The founder of /e/os is anti-security (bsky.app)
from rbits@lemmy.world to privacy@lemmy.ml on 05 Apr 23:34
https://lemmy.world/post/45225700

Read the whole thread

However, we don’t have a “hardened security” approach, we aren’t developing a phone for pedo(censored) so they can evade justice.

#privacy

threaded - newest

timewarp@lemmy.world on 06 Apr 00:29 next collapse

To be fair I don’t know anyone that has ever used e/OS or considered it to be a serious project

RenardDesMers@lemmy.ml on 06 Apr 01:00 collapse

Honestly, the fact that it is supported by default on the fairphone was quite appealing to me but this poor opinion from the CEO rubs me the wrong way

warmaster@lemmy.world on 06 Apr 00:29 next collapse

Is he confusing privacy for security?

rbits@lemmy.world on 06 Apr 01:09 next collapse

Who? Gaël Duval or GrapheneOS?

Tenderizer78@lemmy.ml on 06 Apr 04:16 collapse

They’re two sides of the same coin. Can’t have privacy without security and can’t have security without privacy.

Looking at the post though he’s specifically talking about advanced security as a means of preserving privacy, security you’d need if (based on his model) targeted by a government (whether foreign or your local police forensics team). I don’t think his model is correct though because while extra hardened security is useful to protect privacy in such an instance, it’s also just best practice because it’s better to have too much security than not enough, just to keep your bank account secure at least.

LedgeDrop@lemmy.zip on 06 Apr 04:41 collapse

They’re two sides of the same coin. Can’t have privacy without security and can’t have security without privacy.

Hmmm… I half agree with what you said. The corner stone of most security is an element of initial trust.

With SSL, we’re trusting that the certificate authority is valid.

With tools like GPG, I (as the sender) are trusting that the key I’m using to sign a message is really yours.

With Android we (the users) and the application developers are trusting Google (hence why “sideloading” is now “bad”, because Google says it is).

I absolutely agree that privacy cannot exist without security. But, your privacy is dependent on who your security model trusts.

I don’t trust Google with my privacy (hence, I degoogle) , but my bank app doesn’t trust my security (hence, the app can only be installed via Google Play).

So, privacy is dependent on security, but security is built on trust.

FEIN@lemmy.world on 06 Apr 00:33 next collapse

Kind of shameful of /e/ to blatantly disregard user privacy like that. Is Graphene our last stand against Orwellian surveillance?

lennee@lemmy.world on 06 Apr 00:48 collapse

i honestly dont care much about privacy in the sense that i dont rlly need it to be provided by an OS, just give me max freedom and let me handle privacy myself. That being said I am on grapheneOS atm but still hoping for librephone to enable me to have an arch linux like phone experience that i can customize to hell

ScoffingLizard@lemmy.dbzer0.com on 06 Apr 09:06 collapse

That would be really cool.

endlessvoid@lemmy.today on 06 Apr 00:35 next collapse

“anyone who wants privacy from their government is a pedophile” is a hell of a stance…

thatsnomayo@lemmy.ml on 06 Apr 04:33 next collapse

the privatized western govts & their tech boys literally are the infrastructure of the global pedos it’s asinine & dangerous to tell people to ignore that!

Tenderizer78@lemmy.ml on 06 Apr 04:48 next collapse

The stereotype of pedophiles in cop shows is that they use desktop computers anyway, not phones. Don’t know how true to reality that is though.

PolarKraken@lemmy.dbzer0.com on 06 Apr 05:19 next collapse

Honestly by now it’s becoming reasonable to assume “projection” as a baseline, to then change based on evidence, when someone has a take like this guy’s.

I don’t mean the political tactic, just the garden-variety kind of projection. “Probably ~everyone thinks the way I do, and boy, we better not give everyone the tools to act on that…”

Deeply wrong about how most folks think, because of how they themselves do, and believing they’re therefore helping. Likewise a self-admission, because they don’t realize they’re admitting anything.

Maybe not the case with this guy, I’m not gonna dive in.

But I do sincerely believe that’s a somewhat charitable take toward anyone making a claim like this today. Charitable in the sense of acknowledging a misunderstanding and desire to help.

The less charitable one being - just obviously complicit. Fuck this noise.

FauxLiving@lemmy.world on 06 Apr 19:28 collapse

“Why did you lock your doors, what did you steal?”

DisgruntledGorillaGang@reddthat.com on 08 Apr 01:28 collapse

More like, “Why did you lock your doors, are you diddling kids?”

blackbrook@mander.xyz on 06 Apr 00:44 next collapse

I can’t believes he’s intentionally anti-privacy. Occam’s razor suggests he’s instead a fucking idiot.

rbits@lemmy.world on 06 Apr 01:19 collapse

Yeah maybe. But whether it’s intentional or not, I would not want to use /e/os.

But also, from the linked thread:

Murena is a for-profit company owned by shareholders including Gaël Duval. /e/ has a non-profit organization which is also led by Gaël Duval. /e/ includes paid services from Murena. /e/ very clearly exists to build products for Murena to sell in order to enrich the shareholders.

Despite being done for profit, /e/ receives millions of euros in funding from the EU on an ongoing basis. /e/ and Murena use extraordinarily inaccurate marketing to not only promote their products/services but also to mislead people about GrapheneOS and scare them away from it.

From @grapheneos.org

blackbrook@mander.xyz on 06 Apr 05:52 next collapse

Oh agreed. I wouldn’t want to install an OS from a fucking idiot either.

(And I take your point that said idiot may also be a dishonest slime ball.)

