12 ms·

Disagree. The reputation of Nick Calyx (worth a look his Wikipedia page), or GrapheneOS team, etc, is so much easier lost than that of, say, Google's Android t

Disagree. The reputation of Nick Calyx (worth a look his Wikipedia page), or GrapheneOS team, etc, is so much easier lost than that of, say, Google's Android team.....or iOS security team. Having said that: Calyx shouldn't be considered much more secure than Android Open Source Project (AOSP). That's where GrapheneOS shines. Calyx should, however, be considered more private than AOSP, less dodgy & exploitable than Samsung etc Android "enhancements", aka UI/UX bloatware.

nextos 5y ago
How does CalyxOS compare to GrapheneOS?
- GekkePrutser 5y ago
  Calyx has more focus on functionality and privacy rather than security. On Graphene, security is always priority #1. For example: Calyx provides MicroG. This means you can talk to Google Play services, though in a better, more privacy-conscious way. MicroG is an open implentation of Google Play Services. However, MicroG requires signature spoofing: You need to install a fake Google certificate so that it can trick official apps into thinking they're talking to Google Play Services directly. This could technically be abused, though Calyx takes lots of precautions to prevent that. GrapheneOS with their security-first approach don't deem this worth the risk. So with apps requiring play services you don't get push messages and network-based location checks, among others. So, do you want an allround phone to use everyday (and use things like Uber, Facebook, etc) but more private and secure than AOSP, take Calyx. Do you want security over everything and are willing to compromise a bit on functionality and app compatibility (some apps will refuse to run without google play), pick Graphene. Either way you'll need a Google Pixel by the way.
  - cdesai 5y ago
    The microG creator goes into more detail about signature spoofing at https://github.com/microg/GmsCore/issues/1467#issuecomment-840711695 https://github.com/microg/GmsCore/issues/1467#issuecomment-8... The concerns usually raised against that are due to the "default" patch included in their repository, which has a specific purpose. We don't use that, https://calyxos.org/about/tech/microg/ https://calyxos.org/about/tech/microg/ are the precautions we take to try and prevent abuse. I made it a privileged permission because that's a standard Android thing to gate things (such as reading of IMEI) - My thought process being that if you somehow managed to get around privileged permissions, we have much bigger problems than signature spoofing.
    - GekkePrutser 5y ago
      Yeah I agree, it's a good compromise and I definitely use MicroG despite that (though not on Calyx but Lineage for MicroG, as I don't have a Pixel phone). I think the Calyx precautions are more than adequate. And better than Lineage's. I just wanted to highlight the difference in focus, GrapheneOS will always pick the security side when a compromise needs to be made. Another example is the "We don't lie about security features" stance about SafetyNet. Even though a GrapheneOS phone is arguably more secure than a random manufacturer-modified Android rom. I agree that signature spoofing has an unnecessarily bad name. Probably because some mainstream roms like Lineage eschewing it. Personally I think it's a great tradeoff between privacy and functionality.
  - kelnos 5y ago
    This is the trade off that I hate having to make, and I'm glad to see something like Calyx here. I want a phone that respects my privacy and is secure, but I also want to use apps like Google Photos (my favorite app that I use more than anything, aside from Firefox), Lyft, Netflix, Slack, banking apps, airline apps, and, critically, Google Pay. I get that using many of those apps might increase my exposure to tracking and privacy leaks, but I just want an OS behind them that I know I can trust in isolation, and that may have measures in place that at least try to mitigate some of the worst privacy abuses from the apps. (And if it can't always succeed at that, that's fine, I'll live.) Meanwhile, my only real choices are stock Android, which I know I can't trust to protect my privacy (since Google's business model depends on that), and iOS, which will treat me like a child and not let me do what I want with my phone unless Apple approves. (I'm also really concerned about the privacy implications of Apple's plan to do client-side scanning for CSAM material, assuming that's true.) So I just don't feel like there's anything out there right now that will let me run the apps I want, that is built in top of an OS that I feel I can trust. Calyx seems to be one of the few I've seen that looks like they're actually trying to be that.
