Readit News logoReadit News
tranq_cassowary commented on GrapheneOS – Break Free from Google and Apple   blog.tomaszdunia.pl/graph... · Posted by u/to3k
thomastjeffery · a month ago
As great as GrapheneOS has been, I'm still tempted to switch to LineageOS. Sure, it would be objectively less secure, but at least then I might be able to disable the obnoxious "automatically disabled 3 unused background apps" notifications.

The biggest problem with security culture is its obsessive hyperfocus on security. Any change that could possibly be less secure (even in extremely exclusive circumstances) must be wrong. Even if it improves accessibility, it must be rejected out of hand.

GrapheneOS promises to liberate us from the enshittification of Google's anticompetitive moat; but it focuses that effort exclusively on security. Everything else that was enshittified gets carefully preserved as-is in the name of "security".

All I want is a mobile computer that does what I tell it to. Why is that constantly treated as an unreasonable fantasy?

tranq_cassowary · 24 days ago
> Even if it improves accessibility, it must be rejected out of hand

GrapheneOS has many exploit mitigations and those that would break compatability with too much apps are opt-in instead of opt-out. They also have per app toggles so you can decide to use them per app. So they certainly don't sacrifice accessibility for the highest level of security.

> GrapheneOS promises to liberate us from the enshittification of Google's anticompetitive moat

This isn't something GrapheneOS promises anywhere on their website. They aim to offer a secure and private OS with good compatability with Android apps.

> but it focuses that effort exclusively on security.

They focus on privacy and usability as well. Security is actually only focused on because the privacy features aren't enforceable without security.

> Why is that constantly treated as an unreasonable fantasy?

Because tinkering, hackability and unrestricted freedom aren't the purposes for which GrapheneOS was made.

tranq_cassowary commented on GrapheneOS – Break Free from Google and Apple   blog.tomaszdunia.pl/graph... · Posted by u/to3k
jokethrowaway · a month ago
I really don't want to give Google money so the Pixel is off for me until GrapheneOS supports something else.

For now I consider smartphones as disposable toys that can't be trusted with anything sensitive and use a computer for privacy.

I also don't like the idea of running Android, I still hope for a real linux phone at some point.

tranq_cassowary · 24 days ago
Phones, to just give one example, at least have fine-grained run-time permission controls while on Linux apps can just access anything the user can, except if you use something like Flatpak which gives you sandboxing but the quality of that sandboxing is still worse than Android 4.4 KitKat. How can you protect your sensitive info without such permission controls that gate access to your personal data?

Note that this is just one example, there are also other problems with traditional desktop OSes and a large portion of desktop hardware.

tranq_cassowary commented on GrapheneOS – Break Free from Google and Apple   blog.tomaszdunia.pl/graph... · Posted by u/to3k
zhouzhao · a month ago
>Because google actually cares about hardware and software security.

That statement might not have aged so well, especially consindering googles attempt to lock out apps from their devices, If the developers do not comply with being oficially registered.

tranq_cassowary · 24 days ago
That's not at all what Google announced.

It has nothing to do with devices. It has to do with OSes, most notably OSes certified by Google, which GrapheneOS isn't.

Also, it will be possible to bypass it even on certified OSes.

tranq_cassowary commented on GrapheneOS – Break Free from Google and Apple   blog.tomaszdunia.pl/graph... · Posted by u/to3k
kopirgan · a month ago
There's several AOSP based ROMs in forums like xda. Mostly developed by enthusiasts.

Recall using one years ago on my Samsung device with happy results. That was long before banking apps etc. Wondering what's the difference with this? Extra security?

tranq_cassowary · 24 days ago
This is a production grade OS, it's made by professionals, it's not hobbyist. It keeps up with updates of upstream Android and Linux kernel. It has a ton of good security and privacy features.
tranq_cassowary commented on GrapheneOS – Break Free from Google and Apple   blog.tomaszdunia.pl/graph... · Posted by u/to3k
H8crilA · 25 days ago
Does anyone have an answer to the problem of an OS for a laptop? I'm thinking about strong security here, less so about privacy (which is doable, for example via a Linux distribution).
tranq_cassowary · 24 days ago
ChromeOS (most secure OS), MacOS (most secure firmware and still much more secure OS compared to non-ChromeOS competitors)
tranq_cassowary commented on GrapheneOS – Break Free from Google and Apple   blog.tomaszdunia.pl/graph... · Posted by u/to3k
QuiEgo · 25 days ago
This is the phone version of saying “the power utility is an evil awful monopoly that treats me like shit, so I’m gonna get solar and batteries and go off grid.”