ScoffingLizard@lemmy.dbzer0.com on 06 Apr 09:05 collapse

Graphene made an OS only for Google phones. I can see what they mean here, but not sure they have room to talk regardless of the security circumstances.

It is shitty if there was a smear campaign against them though.

9point6@lemmy.world on 06 Apr 01:05 next collapse

Lmao what a toxic piece of shit

Privacy is something everyone deserves, not something only criminals want

rbits@lemmy.world on 06 Apr 01:05 next collapse

Another quote from the thread

Their marketing heavily focuses on avoiding Google and gives the impression they believe privacy means avoiding one company. Meanwhile, they add a bunch of Google services not present in the Android Open Source Project and give extensive privileged access to Google apps/services.

From @grapheneos.org

rbits@lemmy.world on 06 Apr 01:09 next collapse

Recently, France’s national law enforcement began fearmongering about GrapheneOS and smearing it with inaccurate claims. France’s corporate and state media heavily participated. Many articles and also radio/television coverage misrepresented GrapheneOS as being for criminals.

From @grapheneos.org

mindbleach@sh.itjust.works on 06 Apr 01:49 next collapse

A fine endorsement.

lsjw96kxs@sh.itjust.works on 06 Apr 06:12 collapse

It was already debunked. A single french tabloid (not true journal) featured why graphene was used by criminals. It’s not the government that was specifically targetting it by all means it had.

ScoffingLizard@lemmy.dbzer0.com on 06 Apr 09:02 collapse

What priveledged access? I only found one call home from MicroG, and it was easily disabled.

beyond@linkage.ds8.zone on 07 Apr 20:30 collapse

Been a while since I used microG but I remember the Google registration specifically being opt-in. Then again, I also remember reading that /e/OS automatically enables it, so…

Fedpie@sopuli.xyz on 06 Apr 01:10 next collapse

I think it’s fair they support way more phones than GrapheneOS, even if the security is way worse. But it’s a whole other thing to call people who want secure phones pedophiles.

rbits@lemmy.world on 06 Apr 01:17 next collapse

I am skeptical how worthwile it is to use /e/os over OEM Android at this point

JamesBoeing737MAX@sopuli.xyz on 06 Apr 08:22 next collapse

Well, you get a superiour privacy and security by just debloating a device via ADB.

freeman@sh.itjust.works on 06 Apr 12:21 collapse

You keep access to non-verified apps no matter what Google wants since it uses microG.

It’s openness vs security.

Tenderizer78@lemmy.ml on 06 Apr 04:43 next collapse

I think both approaches are too extreme. Supporting every device leads to poor security, poor stability, and therefore a poor user experience, but only supporting just Google devices (while there is a good reason for that) is a step too far for most people.

If I were in the position of e/os I’d just support probably three manufacturers. Going through the major ones that I know of: Motorola and Google are obvious picks. Next would need to be something cheap and popular. Samsung is way out of the question. Xiaomi and Vivo I’ve never seen their phones mentioned outside of China (which is a country that generally doesn’t have the same privacy considerations as people in the west do). That leaves Oneplus and Tecno Mobile for the third model.

Goodlucksil@lemmy.dbzer0.com on 06 Apr 07:19 collapse

CalyxOS (when it existed) supported Fairphone, Motorola (some) and Pixel.

weaselsrippedmyflesh@piefed.social on 06 Apr 08:33 collapse

Agree with your outlook, but I think it’s not too farfetched to give the benefit of the doubt to the speaker here and establish that pedophiles were used as an example (of people whose survival depends on their data not being breached), rather than a direct comparison. And he goes on to name being an executive to the secret services as another example (again, of people to whom hardened security of data is an imperative), but we’re not saying he thinks secure phones are just for people in secret services, are we?

He’s just saying, albeit rather clumsily, that their goal is simply not that level of hardened security, but rather privacy from data miners.

mindbleach@sh.itjust.works on 06 Apr 01:48 next collapse

First they came for people I don’t like, I assume, and I said hell yeah, there’s no way that will ever be me. Over here, officer. Come for a few more kinds of people I don’t like. Nothing bad ever happened to the French!

onlinepersona@programming.dev on 06 Apr 05:22 next collapse

Please provide the video with the question included. This looks cut to fit the anti murena narrative that GrapheneOS has been screaming about for years. It’s the same tactic Republicans use against others: cutting only a bit that sounds bad when taken out of context.

onlinepersona@programming.dev on 06 Apr 05:24 next collapse

Please provide the video with the question included. This looks cut to fit the anti murena narrative that GrapheneOS has been screaming about for years. It’s the same tactic Republicans use against others: cutting only a bit that sounds bad when taken out of context.

verdi@tarte.nuage-libre.fr on 06 Apr 07:35 next collapse

For context, for those in the anglosphere, Graphene OS had some troubles in France because the government portrayed the users of the OS as majority criminals, like narcos and including pedos. They left the French market.

Occam’s razor would lead one to believe Gael is not talking to users but to shareholders and the government, where he mentions pedos, which is the soup du jour to go after privacy.

Now, why is this being spread by GOS without context? Easy, they just entered a deal with Motorola, and creating an environment where people hate the competition is a very profitable endeavour for GOS. Finally, Mikay should get help, he’s impossibly technically endowed but also facing some demons that push GOS into unsavoury practices.

Finally, Motorola produces a panoply of devices for LEA, if you think a for profit company will not leverage their deal with GOS to sell a bypass device to law enforcement agencies and have the monopoly on that market you are out of your goddamn mind. The truth is /e/ doesn’t purport to sell a private OS, they sell an OS with less tracking. Graphene advertises a fully “private” OS but then enters a deal with one of biggest cop suppliers in the world and not a word on how that compromises their promise of security for users.

