We have a partial port of GrapheneOS to the Pixel 11 series after a week of work on it. We're unable to complete the port due to lack of support for ARM hardware memory tagging in software, firmware and near certainly hardware. It appears Google cut an important security feature to save money.
Wish they’d focus on phones NOT made by major corporations like Google and Motorola, and instead focus on small companies’ phones like Fairphone, Pine64, Purism, Jolla, etc.
They can’t. They require extremely up to date firmware and very short update cycles. Only large corporations with huge phone platforms are able to do satisfy that.
That is mincing words but as long as they don’t change their requirements (which they don’t want to) they actually can’t, without failing those requirements.
Short-sighted goal in my opinion. They could be the leader in privacy for smartphones from the bottom up, including hardware and software.
GOS’s work with Motorola might just lead Motorola to be that group as they always have for decades, so my issues might go away anyways.
Just getting arrogant, self-isolating vibes when they have soooo much good will with the tech community on building privacy from the ground up in some of the most important intelligent devices in our lives.
Why can’t GOS join a working group with ISO or IEC or IEEE or other groups to create roadmaps and tiers of compliance so that other manufacturers have means and methods of approaching GOS’s lofty goals.
Can Graphene OS achieve their privacy targets and principles in different ways that encourage collaboration with non-corporations?
I refuse to believe that GOS can’t agree to graduated privacy provisions according to the capabilities of Linux and sustainable/repairable non-corpo companies and their phones.
Well, than you should read what GOS developers have to say about that, they are pretty clear on it. They absolutely do not accept any compromise on that, even if that means being forced to rely on cooperation by big corporations for hardware and firmware. I don’t even judge that, it is just merely how it is.
I want them to keep their principles, and at the same time partner with some Linux group or some other working group representing Open-Source Hardware (OSH) so that one day we don’t HAVE to rely on corporations for true privacy with our smartphones.
I can’t see how that is possible without compromising on their security requirements. The hardware isn’t the problem here, that could be overcome, the extremely rapid firmware updating reqirement is. That needs huge resources, hence they are using so far a device from the huge comoany behind the Android ecosystem. Already Motorola, another huge compaby is stretchung that requirement, as tgey are not sitting at the source of that ecosystem.
Again, I am not defending GrapheneOS’ choice, just describing their dilemma
The hardware requirements are public. Those manufacturers have chosen not to implement supported hardware, which is step 0.
There is also a maintenance burden for the GrapheneOS team. The ROM requires kernel patches and driver work that makes supporting additional phones intensive work.
Why would manufacturers choose to meet GOS’s extra requirements?
There needs to be a give and take. It seems like GOS’s mantra is their way or the high way, which isn’t collaborative in the slightest.
Can there not be discussions held between Linux and sustainable/repairable OEMs and GOS to start integrating each other’s requirements? Diplomacy/negotiations/working groups are just completely neglected?
If GrapheneOS can’t handle the maintenance burden, there is nothing to negotiate.
Presumably, maintaining software for a niche phone requires effort similar in magnitude to a larger, mainstream phone. Why, then, would a solely privacy-oriented org choose to cater to a smaller audience?
GrapheneOS is an open-source fork of AOSP. Anyone could fork it again and provide kernel modules/drivers for their hardware.
To my knowledge, GrapheneOS is not standards-based. They take one operating system, and tweak it. I don’t know if there are relevant standards to contribute to, or even standards bodies to approve them.
Thanks for taking the time to educate someone that is STEM-studied but not necessarily in computer hardware/software.
Given that GrapheneOS picked AOSP to be their canvas with which to tighten down the hatches and improve the base AOSP platform’s privacy characteristics, this to me indicates that nothing is stopping GOS from doing the same and contributing to other major platforms intended for mobile devices. Unless of course bandwidth is an issue for them, then they can’t contribute to more than just their AOSP fork.
As someone who uses tech and doesn’t really develop it, I would appreciate GrapheneOS expanding their vision to other software/hardware platforms like those being worked on by the Ubuntu Touch, SailfishOS, PostmarketOS, etc. teams.
I’m not advocating that GOS work on all of these, but I am advocate for GOS to branch off from corporate dependence in the event Motorola goes the way of Google.
If one thing capitalism has shown us over the last 100+ years, corporations that can enshittify will enshittify. It’s only a matter of time, and it’d be better imo for GOS to start pivoting sooner rather than later.
Unless GOS are ok with ceasing their entire project once Motorola drops them. Maybe they’re confident in that bet. I wouldn’t be, being a FOSS advocate myself nowadays.
GOS is designed for maximum security at its base. It uses all the hardware features it requires to minimize its attack surface against adversaries that have infinite resources to attack the device and get at the infirmation inside.
