Comment by wps

16 hours ago

The amount of roadblocks Google is putting up for GrapheneOS is just ridiculous. None of their decisions make any sense, from the delayed source patches upstream, to the embargos, attestation issues, etc. Google simply regrets android being open source.

I hope people remember this when advocating for chromium. Just because it is open source doesn't mean they don't control it. We need to start the long process of hard forking now or turn to alternatives like Firefox as a new foundation.

  > Google simply regrets android being open source.

Android wouldn't be what it is if it wasn't open source. With all the work from outside Google. The same is true chrome.

But they won't learn that on their own. They are breaking the deals. So we move. We force their hand

  • > But they won't learn that on their own

    I think they're fully aware of this. They just don't care, because the goal of "get market share super high" has been reached, so now they have no need for it to continue being open.

    I don't disagree about what that means we should do; I just don't think we should assume they're being naive here. It's like writing a program to play chess; you should select your move assuming the opponent is smart and will make the optimal counterplay rather than assuming weakness, and then if they end up being less smart than that, you're still in a good place.

    • Tbh I don't think fighting open source is Google's best play. I think it is in their own best interest to keep it fully open. It is free labor by those who are most passionate. It gives strong signals at what people want, this direction you develop. It strengthens security as more people try to test it. It means people work on forks rather than alternatives. All this is true even with a monopolistic market share.

      So yes, I do think they are being naïve. The stance is myopic. It is only a good move in the short term, and barely even that. It is under the false belief that we operate in a zero sum game.

      5 replies →

  • Hard forking doesn't solve the problem of closed source.

    If the goal of a hard fork is "the community will invest equal resources that Google does today" then you wildly underestimate how many engineers work on Chrome.

    • Not denying than many engineers work on Chrome just wondering how many of them work on Chrome features that are anti pattern, reducing privacy, improving information collection or tracking or against users interest in broad.

      1 reply →

    • Can anyone actually share 1 - 3 examples where a hard fork of a living os project has actually succeeded ?

      If AMZN couldnt make their fire whatever it was called fork of Android really grow, what chance has the community got ?

      5 replies →

    • >wildly underestimate how many engineers work on Chrome.

      It is completely insane how many people work on Chrome. It seems like it is time to deprecate web browsers and do something different. Like you get a frame-buffer to draw on with something like a wasm vm. Web pages get replaced by programs (which they essentially are anyway). Get rid of 99.9% of the cruft that has accumulated over the decades in browsers. If you want to have some of that cruft, that is a library you have to send.

      8 replies →

    • But the open source project wouldn’t need to invest as much as Google does. There are all kinds of features and things they are working on that the general public really does not care about.

      6 replies →

    • The bigger problem is wasting developer effort contributing to Google's platform. The real secret behind Android being "open" (sorta) is that while almost nobody runs AOSP, Google has tricked a bunch of fools into working on Android forks instead of building a real competitor.

      Playing at their table is a losing game, the house always wins.

      21 replies →

  • > Android wouldn't be what it is if it wasn't open source.

    Yes, and now that they've achieved market saturation, it's time to pull up the ladder.

    Thanks for all the free work, suckers!

  • I would say its even more proactive than support other projects. It is becoming clearer that every single technically competent member of the friends or family is now required to educate and proactively change devices.

    Remember this upcoming Christmas that the ye oldie tradition of fixing PCs clearing awful exploiting phone apps (and cancelling subscriptions) should also include the "fix my browser" again, instead of Internet Explorer being replaced by Chrome, our collective duties is to replace Chrome with Firefox, plus its useful extensions to block ads and improve the web experience removing trackers etc.

    Your call to arms today is to ensure all your tech colleagues join the movement, and then we can see Google's management views on "market growth"; they forget they made Chrome, we sold it - its our fault we forgot the "infinite growth of shareholder value"...

  • What's the licensing on AOSP? Everything I look for points to Google-owned things. Is it a GPL/similar that Google is actually legally required to share its changes?

  • > or turn to alternatives like Firefox as a new foundation.

    With the way Firefox is heading, that might not be the best idea. Nowadays Mozilla seem more focused on riding the AI-hype wave than actually making an excellent browser people want to actually use.

    • Is Firefox or Mozilla perfect? Heck no. But we're not comparing Mozilla against pre-IBM Red Hat or Ben & Jerry's or whatever your concept of the ideal corporate citizen is. We're comparing Mozilla against Google. That's a very low bar that Mozilla clears with ease, especially if you're criteria includes shoving AI down your throat.