It’s cool it’s possible, but it’s not practical for most people.

tranq_cassowary · 24 days ago
What do you think the major practical downsides are? Maybe you are not aware of how many things perfectly work or how easy some workaround are, so I am wondering.
tranq_cassowary commented on GrapheneOS – Break Free from Google and Apple   blog.tomaszdunia.pl/graph... · Posted by u/to3k
linsomniac · 25 days ago
FYI: Google Fi + GrapheneOS doesn't work. My son recently tried setting up GrapheneOS and got everything working but couldn't get connected to Google Fi to work, even with a SIM card.
tranq_cassowary · 24 days ago
It works but you need to install the Google Fi app from the Google Play Store.
tranq_cassowary commented on GrapheneOS – Break Free from Google and Apple   blog.tomaszdunia.pl/graph... · Posted by u/to3k
Aachen · 25 days ago
Definitely one of the best features to have this in the native UI, though it's also possible in other ways

If anyone wants this without GrapheneOS: https://f-droid.org/packages/dev.ukanth.ufirewall

If anyone wants this without GrapheneOS and without root: https://f-droid.org/packages/net.kollnig.missioncontrol.fdro...

tranq_cassowary · 24 days ago
That's not at all a similar approach so it doesn't quality as "if anyone wants *this*). The GrapheneOS feature pretends the network is down and local host is also inaccessible. This is good for compatability (apps generally take into account that a network can be down) and too avoid apps knowing you are using the feature.
tranq_cassowary commented on GrapheneOS – Break Free from Google and Apple   blog.tomaszdunia.pl/graph... · Posted by u/to3k
Aachen · 25 days ago
Not sure if I'm understanding you right, but I wasn't saying that my experience is the only one that matters. Just that it's not a thing one notices in practice, at least not under conditions I've experienced (I figure a reader can fill in that last bit for a comment written in the first person). Saying AOSP's is "much, much faster" suggests it would be noticeable and afaik it's not (at human timescales), so I wanted to add that info to the thread

Good point about the USB thing btw. It's obvious to me and the reason why I go one step further and leave USB debugging always enabled now that there's this private key authorisation method anyway (it asks for computers whose key it doesn't yet trust), but indeed a lot of users might follow GrapheneOS' advice without realising

tranq_cassowary · 24 days ago
Leaving USB dubbing enabled just exposes a lot of attack surface. And if you use USB debugging you are placing a lot of trust in the computer you are connecting to. You don't need USB debugging to reflash GrapheneOS or to sideload updates from the recovery mode. So, it's not relevant to prevent a device brick.
tranq_cassowary commented on GrapheneOS – Break Free from Google and Apple   blog.tomaszdunia.pl/graph... · Posted by u/to3k
jeffbee · 25 days ago
That's great and, of course, only your experience matters to the choice of which OS you use. I just don't want people to get the impression there are no tradeoffs.

Another tradeoff GrapheneOS makes is because of the way they configure the USB port makes it more possible that you will irreversibly brick your phone by accident. You could say that the USB management is the only really material difference between Android and GrapheneOS when it comes to a law enforcement search threat model, but that also comes with a tradeoff.

tranq_cassowary · 24 days ago
It doesn't make it more possible to irreversibly brick your phone. Even if you set it to the most strict setting the port still works when you are in the bootloader and recovery modes. See https://grapheneos.org/features#usb-c-port-and-pogo-pins-con...

Also, it isn't the only materials difference in that threat model. To just give on example, the autoreboot feature is also useful for that.

u/tranq_cassowary

KarmaCake day105August 20, 2025View Original