There’s only one way to be really safe, a 0 trust model where you don’t use your phone as a reliable communicator.

Coleslaw4145@lemmy.world on 06 Apr 13:05 next collapse

Finally, Motorola produces a panoply of devices for LEA, if you think a for profit company will not leverage their deal with GOS to sell a bypass device to law enforcement agencies and have the monopoly on that market you are out of your goddamn mind.

You realise that Motorola Solutions (that make stuff for law enforcement agencies) and Motorola Mobility (that make phones) are two completely seperate companies?

Motorola Mobility is a wholly owned subsidiary of Lenovo.

They have nothing to do with eachother beyond just the brand. Motorola Mobility dont even own the rights to the name or logo. They have to license the brand from Motorola Solutions.

verdi@tarte.nuage-libre.fr on 06 Apr 13:40 collapse

You realise that Motorola Solutions (that make stuff for law enforcement agencies) and Motorola Mobility (that make phones) are two completely seperate companies?

I didn’t. Good catch. The original point stands though, given Lenovo’s history, business practices and their collaboration with LEA, it’s just the holding company that changes.

versionc@lemmy.world on 06 Apr 15:42 collapse

that push GOS into unsavoury practices.

Can you elaborate on this?

verdi@tarte.nuage-libre.fr on 06 Apr 16:01 collapse

i. e.

Deal with Motorola to make bank before “they” get to him.

Desperate attempts at portraying himself as victim of persecution.

FUD on other AOSP projects.

Cleisthenian@lemmy.ml on 06 Apr 21:09 collapse

Incredibly weak response

noodlejetski@piefed.social on 06 Apr 07:43 next collapse

honestly, given Graphene’s social media record, I’d assume they’re translating the video in the least generous way possible

[deleted] on 06 Apr 08:11 next collapse

.

JamesBoeing737MAX@sopuli.xyz on 06 Apr 08:20 next collapse

Well, look at the /e/ os. It just confirms the narrative. If you just hate google, you can remove their apps via ADB.

whyNotSquirrel@sh.itjust.works on 06 Apr 08:23 collapse

Honestly I think it’s a neutral translation, he really poorly chose his words.

But is there any other choice possible if GrapheneOS isn’t supported on your device? Graphene seams to say that AndroidOS is better?!

blackbeard@europe.pub on 06 Apr 07:47 next collapse

Interesting conversation with GrapheneOS. Didn’t know they essentially hate each other. I’m using e/os but just because I cannot run graphene on my device.

Danitos@reddthat.com on 06 Apr 08:29 collapse

GrapheneOS’s leadership hates basically any other ROM. If you say something negative about GrapheneOS, he will probably call you out as part of CalyxOS team in a hate raid party, or something of the like.

They make an amazing OS, but you’re better off not giving them much attention in their constant drama.

jjlinux@lemmy.zip on 06 Apr 15:40 collapse

Calling others on their bullshit does not equal hating on them. Why do you think CalyxOS had to ‘take a break’? Why do you think that The only thing these ‘privacy’ focused OSs can do about GrapheneOS is say it’s geared towards criminals? They have no other way to try and smear them because they’re all garbage in comparison.

Get your shit straight. GrapheneOS is so fucking awesome that they plugged an actual Linux kernel hole within hours of it being found, whereas it took Google weeks, never mind these Murena and Calyx morons.

eldavi@lemmy.ml on 06 Apr 16:04 collapse

… bullshit … criminals … smear … garbage … get your shit straight … morons.

more expletives, than sentences; this reads like it was written by micay himself. lol

Hominine@lemmy.world on 06 Apr 16:25 next collapse

I wouldn’t be surprised if there is more that one sockpuppet to be quite honest, they just cannot grow tf up.

eldavi@lemmy.ml on 06 Apr 16:52 collapse

i’m inclined to believe that the continuous barrage of hate lobbied their way makes them reactionary because they lack the discipline that typifies rightist beliefts; they could accomplish A LOT MORE if they copied pages from the leftist playbooks where public engagement is concerned.

jjlinux@lemmy.zip on 06 Apr 16:38 next collapse

You’re finally getting it. Good.

DisgruntledGorillaGang@reddthat.com on 08 Apr 01:37 collapse

People curse. Get over it. Just goes to show that you don’t have anything to say about the actual point of their comment when you clutch pearls like that.

Undertaker@feddit.org on 06 Apr 07:54 next collapse

It fits into the whole philosophy. There are several posts ( Initial Kuketz, discussion on Kuketz critique, reminder/restart discussion, criticism on usage of OpenAI in /e/ and poor communication, same questions again with no or wrong answers) criticising /e/ for heavily ignoring privacy and security flaws and only one response post on this Duvals answer on OpenAI usage in which they clarify to see ‘emotional’ reactions and look for alternatives while still finding it acceptable and criticism is ‘FUD’ and ‘hurt of reputation’ instead of valid concern.

Additionaly the points postet by Kuketz are not addressed since today. Updates are a bit faster but still with weeks delay and still not including several parts of security updates (instead it’s the bare minimum).

I looked for several posts on social media and Duval always ignores the points and yells that all the people are only up to harass him. He also uses false arguments to convince (probably) himself of this ridiculous behaviour.

I started using /e/ in summer 2022 and was positive and hopeful because of the idea (long updates, privacy in mind, degoogled). But over the years learning that nearly all internal community and external expert criticism was ignored or marked as irrelevant or harassment when it’s not, my opinion changed and I’m no longer willing to talk or write about /e/ diplomatically as it is inappropriate.