      5 replies →

    • Mozilla definitely wastes a bunch of money building features I don’t want. But underneath it all, Firefox is still an excellent web browser. You just occasionally have to disable “pocket” or “gadgets” or something.

    • It is sad to see Firefox riding various hype trains over the years, but I can't really blame them. Miss the wrong train, and you fall behind and may not be able to catch up. Miss the train to nowhere, and you are only wasting resources.

      As for the excellent browser that people want, that raises the question of what people want. There are likely as many answers as people.

      12 replies →

  • > or turn to alternatives like Firefox

    Implying I ever left Firefox in the first place.

  • > So we move. We force their hand

    What do you have in mind?

  • LOL "start" using Firefox. I've been using Firefox for half a decade. There's zero I miss about Chrome.

    • Rather than being smug, I’ll say awesome! The best time to start using Firefox is yesterday. The second best time is now.

      IOW:

      Don’t threaten to stop using Google Chrome if they do one more evil thing. Start now.

  • There are already several different forks of Chromium and they are able to make their own decisions on points where they want to differentiate from upstream or other browsers in the market.

  • > Just because it is open source doesn't mean they don't control it

    Just point out how that hurts security or privacy and we’re with you!

  • It's sad we lost ChromeOS. They got Linux, they got open source, they didn't make so so so many unforced errors.

    Now that the chromebooks are also Android, it feels like the slide is only going to grow ever more fearsome.

Google is also seriously dropping the ball in terms of security. The CVE-2026-43499 root LPE (aka ghostlock) is still unpatched across all Pixel devices, on the latest """security""" update, despite weaponized exploits being public for months.

  • Pixels used to have far better updates than any other Android devices but they stopped improving it years ago. It should have kept improving because it's not at all adequate. They need to be able to release OS updates more than once per month and it shouldn't take months for patches to make it into the OS. It currently takes them at least around 2 months to get even the most urgent patches into the OS. They could fix emergency calls being broken if the patch was made around 3 weeks before an OS release, but that's about as quick as they can go. It's not at all adequate for security and is a complete joke compared to Chromium's release cycle. They can get an emergency Chrome update released within a couple days. They should at least be able to do it for the Pixel OS in a week.

    GrapheneOS is often around 4 to 6 months ahead on merging Linux kernel LTS releases. We used to handle this ourselves but switched to the Android GKI LTS branch maintained by Greg KH. Unfortunately, it was often struggling to keep up even before the absolutely massive increase in Linux kernel security patches this year. AI models have rapidly accelerated vulnerability discovery and it's an ongoing crisis for the Linux kernel. We want to be on the latest LTS revision within days and want to be using the latest LTS branch within months of it being released. We're not at all happy with how Android is handling things and plan to fix that ourselves. We'll get things back to how they should be.

    We also ship all the AOSP userspace patches months before Pixels due to shipping all of the security preview patches as soon as possible. There are sometimes minor regressions but we find and fix them ourselves downstream. The security preview system has a terrible design especially considering that frontier AI models can reverse engineer the patches. There should at least only be a source embargo for around 24 to 72 hours rather than pretending as if it can work with the patches available 2 to 6 months in advance.

  • I just ran https://github.com/CakesTwix/Android-CVE-2026-43499 on my Pixel 9 Pro and it seems to have been patched. I did get a system update not long ago, though.

    • Try https://github.com/alex193a/Root-My-Pixel, worked on my 9a as of a few days ago (the version table in the readme is stale). I haven't checked the September update yet though (installing it now, to check).

      Edit: September update for 8a has a kernel build from July. I believe it's still vulnerable but the exploit will need its offsets adjusting etc.

  • There's "dropping the ball" and then there's "not reaching out your glove to catch it to begin with".

    It'd be interesting to see which one is happening here.

It's not a regret. Android would never have been popular in the first place if it had not been open source. If phone makers had been able to anticipate how much the demons at Google would be able to lock down the Android then they would never had used the OS back in ~2009.

  • I don't think this is actually true. Phone makers seem happy to have the platform locked down even further. They're putting even more roadblocks, as evidenced by most of them making bootloaders unlockable.

    • Any discussion about this is shut down. I just read an article https://www.bbc.com/news/articles/ckqxvy98x578o In the UK according to the BBC, politicians are pressing Samsung and apple to make stolen phones bricks. Samsung in response said that they have implemented several security features for this purpose. I think Samsung considers removing OEM unlocking a security feature according to the bootloader unlock hall of shame.

