Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GrapheneOS is the only Android OS providing full security patches

grapheneos.social

Post reply on HN
Print view View original

61–70 of 467 posts

Re: GrapheneOS is the only Android OS providing full security patches

#61

Post by immibis »

vbezhenar wrote: post #44
fmajid wrote: post #20

Earlier quoted context omitted.

Most ARM devices don't have UEFI or a standardized hardware abstraction layer as x86/x64 does, a prerequisite for having a choice of OSes.

I don't believe that's the true problem. Booting operating system is not a problem. There's no standardized hardware abstraction layer in PC either, every OS brings their own set of drivers. My guess is that modern hardware is too complicated for one hacker to write reliable drivers. That wasn't the case back in the 90-s, when Linux matured. So we are at mercy of hardware manufacturers and they happened to not be int…

In the ARM world, there isn't even a standard way to boot, and there are no standard hardware interfaces - except maybe the interrupt controller, since it's part of the CPU and only ARM designs the CPUs.

On any PC, you can still use BIOS/UEFI services to get a basic framebuffer and keyboard input. You cannot do that on embedded ARM devices - you need to get several layers into the graphics stack to have a framebuffer. I tried it on the PinePhone, using existing source code as a reference, and the furthest I got was sending commands from the video port to the LCD controller and then not having an oscilloscope to see if the LCD controller replied back.

Re: GrapheneOS is the only Android OS providing full security patches

#62

Post by AnthonyMouse »

idle_zealot wrote: post #13
SubiculumCode wrote: post #11

Why was it that in the early PC days, IBM was unable to keep a lid on 'IBM compatible', allowing for the PC interoperability explosion, yet today, almost every phone has closed drivers, closed and locked bootloaders, and almost complete corporate control over our devices? Why are there not yet a plethora of phones on the market that allow anyone to install their OS of choice?

> Why are there not yet a plethora of phones on the market that allow anyone to install their OS of choice? There are technical reasons, but as ever the real underlying causes are incentives. Companies realized that the OS is a profit center, something they can use to influence user behavior to their benefit. Before the goal was to be a hardware company and offer the best hardware possible for cost. Now the goal is t…

> So why would a company, in this new environment, invest resources in making their hardware compatible with competing software environments?

Because that's what customers want to buy. People are paying premium iPhone prices for hardware with mediocre specs and then the hardware sells out when someone like Purism or Fairphone actually makes an open one. How many sales would you get if you did the same thing on a phone that was actually price/performance competitive with the closed ones?

Meanwhile all of that "profit center" talk is MBA hopium. Nobody is actually using the Xiaomi App Store, least of all the people who would put a different OS on their phone.

The real problem here is Google. Hardware attestation needs to be an antitrust violation the same as Microsoft intentionally breaking software when you tried to run it on a competing version of DOS and for exactly the same reason.

Re: GrapheneOS is the only Android OS providing full security patches

#63

Post by immibis »

subscribed wrote: post #19
piyuv wrote: post #18

Earlier quoted context omitted.

Cory Doctorow answers this in his book “The Internet Con”. IBM fought with DoJ for years. Today, it’s a felony to mess with anything locked down (anti circumvention)

I don't think it's a felony to root/jailbreak one's own phone.

It is. 17 U.S. Code § 1201 - Circumvention of copyright protection systems

Re: GrapheneOS is the only Android OS providing full security patches

#64

Post by morserer »

y-c-o-m-b wrote: post #28

Graphene has really caught my eye in the last several months, but unfortunately I couldn't find a good deal for Pixel phones (>128GB storage), used or new. That's the biggest bottleneck for adoption it seems. I just finally switched from an S10E to a S25Ultra (black friday deal brought down to $820), but not being able to use Graphene in the future hurts a bit for sure.

Goodness, friend, where were you looking?

A used 256GB Pixel 8 in good condition is $320. https://swappa.com/listings/google-pixel-8?carrier=unlocked&...

Re: GrapheneOS is the only Android OS providing full security patches

#65

Post by JoshTriplett »

tenthirtyam wrote: post #57
axelthegerman wrote: post #21

Earlier quoted context omitted.

Oh that's one of the best news in the smartphone world in a long time. It's impossible to escape the Apple/Google duopoly but at least GrapheneOS makes the most out of Android regarding privacy. I still wish we could get some kind of low resource, stable and mature Android clone instead of Google needlessly increasing complexity but this will over time break app compatibility (Google will make sure of it) Edit: I do…

I'm not knowledgeable enough -- what would it take to escape the Apple/Google duopoly? I'm imagining a future where you buy a smartphone and when you do the first configuration, it asks you which services provider you want to use. Google and Apple are probably at the top of the list, but at the bottom there is "custom..." where you can specify the IP or host.domain of your own self-hosted setup. Then, when you downlo…

> I'm not knowledgeable enough -- what would it take to escape the Apple/Google duopoly?