JamesBoeing737MAX@sopuli.xyz on 06 Apr 08:09 next collapse

Yeah, no shit. Look at their OS and online services.

weaselsrippedmyflesh@piefed.social on 06 Apr 08:15 next collapse

I don’t think he’s actually making the parallelism with pedophiles and security per se, but rather he’s making the case that his OS’ mission isn’t by default focused on that level of security or anonymity, but rather privacy and disengagement from companies who profit from your data being mined.

He mentioned pedophiles, as well as the secret service, right after, as examples of either criminals who need to be obscured from detection (maybe because it’s easy for the Epstein class to pop in someone’s head, nowadays?) or government agents that need to protect themselves from data breaches, and said his type of OS isn’t made with that level of airtight security in mind, which is understandable and reasonable, and something we probably all knew already. It could’ve just as well been terrorists and investigative journalists mentioned.

One could take his stance and engage in discussion on whether we need that level of security by default as ordinary citizens, or that even without exceptional circumstances, it becomes necessary in an increasingly hypervigilant society/government, but that’s a separate discussion.

We should have a little nuance in interpreting speeches like these rather than taking things this literally, especially when it’s coming from a direct competitor in the degoogling sphere, who would naturally gain from holding it up in the most unflattering light.

Jason2357@lemmy.ca on 06 Apr 13:20 collapse

Are you a native french speaker? Maybe you heard it differently from me, but while I am all for nuance, lets not sanewash people and take them at their word.

I use plenty of software where the developers are not primarily focused on security, but his line of reasoning sounds just plain dangerous for an OS developer. Maybe he phrased it bad, but that would be up to him to clarify and we shouldnt do that for him.

weaselsrippedmyflesh@piefed.social on 06 Apr 13:43 collapse

It’s also up to us to not jump aboard any given claim and be critical of what others are spelling out for us. In any case, the transcripts in both english and french were posted by grapheneOS in the comments as well, so non-native french speakers can draw their own conclusions.

You’re right that it’s also up to him to clarify his remarks, but I feel like this is a non-issue generously stretched out online that just sows further division that only benefits the big offenders against privacy.

Armand1@lemmy.world on 06 Apr 08:15 next collapse

The full translation of the clip of Gaël Duval provided by GrapheneOS:

There’s the attack surface, on that front we’re not security specialists here, so I couldn’t answer you precisely, but from the discussions I’ve had, it seems that everything we do reduces attack surface.

However, we don’t have a “hardened security” approach, we aren’t developing a phone for pedo(censored) so they can evade justice. So there aren’t difficult things to check if the memory is corrupted, really hardened security stuff that could clearly be useful for executives, in the secret service, or whatever.

That’s not our goal, our goal is to start from an observation: today our personal data is constantly being plundered and that wouldn’t be legal in real life with the mail or the telephone, we want to change that. So we are making you a product that changes that by default for anyone.

As a french speaker, I can attest that the translation is fairly accurate.

While I don’t agree with the characterisation Gaël Duval makes here, I believe the statement from GrapheneOS here:

Duval and his organizations have consistently taken a stance against protecting users from exploits. In this video, he once again claims protecting against exploits is for only useful pedophiles and spies.

Is a bit disingenuous. It sounds like they do make some efforts to secure their device, but it’s not their main focus. Theirs is to improve privacy first and foremost.

I would take anything GrapheneOS devs says with a grain of salt, as we all know that they have quite an adversarial relationship with… well… everyone. But especially other OS makers.

Danitos@reddthat.com on 06 Apr 08:35 collapse

It sounds like they do make some efforts to secure their device, but it’s not their main focus. Theirs is to improve privacy first and foremost.

I don’t have any issue with that: different OSes have different priorities and that’s okay. However, I feel like he’s basically saying that users of hardened secure devices are pedos, and I have a very big issue with that. I don’t know if maybe in French it doesn’t sound that way, but the English translation does for me.

jjlinux@lemmy.zip on 06 Apr 15:02 collapse

That’s how it sounds. So, I’m a pedophile because I run GrapheneOS on my phone? I guess I better tell my wife, and my kids.

punchmesan@lemmy.dbzer0.com on 06 Apr 15:26 collapse

… and my kids

“Hey Kiddos! So I have some good news and some bad news…”

SirSlothful@piefed.world on 06 Apr 08:43 next collapse

Its a shitty thing to say.

I do use /e/os because I fundamentally object to giving money go google to not use android. It seems like a false economy.

When I first moved away from android I had a pixel but it was not supported by graphene as it was out of security updates from android. So I went for a fairphone so I had a phone that was supported for 10 years. Stopping security updates for a working phone to force me to give money money to google while contriting to e-waste and planned obsolescence fucked me off.

I’m looking forward to seeing the output of the graphene/Motorola project as I do agree with the approach to security.

herseycokguzelolacak@lemmy.ml on 06 Apr 08:55 next collapse

I have a huge problem with GrapheneOS: they rely too much on Google hardware. That is why I never used Graphene and probably never will.

innocentz3r0@programming.dev on 06 Apr 09:52 next collapse

Well, wait for motorola’s graphene compatible phones to pop up ig.

Lemmert@reddthat.com on 06 Apr 10:11 collapse

Just wondering, do you have a problem in the sense that you don’t want to support Google or more that you’re worried the actual hardware is not safe or trustworthy?

herseycokguzelolacak@lemmy.ml on 06 Apr 12:04 collapse

Google is the exact opposite of privacy and security.

I find it very dishonest that GrapheneOS was advertising itself as the secure option while tying itself so closely to Google.

