn't solve the issue of why you would buy a new phone - warranty.

Re: GrapheneOS is the only Android OS providing full security patches

#186

https://tbot.substack.com/p/grapheneos-new-oem-partnership > GrapheneOS has officially confirmed a major new hardware partnership—one that marks the end of its long-standing Pixel exclusivity. According to the team, work with a major Android OEM began in June and is now moving toward the development of a next-generation smartphone built to meet GrapheneOS’ strict privacy and security standards.

I wonder if a real OEM supports graphene if that would solve device attestation for things like banking apps.

Never underestimate stupid, especially for that sector.

Re: GrapheneOS is the only Android OS providing full security patches

#187
post #185

Earlier quoted context omitted.

Have you considered using mail forwarding, or sites like Swappa.com with forwarding built in? Hoping this helps you get your hands on a cheap Pixel!

That's not only adding to cost but also doesn't solve the issue of why you would buy a new phone - warranty.

They just said Pixels.

Nothing about brand new ones.

Just that the new ones might be easier to buy international.

Phone without warranty is better than phone you hate, or phone with OS you disagree fundamentally with - in my opinion.

Re: GrapheneOS is the only Android OS providing full security patches

#189
post #167

Earlier quoted context omitted.

This is really cool, but, longer term, what happens if Google makes android closed source? I feel this is a very real risk.

Not sure if the big manufacturers would want to depend on a proprietary Google OS. Samsung does make a lot of changes to the OS, for instance.

> Not sure if the big manufacturers would want to depend on a proprietary Google OS.

They already do; Google's flavour of Android adds plenty of proprietary components on top of AOSP.

Post reply on HN