Comment by mrbluecoat
1 day ago
"[GrapheneOS] lost most interest in that hardware due to the poor way privacy, security, updates and marketing based on these things has been handled."
https://discuss.grapheneos.org/d/28825-is-there-any-chance-o...
1 day ago
"[GrapheneOS] lost most interest in that hardware due to the poor way privacy, security, updates and marketing based on these things has been handled."
https://discuss.grapheneos.org/d/28825-is-there-any-chance-o...
I'm sure their concerns are valid but just because GrapheneOS don't consider the Fairphone to meet their standards for security doesn't mean it is not worth considering for other people who may have different priorities. Fairphones have certain advantages over Pixels such as better repairability and more ethically sourced labour/components. IMO it's good to see the Fairphone do well (and I hope GrapheneOS's partnership with Motorola also goes well).
Unfortunately it looks like it's not just a issue of missing hardware security features:
> Their partnership with Murena along with promoting it themselves with misleading marketing means no possibility of working with us.
I want to like GrapheneOS, but the pettiness of its leadership is a real problem for the long term prospect of the project.
As someone that swapped from fairphone 5 to a pixel9a with graphene.
I have to side with graphene. Fairphone is a cool concept, but its a expensive phone, early on i had problem with the speakers and mic. Security updates are extremely slow, support is extremely slow.
Their missions is to make a fair phone, but is it fair if you are then forced to buy more ewaste because your phone breaks? Look at pixel software support, its really good, and eu made batteries replacement mandatory.
Is it pettiness or just sticking to their morals? Murena, as they mentioned, forwards data to OpenAI which is against pretty much everything Graphene stands for.
22 replies →
That does not seem like pettiness to me. That seems like a very good reason to not work with someone.
4 replies →
Refusing to work with organizations or individuals that are detrimental to privacy and security is not petty.
Murena does not provide private or secure products and has positioned itself to be against what GrapheneOS provides. A partnership with a company opposed to GrapheneOS and spreading misinformation about it would not be beneficial, and it is not petty to make the smart choice for the benefit of privacy and security.
[flagged]
4 replies →
The Graphene devs can be a bit obsessive about security, but with a starting price above $600, I think the average user is probably better off with a Pixel 10a bought on sale closer to $300. The stock Fairphone OS seems to include Google services, which is kind of surprising and at odds with the focus on user control and all that.
Fairphones don't provide bare minimum privacy and security. Expecting that is not being obsessive. The flaws are increasingly glaring and easier than ever to exploit thanks to advances in AI models. People should care about this and should get a device with reasonable privacy and security such as an iPhone instead.
Fairphone 5 and earlier having an end-of-life Linux kernel with the Fairphone 6 coming up next is a disaster. Many months of delays for standard Android userspace patches from when they can first be shipped and years of delays for the full patches is also a major problem. An increasingly small portion of the patches is backported to older releases and they have months of delays for those.
Fairphones are also missing crucial industry standard hardware security features. People have come to expect their device will provide strong encryption with a random 6 digit PIN rather than a very strong passphrase but that's not the case with a Fairphone.
More information:
https://news.ycombinator.com/item?id=49354623
[flagged]
Here's a post with more specific allegations:
https://discuss.grapheneos.org/d/24134-devices-lacking-stand...
i dont get it, they are comparing eOS to graphene, not talking about the hardware.
this would be like grapheneOS not using pixel because the stock android that ships with it does not respect privacy.
am i missing something?
You still need to rely on the OEM to properly configure the bootloader, not leak the keys, and provide updated vendor blobs.
It should be doable with cooperation between the two, right?
If we add that FSF aims to provide free alternatives to some vendor blobs the landscape begins to look promising.[0]
One party to provide needed specs for hardware, one party to free the hardware from vendor blobs and another party to merge this into a working product.
[0] https://www.fsf.org/campaigns/librephone
[flagged]
2 replies →
[flagged]
One thing in the story is that the SPU - the secure enclave on Qualcomm chips that is separate from just running on TrustZone on the main processor - is only available on Snapdragon 8 and X tier products. It's market segmented away from 7 series and below.
Also, I think Qualcomm has only started supporting MTE on Snapdragon 8 Elite Gen 5. Older and cheaper SoCs do not support it yet. Outside that, I think only Google Tensor, recent Exynos generations, and Apple A-series support MTE (though IIRC Apple has an improved extension of it).
Snapdragon 8 Elite Gen 5 has at support for MTE. It doesn't yet support running the whole kernel and userspace with it in practice as GrapheneOS requires but we're going to be working on it with Motorola and Qualcomm.
Fairphone also had the publicly available test key flagged as trusted by the boot loader at one point, which probably discourages projects like GOS, since it makes it harder to trust the hardware to not be a weak link in security.