Coleslaw4145@lemmy.world on 06 Apr 12:50 next collapse

It only works on Pixel phones because they are the only phones on the market that meet the security requirments.

Thats why for the future Motorola phones, Motorola will have to design a new phone that will meet those requirements. They can’t just put Graphene OS on an existing Motorola model.

herseycokguzelolacak@lemmy.ml on 06 Apr 17:03 collapse

lemmy.ml/post/45526027/24995083

Coleslaw4145@lemmy.world on 06 Apr 18:57 collapse

If you don’t care about hardware security then don’t use Graphene OS, it’s not made for you. Its made for people who do care.

As for Google harvesting data, Graphene has all of that stripped out by default. It doesnt even have Google Play Services, you need to install it seperately if you want to use it.

MangoPenguin@lemmy.blahaj.zone on 06 Apr 13:07 collapse

The Pixel phones were the only devices with secure enough hardware to make GrapheneOS viable, that’s why they developed it for them.

It wasn’t because of some deal with google or anything like that.

herseycokguzelolacak@lemmy.ml on 06 Apr 17:03 collapse

Hardware security guarantees are irrelevant for most people, including myself. A very small segment of the popularion needs them.

What matters infinitely more is who has access to your data. And Google is one of the worst offenders.

FauxLiving@lemmy.world on 06 Apr 19:30 next collapse

Buying a phone from Google (HTC really) does not give Google access to your data.

There are no Google services installed by Graphene, you have the option of running Google services if you choose, but even if you choose to do so they are kept in a sandbox and not given privileged information on the system.

herseycokguzelolacak@lemmy.ml on 06 Apr 20:33 collapse

There are no Google services installed by Graphene, you have the option of running Google services if you choose, but even if you choose to do so they are kept in a sandbox and not given privileged information on the system.

Using Google hardware results in financial gain for Google, which is one of the worst companies out there for privacy and security. I do not like that GrapheneOS is working to propagate Google’s monopoly.

FauxLiving@lemmy.world on 06 Apr 22:36 next collapse

You’re moving the goalposts, you said:

What matters infinitely more is who has access to your data. And Google is one of the worst offenders.

That’s completely different than who benefits financially from your phone purchase.

herseycokguzelolacak@lemmy.ml on 07 Apr 06:59 collapse

I’m not moving goalposts. If you care about security, then you should also care about not making money for Google.

FauxLiving@lemmy.world on 07 Apr 14:09 collapse

Those are two different things.

Coleslaw4145@lemmy.world on 06 Apr 23:24 collapse

Using Google hardware results in financial gain for Google

So buy 2nd hand then.

Lemmert@reddthat.com on 06 Apr 19:31 next collapse

I don’t really see the issue. So you don’t really care about robust and trustworthy hardware. That I get to some extent considering you’re more worried about your data itself. But if you’re flashing your device with GOS, there is no data being shared to Google unless you specifically want to use Google Play Services or the Play Store. Both of which don’t come pre-installed

Edit: I added the if

herseycokguzelolacak@lemmy.ml on 06 Apr 20:35 collapse

Robust and trustworthy hardware does not matter if the apps you need for daily life (like banking or public transportation) are so integrated with Google’s ecosystem that they leak everything.

Breaking Google’s hold over Android is the most important security topic of all time. Everything else is secondary. GrapheneOS is not real security.

Lemmert@reddthat.com on 06 Apr 22:01 collapse

But how does this tie back to your original statement about GOS security and tying itself with Google? The issues you’re raising aren’t even a GOS specific one. I also find it strange to not call it secure because services themselves are reliant on Google’s services. That is not an issue any OS can solve. I say this as someone who does not rely on any Google services on my phone. I also believe you might be conflating security with privacy.

herseycokguzelolacak@lemmy.ml on 07 Apr 07:00 collapse

The issues are not GOS specific. I am saying that GOS is selling snake oil, not real security.

MangoPenguin@lemmy.blahaj.zone on 06 Apr 19:39 collapse

In that case another degoogled ROM sounds more like what you’re after?

Graphenes thing is hardware security.

nebulahhh@lemmy.blahaj.zone on 06 Apr 09:13 next collapse

We’ve known that /e/os is anti security/privacy look at all their attacks on grapheneos

Hominine@lemmy.world on 06 Apr 14:07 collapse

I’ve not seen this though GrapheneOS has repeatedly belittled /e/os. As others in this thread have noted the propensity to repeatedly attack other projects is the biggest failing of GOS. As a user it does little more than leave me funding PostmarketOS while biding time for a proper linux solution.

nebulahhh@lemmy.blahaj.zone on 06 Apr 14:31 collapse

GrapheneOS only points out (very bluntly tbf) the fact that /e/os and other “privacy” focused os don’t keep up with critical security patches and actually makes users less private and secure due to this. I think saying that GrapheneOS belittled /e/os is a little much considering the amount of missinformation/attacks that people from /e/os and Murena have been doing accross social media. I mean you see it here calling “hardened security approach” is for pedos/criminals very extreme language which does genuine harm to projects like GrapheneOS. Their Unified Attestation project is just a way for them (/e/os, murena etc) to control which apps can run on which device when GrapheneOS supports hardware attestation which would allow (afaik) apps to verify on the hardware level to ensure the security of apps. Read this thread on their mastodon, they routinely have to defend themselves on social media from a mountain of misinformation and disinformation you should read some of the other posts on their mastodon.