At this point? Reliable emulation that can run 99% of Android apps, to provide a bridge until the platform is interesting enough for people to develop for it "natively".

I think the easiest way to do that would be to run Android in a VM.

Re: GrapheneOS is the only Android OS providing full security patches

#66

Post by wafflemaker »

AnthonyMouse wrote: post #56
SubiculumCode wrote: post #41

Earlier quoted context omitted.

Yeah but lots of phones you can't get ROMs for from a reputable source, and I sure as heck don't have the know how or time to build one, even if possible, which a lot of times is not due to locking down bootloaders, drivers, etc.

But that has the same cause. When you buy a Windows PC, the first thing a lot of tech people will do is format it and put on a clean install of Windows without all of the OEM crapware, or in these days install Linux if grandma is just using email and Facebook anyway. If you try to do that on your Android device, your bank app is broken, most importantly not because of anything the alternate OS is doing wrong , which…

For me the bank app was working, but the electric scooter app didn't and that was it for me :( Damn e-scooters, can't live without them.

But I still haven't contacted the support to ask them to verify phones in another way.

Re: GrapheneOS is the only Android OS providing full security patches

#67

Post by akimbostrawman »

zekica wrote: post #12
nanomonkey wrote: post #5

As a LineageOS user, I'd be interested in the disparity between GrapheneOS and LineageOS.

They have different goals: GrapheneOS wants to make a FOSS Android with the security model that makes it hard for any bad party to break into the phone. LineageOS wants to make a FOSS Android that respects user's privacy first and foremost - it implements security as best as it can but the level of security protections differs on different supported devices. Good news is that if you have a boot passphrase, it's secur…

that is simply wrong.

GrapheneOS is both in terms of security and privacy the best but currently only supports pixel phones.

LineageOS is trying to support as many devices as possible still with lot of google connections and missing security updates.

>Good news is that if you have a boot passphrase, it's security is somewhat close to GrapheneOS

its not anywhere close https://grapheneos.org/features

Re: GrapheneOS is the only Android OS providing full security patches

#68

Post by gunalx »

JoshTriplett wrote: post #65
tenthirtyam wrote: post #57

Earlier quoted context omitted.

I'm not knowledgeable enough -- what would it take to escape the Apple/Google duopoly? I'm imagining a future where you buy a smartphone and when you do the first configuration, it asks you which services provider you want to use. Google and Apple are probably at the top of the list, but at the bottom there is "custom..." where you can specify the IP or host.domain of your own self-hosted setup. Then, when you downlo…

> I'm not knowledgeable enough -- what would it take to escape the Apple/Google duopoly? At this point? Reliable emulation that can run 99% of Android apps, to provide a bridge until the platform is interesting enough for people to develop for it "natively". I think the easiest way to do that would be to run Android in a VM.

You can go the waydroid style with namespacing, or native containers if using the linux kernel. No need to do a full vm

Re: GrapheneOS is the only Android OS providing full security patches

#69

Post by sroussey »

AnthonyMouse wrote: post #62
idle_zealot wrote: post #13

Earlier quoted context omitted.

> Why are there not yet a plethora of phones on the market that allow anyone to install their OS of choice? There are technical reasons, but as ever the real underlying causes are incentives. Companies realized that the OS is a profit center, something they can use to influence user behavior to their benefit. Before the goal was to be a hardware company and offer the best hardware possible for cost. Now the goal is t…

> So why would a company, in this new environment, invest resources in making their hardware compatible with competing software environments? Because that's what customers want to buy. People are paying premium iPhone prices for hardware with mediocre specs and then the hardware sells out when someone like Purism or Fairphone actually makes an open one. How many sales would you get if you did the same thing on a phon…

Some of the funnest work, if you could get it, was swapping ssds out of laptops coming through customs for high value targets.

Re: GrapheneOS is the only Android OS providing full security patches

#70

Post by Terr_ »

subscribed wrote: post #35
mcsniff wrote: post #10

Earlier quoted context omitted.

If you care about security above all else and you have a Pixel, GrapheneOS should really be your only consideration. LineageOS has a place for those who care less about security and more about features, "freedom", compatibility, community etc... I was a LOS user and maintained my own forks for devices, but switching to GrapheneOS was a good decision and I don't really miss anything.

It might be important to mention, that Lineage OS is available on a number of the devices abandoned by their original vendors, so sometimes it may be a much better solution to get a Lineage OS onto their former "flagship" which stopped getting updates 18 months after the release. So if the bootloader can be relocked and not passing Play Integrity scam is not a problem, Lineage may be a better option. Better than noth…

Just yesterday I took an old Motorola smartphone from 8 years ago (Android 9) and put LineageOS on it.

Poof, it's transformed from unusually-glitchy e-waste to a tool someone can actually benefit from.

> So if the bootloader can be relocked

Their website says they recommend against that and will not support it, because of a high chance the device will get bricked. :(

Post reply on HN