    - GekkePrutser 5y ago
      I agree, this is my stance as well,. Though I don't think Calyx tries to limit tracking on installed apps. I would recommend using something like TrackerControl to limit those.
      - ignoramous 5y ago
        TrackerControl doesn't encrypt your DNS queries, though. You'd need to proxy DNS requests to another app like http://github.com/ch4t4r/Nebulo http://github.com/ch4t4r/Nebulo which supports DoT / DoH3 / DoH for that. (disclosure: I co-develop a FOSS TrackerControl alternative)
        privacyking 5y ago
        What is your trackercontrol alternative called? What makes it better or worse?
  - throwaway888abc 5y ago
    > you don't get push messages and network-based location checks, among others. This should be advertised as major feature.
  - strcat 5y ago
    > Calyx has more focus on functionality and privacy rather than security. That's not true. GrapheneOS is heavily focused on privacy and offers much better privacy than CalyxOS. See https://grapheneos.org/features https://grapheneos.org/features for the privacy and security features offered beyond AOSP. Unlike CalyxOS, we aren't listing AOSP features as our own. CalyxOS has a leaky firewall which apps can bypass and a leaky VPN tethering implementation. GrapheneOS has a Network toggle without those leaks and prefers the approach of fine-grained VPNs rather than using the same tunnel for everything. We want real per-profile VPNs rather than making more devices use the same VPN, especially in a leaky way. > For example: Calyx provides MicroG. This means you can talk to Google Play services, though in a better, more privacy-conscious way. MicroG is an open implentation of Google Play Services. GrapheneOS has https://grapheneos.org/usage#sandboxed-play-services https://grapheneos.org/usage#sandboxed-play-services which is able to provide much better app compatibility, far more functionality and without the privacy/security sacrifices of microG. microG lacks the same security checks and key pinning of Play. It doesn't avoid trusting Play because the apps using Play are using the Play client libraries. microG is an additional trusted party. > This could technically be abused, though Calyx takes lots of precautions to prevent that. They simply limit it to microG and the Play services signature, which was our suggestion. That isn't taking a lot of precautions. It is abused because apps are tricked into giving their data to an app without the same security model/checks and key pinning (microG) is > GrapheneOS with their security-first approach don't deem this worth the risk. No, we took a better approach instead. https://grapheneos.org/usage#sandboxed-play-services https://grapheneos.org/usage#sandboxed-play-services > So with apps requiring play services you don't get push messages and network-based location checks, among others. Push works fine with many apps without Play. GrapheneOS has support for using Play in a sandbox. > So, do you want an allround phone to use everyday (and use things like Uber, Facebook, etc) but more private and secure than AOSP, take Calyx. Those apps work fine on GrapheneOS. CalyxOS isn't more private and more secure than AOSP. CalyxOS includes a lot more proprietary services (Google, WhatsApp, etc.) than AOSP. For the most part, they're making changes which quite easily hurt privacy and security. > Do you want security over everything and are willing to compromise a bit on functionality and app compatibility (some apps will refuse to run without google play), pick Graphene. This is a highly inaccurate portrayal of what GrapheneOS provides and the decision making process. GrapheneOS values privacy and usability very highly. It balances those with security. What really defines GrapheneOS is that we aim to implement things in a proper way that cannot be bypassed by adversaries. A privacy feature that's simply worked around is not much of a privacy feature.
- strcat 5y ago
  GrapheneOS has the substantial privacy and security features documented at https://grapheneos.org/features https://grapheneos.org/features. This is a list of differences from AOSP. We've landed assorted privacy/security upstream in AOSP and AOSP upstream projects like the Linux kernel. Those features are NOT listed on that page, because they aren't differences from AOSP anymore. We're confident enough in our ability to implement substantial improvements that we can land features upstream. GrapheneOS has an easy to use web installer: https://grapheneos.org/install/web https://grapheneos.org/install/web which is based on the fastboot.js library created with our funding. We also now has a sandboxed Play services compatibility layer implementing a no compromises approach to providing app compatibility: https://grapheneos.org/usage#sandboxed-play-services