Hominine@lemmy.world on 06 Apr 16:23 collapse

Considering I’ve had my own posts deleted during the last round of admin meltdowns here on the fediverse I have seen all I need to of GOS’s leadership antics, thank you very much.

eldavi@lemmy.ml on 06 Apr 16:44 collapse

which instances did that?

Hominine@lemmy.world on 06 Apr 19:18 collapse

grapheneos@lemmy.ml
a.lemmy.world/lemmy.world/comment/21010858
I spoke out about the persecution complex of the management and got shut down, like-minded sentiment be damned I guess. We can see the sycophancy here also, Stallman save us from such small minds…

eldavi@lemmy.ml on 06 Apr 19:36 collapse

<img alt="" src="https://lemmy.ml/pictrs/image/45687334-4e6a-42c4-a89f-667857aaf95c.png">

the mod’s reasoning is sus at best and makes this community feel like it’s captured by reactionaries.

[deleted] on 06 Apr 10:46 next collapse

.

quips@slrpnk.net on 06 Apr 10:59 next collapse

You did not need to censor anything this is not Reddit

rbits@lemmy.world on 06 Apr 12:16 collapse

First of all, I didn’t censor it, that’s a quote from the Bluesky post.

But also, why is everybody so offended by censored words here? I don’t get it.

fatcat@discuss.tchncs.de on 06 Apr 12:28 next collapse

But also, why is everybody so offended by censored words here?

I think because it’s a sign how social media corps have trained us to avoid certain words or even create new ones (for example “unalive” instead of “kill”).

MasterNerd@lemmy.zip on 06 Apr 13:21 collapse

The term is algospeak, where you change your wording due to online censoring. I fucking hate that corporations have managed to literally change the way we speak.

Tangentism@lemmy.ml on 06 Apr 18:33 collapse

But it’s also great that humans evolve language to keep ahead of algorithms and corporate bullshit.

FauxLiving@lemmy.world on 06 Apr 19:23 collapse

It shows that people internalize censorship and start doing it unprompted.

hyacin@lemmy.ml on 06 Apr 16:59 next collapse

But also, why is everybody so offended by censored words here? I don’t get it.

The biggest reason seems to be that it will evade filters, which people set up very intentionally and specifically to keep these Fedi-spaces a safe place for them mentally.

So, for example, someone comes here to get away from the ‘real world’ and news and whatnot, may have a filter that blocks anything with the word “Trump”, or one I actually see censored a lot more often, “Israel”

Then someone makes a post about “Isr*el is so bad” and it sails right through their filters.

rbits@lemmy.world on 07 Apr 00:35 collapse

Ah fair enough

DisgruntledGorillaGang@reddthat.com on 08 Apr 01:27 collapse

Because its fucking pathetic. Say what you mean and mean what you say.

pmk@piefed.ca on 06 Apr 13:52 next collapse

I can see how one can interpret it like that, but it’s not how I read what he said. I think the point he’s trying to make is that hardened security protects the user from attacks, yes, but their focus is to provide services that can be trusted not to attack the user. He said: “really hardened security stuff that could clearly be useful for executives, in the secret service, or whatever. That’s not our goal”

I mean, I use GrapheneOS on my phone, but do I personally need all the hardened security? Not really. It’s nice theoretically, but mainly I’m just happy the OS itself isn’t spying on me. I’m personally not very worried about an evil maid attack or state level spying.

versionc@lemmy.world on 06 Apr 15:37 next collapse

Someone on Reddit made an interesting comment relevant to this discussion:

old.reddit.com/r/BuyFromEU/comments/…/o94f706/

SatyrSack@quokk.au on 07 Apr 01:15 collapse

So you don’t have to give Reddit clicks:

Dutch hardware, French open-source OS, no Google services.

Apologies for repeating this in pretty much every topic on Fairphone and /e/OS, but there is a lot of misinformation about this. The Fairphone hardware and software is developed by a Chinese company called T2Mobile (this is no secret, it is in Fairphone’s documentation).

Switching to /e/OS does not really change that, because they use the same kernel trees, binary firmware blobs, and device trees maintained by the same Chinese company. So you replaced opaque blobs coming from a South Korean company to those from a Chinese company and Qualcomm (pick your poison I guess).

Besides that /e/OS does not really decouple you from Google. It starts talking to Google pretty much the moment you first set up the device [1]. The device will download proprietary Google SafetyNet blobs that run as part of the privileged microG. /e/OS also contacts Google for assisted GPS, eSIM provisioning, WideVine provisioning, etc. Then if you install certain Google Apps, /e/OS gives them elevated privileges, breaking the regular sandbox model. For instance, if you install Android Auto because you want to use it in your car, some of the dependencies (e.g. Google Maps) have privileged access [2]. It does not stop at Google, e.g. for speech-to-text, Murena does not have any scrupules uploading your voice to OpenAI (and hide it somewhere in the terms that no-one reads) [4].

Besides that, both Fairphone and /e/OS have a history of abysmal security. E.g., both used to sign system images with Android testing keys (which meant that malware could hide in your system image without you noticing). Fairphone is absolutely terrible at maintaining kernel trees - e.g. Fairphone 4 is still using a Linux version that has not been updated since 2020, Fairphone 6 is still on firmware blobs from June 2025 despite Qualcomm pushing out monthly fixes for vulnerabilities since then. The Fairphone 6 is also shipping a Linux kernel that hasn’t been updated since September 2024.