      Intel used to do the same with their anti theft technology aka Intel theft deterrent on their classmate PCs, so students had to enter unlock codes from an IT admin every 3 months or every say 200 boots to prevent the computer from being locked at the bios level preventing it from booting an OS, and there was an update which disabled that functionality permanently. And you would be warned when you had around 50 boots left to get the unlock code.

      5 replies →

    • This is what lots of people forget.

      Android is not a Linux desktop or server distro. It is not about you getting to put what you want on the hardware you bought for free.

      Operating systems are hellaciously expensive to maintain and that only gets worse in markets with rapid hardware improvements, as the smartphone market was up until maybe the late 2010s. Google is not a charity. SV did not come into national prominence for making investors $0. There is no money in giving maybe one in one-hundred smartphone users (and that's being generous) a bunch of code, for free, so that they can put it on their gizmo and talk to their nerd friends at their hacker meetup.

      When they pitched Android as "open", they meant that carriers and device makers could load it up with all of the revenue-enhancing bloat that they wanted. In return, Google got a device that would let them hoover up all of the data they could ever want in order to build better ad service profiles for those using the devices. That is, after all, their business.

      For a while, this could coexist with us screwing around with a real-life tricorder. At some point, though, the free stuff turned into a revenue opportunity that had to be exploited. And so, it will be.

      6 replies →

  • That’s possible (never underestimate the bad decision-making of phone makers), but what would they have done instead? Windows Mobile 6 was the only licensable alternative, but it was a known quantity and obviously a generation behind Android and iOS.

    • Symbian and LiMo were both available at the time. It is hard to say they were good alternatives though. Windows 7 - even with the weight of Microsoft behind it - wasn't able to attract enough hardware manufacturers.

    • Windows Phone was pretty nice, too bad Microsoft didn't follow their DOS and Windows strategy of getting it preinstalled on every consumer PC sold. There was really only the Nokia Lumia line that I recall, but everyone I knew who had one loved it.

      5 replies →

    • WebOS was pretty cool (Palm). But I’m not sure if Palm would have licensed it. Lg ended up with it.

    • There were several credible competitors: WebOS, Symbian, Maemo/MeeGo, Palm OS 6, and of course Windows Mobile. But they required cooperating with a single vendor and/or a lot of work to adapt.

      Android won because it was available "right now" and easy to hack. Vendors could get a BSP (Board Support Package) from a chip manufacturer, slap Android userspace on top of it, and ship a phone within half a year. It was a glorious mess for a while.

      Google then slowly tightened the reins and made the ecosystem more ordered.

      3 replies →

  • No, everyone knew what they were getting into with Android. It wasn't taken lightly by the power users of the time either. I still have a phone somewhere with Ubuntu Touch on it. I really was hoping that would be my phone OS by now. Not that Canonical isn't capable of similar, but that it would bring about acceptance of Linux phones.

    I think we're all more surprised by how long it took for Google to make these bad moves. For a period of time in the 2010s we actually started thinking maybe Google was alright.

    • It wasn't Canonical's limitation. Mozilla can confirm: the barriers to enter the phone manufacturing market are immense. Samsung, Ericsson, Sony, LG, etc, all had solid control of the deals with the network operators worldwide. It's a highly regulated market, you can't get in without Verizon, att, Vodafone etc to let you in. Canonical, Open Moko, Mozilla... Didn't have the strength to push through. Google and Apple did.

      4 replies →

  • It didn't become a major regret really until the antitrust treated android as a competitive space and iphone separate. That decision led to a lot of wtf and tactics changing. Because the platform had been made open it was then an issue of tying vs if it had just been closed like apple there wouldn't have been an issue was a pretty stupid take if you ever want to see an open platform again.

I'm convinced Android being open source is just an accident of history. It's been somewhat useful for Google to be able to ride on that goodwill, but they're not actually invested in open source beyond the ways it directly benefits them (or at least they haven't been in the last 10 years). Thus they're happy to throw the baby out with the bathwater if they believe they need the bathtub for anything that will earn them 0.1 cent more than that baby would.

  • Its more a reflection of the vastly different internal culture of the time (and different executive leadership).

    When Patrick Pichette left and Sundar became CEO both led to massive culture shifts.

They want to be like Apple here and lock things down. Remember SMS? The ubiquitous text messaging protocol that had an API that developers could access? Now, the latest standard, RCS, is locked down with no API and behaves just like iMessage. Ring any bells?