Lowering those standards means opening a vulnerability, which means someone with that vulnerability can have their data stolen from the device in particularly that way, since that vulnerability is well documented.
How come other phones by Samsung, Apple, etc. seem to be doing alright despite not meeting the hyper restrictive requirements of GrapheneOS?
I reject that GrapheneOS can’t continue to do their work with Google Pixels and Motorola and NOT encourage open-source hardware developers to integrate GOS’s so that one day we can have open-source, privacy-first, truly-secure, repairable, sustainable communications devices.
It seems to me like GrapheneOS could lead the world in pushing this topic by creating cross-industry working groups to focus on fixing vulnerabilities in some of the most important intelligent devices existing today.
There could be organizations like IEEE or IEC that GOS may or may not work with, but no one has given me an answer for that. GOS seems self-isolated and therefore self-serving, as an outsider. I don’t understand why they can’t do more outreach to build coalitions in the industry, if they aren’t already.
There is a lot of government / intelligence agency interest in making sure devices can be hacked into… see the whole FBI vs. Apple thing from some time back.
Most device manufacturers are trying to keep costs down… adding security features adds R&D money they have to spend and pass on to the devices as sold.
Most people don’t know or care their devices are easily hackable… until it affects them personally.
Some people have to use GOS because enemy nations are targeting them and their devices in particular for hacking into, and normal devices are easy to break into… see Pegasus.
I agree that GrapheneOS is useful for some and vital for many people in the world.
What I’m asking (and demanding) is for GrapheneOS to not put all their eggs in one basket, and to develop alternatives. I don’t think GOS investing in phone manufacturing with Motorola will last forever, just as Google didn’t. Having non-corporate options is imperative as Big Tech ramps up more and more surveillance, walled off gardens, and enshittification
Using a widely-available phone with good performance, decent quality, and long term security support, meant that more people could access it. I still can’t buy a Fairphone without going through an overseas middleman, then hoping I have no warranty issues, because they don’t sell to Australia. If something goes wrong with my Pixel, the shop I bought it from is minutes away.
Wish they’d focus on phones NOT made by major corporations like Google and Motorola, and instead focus on small companies’ phones like Fairphone, Pine64, Purism, Jolla, etc.
They can’t. They require extremely up to date firmware and very short update cycles. Only large corporations with huge phone platforms are able to do satisfy that.
They don’t want to, which is fine for their goal of having the absolutely most secure phone possible.
That is mincing words but as long as they don’t change their requirements (which they don’t want to) they actually can’t, without failing those requirements.
Short-sighted goal in my opinion. They could be the leader in privacy for smartphones from the bottom up, including hardware and software.
GOS’s work with Motorola might just lead Motorola to be that group as they always have for decades, so my issues might go away anyways.
Just getting arrogant, self-isolating vibes when they have soooo much good will with the tech community on building privacy from the ground up in some of the most important intelligent devices in our lives.
Why can’t GOS join a working group with ISO or IEC or IEEE or other groups to create roadmaps and tiers of compliance so that other manufacturers have means and methods of approaching GOS’s lofty goals.
Can Graphene OS achieve their privacy targets and principles in different ways that encourage collaboration with non-corporations?
I refuse to believe that GOS can’t agree to graduated privacy provisions according to the capabilities of Linux and sustainable/repairable non-corpo companies and their phones.
Well, than you should read what GOS developers have to say about that, they are pretty clear on it. They absolutely do not accept any compromise on that, even if that means being forced to rely on cooperation by big corporations for hardware and firmware. I don’t even judge that, it is just merely how it is.
I am judging that.
I want them to keep their principles, and at the same time partner with some Linux group or some other working group representing Open-Source Hardware (OSH) so that one day we don’t HAVE to rely on corporations for true privacy with our smartphones.
I can’t see how that is possible without compromising on their security requirements. The hardware isn’t the problem here, that could be overcome, the extremely rapid firmware updating reqirement is. That needs huge resources, hence they are using so far a device from the huge comoany behind the Android ecosystem. Already Motorola, another huge compaby is stretchung that requirement, as tgey are not sitting at the source of that ecosystem.
Again, I am not defending GrapheneOS’ choice, just describing their dilemma
Those also don’t meet the hardware requirements
But why can’t GrapheneOS work with those companies to ACQUIRE the right hardware requirements, rather than leaning on a corporation?
The hardware requirements are public. Those manufacturers have chosen not to implement supported hardware, which is step 0.
There is also a maintenance burden for the GrapheneOS team. The ROM requires kernel patches and driver work that makes supporting additional phones intensive work.
