Comment by yjftsjthsd-h
2 days ago
> For the freedom and security nerds they’re better off with GrapheneOS on Pixel or whatever upcoming Motorola phones will support it.
Not quite. The people who care about security first are better off with GOS, yes. However, GOS's threat model very specifically treats the user as a thing to defend against; the freedom-first crowd should avoid them.
Well said. I would say in general there isn't "the best" OS for everyone and never will be, because each OS makes different trade-offs. I for one want primarily what is understood to be "general purpose computer". Other people rightly don't care about that and want a maximum security device, one that even protects users from their own mistakes (of course putting more trust in the makers of the OS). What we should care about is that people have a choice and can get whatever they prefer.
To answer GPs point, I think Fairphone doesn't primarily target either of the two audiences. I think they primarily target the people that care about the ethics of the creation of the hardware. Basically people who would like to minimize the invisible human cost that their phone creates.
> However, GOS's threat model very specifically treats the user as a thing to defend against
Can you elaborate?
GOS mostly honours the Android security model, which many alternatives don't do (many times they don't have a choice because the device doesn't allow them to relock the bootloader, so they just defeat the whole security model from the moment you install).
There is absolutely nothing that can be done on a Stock Android and that I cannot do on GrapheneOS. Or at least I haven't found it.
Yes, GOS is probably a direct improvement over stock android; I would also describe that as suboptimal from a user freedom perspective. Really, most of my beef with GOS is that its developers strongly object to user-controlled root. On my phone, I can run a backup app, give it root access, and backup/restore any app at will. Or, I can run a file manager with root access and inspect any data in the system. The GOS devs object to this on the grounds that any user-installed app getting root undermines their entire security model (and some other arguments that I'm going to skip because I'm trying to steel-man). And that's actually a perfectly valid argument; handing root access to apps does break their security model, but if the user doesn't have root then I'd contest the idea that the user is in control. And of course there is the fact that I have actual uses for root that GOS doesn't provide. (There are some other variants of this basic tension, like bootloader locking, but I think root is the biggest instance and representative.)
> And that's actually a perfectly valid argument; handing root access to apps does break their security model, but if the user doesn't have root then I'd contest the idea that the user is in control.
First, "protecting against an app running with user permissions" does not mean "considering that the human owning the device is malevolent", right?
The idea is that if the human installs a malware, we don't want that malware to own the system. I think it is completely fair, and for most people it is the better deal.
Second, your complaint about GOS is that you want root access, and they don't provide it. You want a feature they don't provide, sure, but that happens. And that's probably a good reason to use an alternative system. But turning "I want feature X" into "if you don't provide the feature I want, then you are not free software" is manipulative IMO. GrapheneOS is as open source as it gets, you can fork it and install it on your Pixel. It is free software. Maybe not the software you want (that's okay, different people have different preferences), but free software nonetheless.
Since we're steelmanning, I would like to add a bit more.
GrapheneOS will never be closed source/proprietary because they believe code freedom (and user freedom by extension) is paramount. They have repeatedly said they don't have the resources to build a ChromeOS-esque firmware authentication and warning flow for ephemeral user-accessible root and support those builds alongside the existing production environment. They have NOT said it is something they have no interest in even discussing. They have also repeatedly said that where the utility is clearly demonstrated and can be architected in a maintainable way, they are open to contributions (and continued maintenance) that properly enable functions that people unnecessarily need to abuse root privileges for.
The main goal of their project is a system that can protect your personal thoughts, associations and memories to the best of its ability (against thieves, attackers, surveillance etc.) while preserving your interaction with the world. Current OSes (including GrapheneOS and iOS) are already far behind where they should be given the wealth of privacy enhancing technology, computer hardware security, systems engineering and OS design knowledge that has existed for decades- so their work is cut out for them and they are putting everything they have into leading the industry. Their hands are already full. For clear use cases the path of least resistance would be to contribute and commit to maintaining features everyone would benefit from.
If it is a feature/function someone understands they would benefit from personally but do not see the value to impose on others, we can circle back to the original fact which is that GrapheneOS is open source and can be bent/built to your will.