Both the Fairphone stock OS and /e/OS are way behind on Android security updates. The Android Security Bulletins are only backports of security issues marked high or critical. On those they are typically 1-2 months behind and the ASB vulnerabilities are already known for 3 months by vendors due to Google’s new security embargo system. That means that Fairphone’s stock OS and /e/OS are usually 4-5 months behind on patching high/critical vulnerabilities. It is even worse for other vulnerabilities, which are commonly used as part of exploit chains. /e/OS and the stock OS are still on Android 15. Since they do not roll out other security updates than ASBs, it means that they are now 1.5 years behind in non-high/critical security updates (since Android 15 was released in September 2024).

And then we haven’t even talked about shady things like the /e/OS App Lounge getting F-Droid packages [3] through a MITM server (cleanapk) for at least 6 years now that often serves outdated package versions. To make it more fun, they do not want to reveal who is actually maintaining this service.

Similarly, hardware security is not great. In contrast to your old S24, the Fairphone 6 does not have separate secure enclave. They only use TrustZone, which basically uses the same CPU/RAM for the TEE (the OS gets isolated by secrets running it in a VM-like environment). TrustZone is vulnerable to side-channel attacks and PINs are easily brute-forced (so, on Fairphone you probably want to use a long passphrase).

Some people will say: who cares, I’m not the target of a state level actor. Remember that in the days of Cellebrite, etc. device security is important to anyone who ever goes to a demonstration or crosses international borders.

I understand that everyone is looking for European alternatives, please think twice if you want to replace them by Chinese blobs, very outdated software, and a security disaster.

[1] https://www.kuketz-blog.de/e-datenschutzfreundlich-bedeutet-nicht-zwangslaeufig-sicher-custom-roms-teil6/

[2] https://eylenburg.github.io/android_comparison.htm

[3] https://forum.f-droid.org/t/e-foundation-using-f-droid-with-middle-man-website/7162

[4] https://forum.fairphone.com/t/e-os-betrays-users-privacy-openai-being-

DisgruntledGorillaGang@reddthat.com on 08 Apr 01:30 next collapse

Fucking yikes.

Fedpie@sopuli.xyz on 08 Apr 16:14 collapse

That is concerning, but I don’t think the Chinese blobs are a big issue.

Anaeijon@lemmy.dbzer0.com on 06 Apr 18:41 next collapse

I’m running e/OS in my old Poco F3 right now.

I switched from LineageOS because I though, e/OS would be easier to ungoogle.

In the end, it just defaults to way more compromises than I would have made on LineageOS.

Over all, it’s actually just LineageOS with MicroG preinstalled, a really bad launcher, an ugly 2015-ish iPhone icon theme, and a few mediocre apps preinstalled, that use these ‘Murena’ services that claim to be an alternative to Google services, but they are neither more secure/foss nor reliable.

Their appstore is rather Bad. Yes, it essentially combines something like APKMirror and F-Droid in one app, but it requests a Google account to access PlayStore Apps.

Imho, LineageOS with MicroG, no GApps, F-Droid and APKMirror and a few foss apps is the better solution.

I have my sync services selfhosted through a NAS and simply use WebDAV (backups), CardDAV and CalDAV. This was harder to set up in e/OS than in basic LineageOS, because e/OS is trying to push their own Murena services for that. And if I didn’t have all of these selfhosted, I’d rather use Proton services instead of Murena.

Over all, really sketchy. It’s like a custom Rom that claims privacy but actually just wants you to möge to their own service.

AnimalsDream@slrpnk.net on 07 Apr 01:15 collapse

This was pretty much my impression of /e/ as well. Used it only briefly. It ran poorly, had a bunch of crap I didn’t want. Bad launcher. Things didn’t work properly.

Overall impression I got was that the people who make /e/ do not know what they are doing.

While the GrapheneOS dev comes across as sus and toxic to me, part of me would like to give it a try. But between Pixel phones still having black screen of death problems, and newer ones lacking a headphone jack - I found a Moto G100 plus LineageOS with MicroG is a great option.

I only run open software on it, and keep everything proprietary on my old un-degooglable phone that only gets turned on when necessary.

utopiah@lemmy.ml on 06 Apr 18:44 next collapse

Sadly FUD as ANYTHING that is NOT increasing profit for surveillance capitalism, i.e Google, Meta, etc is a win for privacy!

Of course /e/OS could be better, GrapheneOS could also be better (including on security) but the big picture is that still ANY of those solutions is making surveillance capitalism, the loss of privacy for profit and power, less efficient. That’s good for all of us who, being on Lemmy or other federated instance, believe we do benefit from having more privacy, or at least not trading it away.

TL;DR: be inclusive, bring others up, don’t be exclusive aiming for perfection none of us can attain.

rbits@lemmy.world on 07 Apr 00:38 next collapse

Just because something does something good doesn’t mean it’s immune to criticism.

DisgruntledGorillaGang@reddthat.com on 08 Apr 01:24 collapse

FUD?

utopiah@lemmy.ml on 09 Apr 15:32 collapse

“Fear, uncertainty, and doubt (FUD) is a manipulative propaganda tactic used in technology sales, marketing, public relations, …” en.wikipedia.org/…/Fear,_uncertainty,_and_doubt

doodoo_wizard@lemmy.ml on 06 Apr 19:20 next collapse

Anyone telling you the list isn’t graphene -> ios -> good custom android -> aosp-> google stock -> samsung stock is lying to you.

Jakeroxs@sh.itjust.works on 06 Apr 19:52 next collapse

I thought Samsung stock was better because of Knox et all

sinextitan@lemmy.world on 07 Apr 10:51 collapse

better but than the rest of the unmentioned dogshit

IratePirate@feddit.org on 06 Apr 21:23 collapse

How is iOS - a proprietary OS owned by a big tech company - second in your list?