Why would manufacturers choose to meet GOS’s extra requirements?
There needs to be a give and take. It seems like GOS’s mantra is their way or the high way, which isn’t collaborative in the slightest.
Can there not be discussions held between Linux and sustainable/repairable OEMs and GOS to start integrating each other’s requirements? Diplomacy/negotiations/working groups are just completely neglected?
If GrapheneOS can’t handle the maintenance burden, there is nothing to negotiate.
Presumably, maintaining software for a niche phone requires effort similar in magnitude to a larger, mainstream phone. Why, then, would a solely privacy-oriented org choose to cater to a smaller audience?
Can other organizations replicate GrapheneOS’s principles in ways where THOSE organizations can maintain the burden?
Is GrapheneOS working towards industry wide standards on privacy-first operating systems from the hardware up?
Are they contributing to the field at large, or are they keeping to themselves out of self preservation (or selfishness)?
GrapheneOS is an open-source fork of AOSP. Anyone could fork it again and provide kernel modules/drivers for their hardware.
To my knowledge, GrapheneOS is not standards-based. They take one operating system, and tweak it. I don’t know if there are relevant standards to contribute to, or even standards bodies to approve them.
Thanks for taking the time to educate someone that is STEM-studied but not necessarily in computer hardware/software.
Given that GrapheneOS picked AOSP to be their canvas with which to tighten down the hatches and improve the base AOSP platform’s privacy characteristics, this to me indicates that nothing is stopping GOS from doing the same and contributing to other major platforms intended for mobile devices. Unless of course bandwidth is an issue for them, then they can’t contribute to more than just their AOSP fork.
As someone who uses tech and doesn’t really develop it, I would appreciate GrapheneOS expanding their vision to other software/hardware platforms like those being worked on by the Ubuntu Touch, SailfishOS, PostmarketOS, etc. teams.
I’m not advocating that GOS work on all of these, but I am advocate for GOS to branch off from corporate dependence in the event Motorola goes the way of Google.
If one thing capitalism has shown us over the last 100+ years, corporations that can enshittify will enshittify. It’s only a matter of time, and it’d be better imo for GOS to start pivoting sooner rather than later.
Unless GOS are ok with ceasing their entire project once Motorola drops them. Maybe they’re confident in that bet. I wouldn’t be, being a FOSS advocate myself nowadays.
GOS is designed for maximum security at its base. It uses all the hardware features it requires to minimize its attack surface against adversaries that have infinite resources to attack the device and get at the infirmation inside.
Lowering those standards means opening a vulnerability, which means someone with that vulnerability can have their data stolen from the device in particularly that way, since that vulnerability is well documented.
How come other phones by Samsung, Apple, etc. seem to be doing alright despite not meeting the hyper restrictive requirements of GrapheneOS?
I reject that GrapheneOS can’t continue to do their work with Google Pixels and Motorola and NOT encourage open-source hardware developers to integrate GOS’s so that one day we can have open-source, privacy-first, truly-secure, repairable, sustainable communications devices.
It seems to me like GrapheneOS could lead the world in pushing this topic by creating cross-industry working groups to focus on fixing vulnerabilities in some of the most important intelligent devices existing today.
There could be organizations like IEEE or IEC that GOS may or may not work with, but no one has given me an answer for that. GOS seems self-isolated and therefore self-serving, as an outsider. I don’t understand why they can’t do more outreach to build coalitions in the industry, if they aren’t already.
There is a lot of government / intelligence agency interest in making sure devices can be hacked into… see the whole FBI vs. Apple thing from some time back.
Most device manufacturers are trying to keep costs down… adding security features adds R&D money they have to spend and pass on to the devices as sold.
Most people don’t know or care their devices are easily hackable… until it affects them personally.
Some people have to use GOS because enemy nations are targeting them and their devices in particular for hacking into, and normal devices are easy to break into… see Pegasus.
I agree that GrapheneOS is useful for some and vital for many people in the world.
What I’m asking (and demanding) is for GrapheneOS to not put all their eggs in one basket, and to develop alternatives. I don’t think GOS investing in phone manufacturing with Motorola will last forever, just as Google didn’t. Having non-corporate options is imperative as Big Tech ramps up more and more surveillance, walled off gardens, and enshittification
Using a widely-available phone with good performance, decent quality, and long term security support, meant that more people could access it. I still can’t buy a Fairphone without going through an overseas middleman, then hoping I have no warranty issues, because they don’t sell to Australia. If something goes wrong with my Pixel, the shop I bought it from is minutes away.
Those that can purchase these Linux phones should.
Those that can’t purchase these Linux phones should purchase whatever is next best.