There was a split world for a long time even before the more recent changes because of the need to hide secret new features or products from the general public. It was always a tricky arrangement. They just decided one day that there wasn't a lot of folks contributing that lacked access to the private repos, so they might as well just switch all development to occur in that place. Honestly, it's somewhat rationale. If there was a significant number of folks contributing to Android without such access I'm sure that wouldn't have happened. We didn't lose as much as folks think we did given the code drops from the private repos still happened even previously.

  > Google simply regrets android being open source.

No, they are benefitting from it! They gained some trust and removed competition from the horizon. Now they are locking the platform down to do what their business is about: displaying ads.

As an outsider in a hyper competitive commercial space like mobile os (apple, android) which part makes you think it's active obstruction and not just moving fast and trying to keep up, get ahead, etc and they want the open source side but it's a lower priority?

The thread states that Google is putting out patches that affect other Android vendors too.

They're not treating GrapheneOS very differently from other vendors, except that Graphene isn't relevant enough to sign a contract with because they don't make phones (or money, really).

Google should be putting out the code and patches like they used to, but the constant badgering of Google on this issue feels off. I don't see anyone complaining that Samsung isn't supporting their security-focused fork enough, or complain that Apple is delaying the bootloader unlock process by a day.

Despite their very worst, selfish intentions, Google is the very best vendor of commercial open source software. While Google's open source project collapses, there's plenty of space for other vendors to step in.

We should bemoan Google's fall from grace, but only because they're on the way to becoming just as bad as every vendor but Librem if they keep this up another decade.

> Google simply regrets android being open source.

Could Google backtrack on this if they wanted? If they suddenly decided to stop releasing public code updates, what would they be violating? I can guess: Anti-trust maybe. probable at least contractual commitments Or is there some stronger forcing function?

> None of their decisions make any sense ..

What? Google is advertisement business. Not a software house. They sell ads. It all makes sense to build a walled garden. They are effectively a monopoly for half of the personal devices _in the world_. And they _will_ return their investments into the opensource. By locking Android and Chrome and showing ads to everyone.

Like the old days shitty TV, full of ads.

Yeah I have trouble accepting it's pure coincidence this occurs just as GrapheneOS is starting to gain some noticeable traction.

It's not that it doesn't make sense, you just said it, they regret - well maybe not regret since they'd never made it without, but they now want to reverse a decision they feel needs to be overhauled. I always thought they'll replace Linux with Fuchsia but that hasn't happened and it's not like they couldn't have done it.

> None of their decisions make any sense

It only doesn’t make sense if you’re assuming conspiracy.

It makes a lot more sense if you assume they just don’t give a shit.

> None of their decisions make any sense,

Of course, it does. Google is no longer afraid to spit on open source. People happy to use Chromium features better remember this. You are renting everything and your landlord will soon come demanding it back.

If someone’s (or some company’s) decisions don’t make sense to you, you don’t understand their motivations.

> Google

Can we just stop saying "Google" as if it's same faceless org? No, it's not Google, one or two asshole execs are behind this policy.

When you realize that keeping people on proprietary mobile OSes is a matter of national security it makes more sense. The USA spares no expense for national security.

GrapheneOS does not even register on Google scale! It does not even manufacture its own devices!

Bigger problem is HarmonyOS and similar devices, compatible with Android. Opensource threat from china!

And no NSA backdoors or honeypots!

  • If the hardware security is on par with iPhone / pixel 8+, then sure.

    Otherwise there's no need for NSA backdoors (as Cellebrite matrix shows) :)

  • GrapheneOS does, however, register on the FBI's radar because a lot of criminals know to use it, and the FBI can't crack it.

  • Sure, let's just trade the NSA for the CCP, no issues there.

    • One poses an active, unchecked threat to the constitutional rights of US citizens, has a chartered mission to subvert and undermine the very field of cryptography itself - going so far as to bribe standards bodies to adopt backdoored algorithms (using taxpayer funds to do so), has plotted to mass-violate the constitutional rights of their own citizens and lie about it to the national legislature (which they carried out successfully, committing perjury in the process and facing zero consequences for it), secretly cooperates with the criminal justice system via parallel construction to target nonviolent, law-abiding political activists with fabricated criminal charges as retaliation for politically disfavored speech, while the other is about 6500 miles away, has negligible presence in / reach into the US, and is generally unconcerned with the domestic political activities of US citizens.

      3 replies →