Jtotheb@lemmy.world on 06 Apr 23:52 next collapse

Which flavor of Google surveillance would you consider a more private and secure phone platform than iOS?

FG_3479@lemmy.world on 07 Apr 00:21 next collapse

It has some of the best exploit protection next to Graphene if you enable lockdown mode.

doodoo_wizard@lemmy.ml on 07 Apr 02:05 collapse

It can be made very good from a security and privacy perspective.

If you know you know I guess.

IratePirate@feddit.org on 08 Apr 11:07 collapse

There’s good reason to suspect that it’s very terrible from its privacy and security perspective.

If you remember you remember I guess.

doodoo_wizard@lemmy.ml on 08 Apr 15:21 collapse

Do you think it’s possible for companies or individuals to not comply with court ordered surveillance and search warrants? That’s what prism is, nsa driven data collection ordered by the court system.

Further, on its own and absent any other evidence, the timeline of prism entry corroborates my statement that ios is second to graphene.

Apple is not a good company, there are no good companies. Apple is a company selling security and privacy amongst other things. You have to buy security and privacy because you can’t go out into the backyard, fell a phone tree, carefully choose the section with the strongest, straightest traces and shape it into an optimally private and secure device in the shed using your grandfathers antique phoneworking bench and strap driven phone lathe.

IratePirate@feddit.org on 08 Apr 19:53 collapse

Do you think it’s possible for companies or individuals to not comply with court ordered surveillance and search warrants?

Companies can’t, no. That’s precisely my point. Hence your argument that iOS is more “secure” than any other bar Graphene is disingenuous. iOS is developed by a company which can be (and likely already has been) pressured into compromising its users on behalf of three-letter agencies. The NSA slides are strong evidence of that.

Large collectives of devs spread out all over the world, however, can withstand such pressures since they’re hard to get a hold of. The developers of OSs such as Graphene, Debian or Lineage could easily resist such attempts, simply because they’re not a legal entity incorporated inside a single jurisdiction.

You’re correct in saying that Apple is “selling” privacy and security (as in: marketing, pinky-promising). They may be selling that story, but I ain’t buying it.

doodoo_wizard@lemmy.ml on 08 Apr 20:29 collapse

As a longtime and current debian user, lol if you think it hasn’t been infiltrated or that any network of developers spread over the globe could resist infiltration let alone the open source “community”.

A large portion of the maintainers of popular open source projects are en the employ of some company or other explicitly because of their maintainer role. Even if some hypothetical distributed global network of developers could resist infiltration, the maintainers of our open source software cannot.

The building blocks of android are maintained by developers who are employed by google. Google was compliant with prism four years before Apple (the exact amount of time it would take for a sealed case to wind its way through appeals).

If the fact of apples compliance with the laws of its jurisdiction worry you, the fact that people don’t get targeted or convicted off of information from properly configured icloud accounts or locked Apple devices should counteract that worry. The fact that other generally held to be trustworthy companies like mullvad are compliant with the laws of their jurisdiction should make it clear that legal compliance doesn’t necessarily mean a company or service isn’t trustworthy.

I would also like to point out that for the purposes of us law, entities outside the jurisdiction of the us are subject to a freer surveillance apparatus which need not be hampered by what some judge is willing to sign off on and doesn’t need to comply with its subjects rights as defined under us law.

An apple in Mexico would be able to offer fewer protections to its us customers than one incorporated in the us.

5PACEBAR@piefed.ca on 06 Apr 13:37 next collapse

Take this with a grain of salt: GrapheneOS is always stirring shit with other players in the privacy space and they try to paint them in the worst light possible.

FauxLiving@lemmy.world on 06 Apr 19:22 next collapse

It’s a video of him speaking in his own words, not much salt needed.

Jakeroxs@sh.itjust.works on 06 Apr 19:55 collapse

Lmao e/OS CEO says a thing, someone inevitably in the comments, “How could GrapheneOS do this!”

Zetta@mander.xyz on 07 Apr 02:26 collapse

GrapheneOS devs just spitting truth and people get butt hurt about it.

DieserTypMatthias@lemmy.ml on 06 Apr 19:58 next collapse

Well, that’ll be another 100€ December donation to GrapheneOS.

BrilliantBadger@piefed.ca on 06 Apr 20:31 next collapse

Years ago as I started research I literally laughed at loud at the thought of buying a google phone to…. Degoogle!

Talk about an instant compromise of values! Haha!

Then I saw the toxicity of the GOS devs & their fanz & that sealed the deal

Best decision ever to run away from that group of nasties

Ahhhhhh, the zen life

Squizzy@lemmy.world on 06 Apr 21:35 next collapse

This is a different OS isnt it? E and G are different and theynare pointing out that being security conscious doesnt make you a criminal

dubyakay@lemmy.ca on 06 Apr 21:49 collapse

The linked bsky thread is by GOS, citing /e/.

FG_3479@lemmy.world on 07 Apr 00:24 collapse

Pixels are the only phones available which meet GrapheneOS’ security requirements. grapheneos.org/faq#future-devices

GrapheneOS appears to be toxic on the outside, but essentially everything they say is completely true.

tixnou@feddit.cl on 06 Apr 22:08 next collapse

some people in this thread still dont get it, so:

you cant expect privacy while also having poor security practices. ideally you’d have both and most of these privacy projects are not much more than just a lineage fork with a dns blocker

apparently in duval’s mind, you can always trust even a fascist government to never try to exploit your phone and to give you privacy. or something idk

apftwb@lemmy.world on 06 Apr 23:40 collapse

Pedophiles use their work emails and gmail. Making a secure phone OS won’t make a difference.