https://grapheneos.org/usage#sandboxed-play-services This will provide much more functionality than microG with better security and without sacrificing privacy by not giving Play any additional access than it has via the client libraries used by apps. It runs as a normal, sandboxed app and we provide fallback code for it to work that way. We return placeholder values for most of the privileged APIs and implement certain APIs like dynamite modules in an unprivileged way. No need to bypass security checks in apps as has to be done to make microG work. That's a problem because microG doesn't uphold the same security model and checks as Play services. For example, it's not pinning component and server keys for important cases. GrapheneOS currently has a much more barebones fresh install, but it's easier to install due to the web installer. The barebones installer is by design. We don't bundle proprietary services. We also don't bundle 3rd party apps and services unnecessarily rather than leaving it up to the user. We'll be providing a first party app repository with modern metadata signing, key rotation, delta update, stable/beta release channels, etc. within the next few months to make it easy for users to install an initial set of apps. High standards will be applied to the apps we choose to build for our repository. Play Store requires API 29+ at the moment and that will be required to use the much safer unattended upgrade approach in Android 12 as opposed to the risky approach used by the Play Store, Aurora Store and F-Droid. We'll likely require API 30+ though. F-Droid itself if API 25 (Android 7.1). The API level is the privacy/security level of an app. API 28 introduces a much stronger SELinux sandbox with per-app SELinux MLS domains protecting the app from others and other apps from it. There are many other improvements, with each API level making things better. For apps not distributed via the Play Store, this is a simple health check to see how much an app prioritizes privacy and security compared to simply getting it working.
GekkePrutser 5y ago
Yeah GrapheneOS is security over privacy, Calyx is privacy over security (and has a bit more mainstream appeal with MicroG, supporting push messaging and location services etc). GrapheneOS has also pioneered a lot of security measures, a lot of which have been added to Android proper (if you see their feature log, a lot of it says "removed because it was introduced in Android"). I wonder if that wouldn't have been the case without them pioneering it. Finally, the big guys make a lot of mistakes too. Remember the time when you could sudo on macOS with a blank password :) Or that other time when they showed your actual password instead of the password hint. AFAIK, Graphene and Calyx have never made any mistakes even close to that severity.
- Koshkin 5y ago
  Don't privacy and security go hand in hand?
  - natpalmer1776 5y ago
    I think the distinction is such that with a private (but not secure) application, the only person getting my data is a malicious actor. With a secure (but not private) application, the only person getting my data is the owner of the code & anyone they are willing to share it with (Governments, Ad-tech, etc.) So if your hard requirement is 'nobody can know anything about what I do with this software' you are correct. However in-practice, security requirements often exist somewhere between the above two scenarios.
    - grifball 5y ago
      Yeah. Mostly, the difference is whether you're protecting against big tech or smaller hackers. The only other difference is that computersecurity also protects your computer as a resource say against mining trojans.
  - Saris 5y ago
    I see it as: Private = not sending data out of my device unless I want it to. Secure = resistant to someone trying to get into my device. They do overlap a bit, to be private a device needs some base level of security. But a device can be very secure and still not be private as it's sending data out for analytics, tracking, etc.
LukeShu 5y ago
> Nick Calyx (worth a look his Wikipedia page) For those struggling to do this: "Nicholas Merrill" is the name you'll need to look up on Wikipedia.

nextos 5y ago

How does CalyxOS compare to GrapheneOS?

GekkePrutser 5y ago
Calyx has more focus on functionality and privacy rather than security. On Graphene, security is always priority #1. For example: Calyx provides MicroG. This means you can talk to Google Play services, though in a better, more privacy-conscious way. MicroG is an open implentation of Google Play Services. However, MicroG requires signature spoofing: You need to install a fake Google certificate so that it can trick official apps into thinking they're talking to Google Play Services directly. This could technically be abused, though Calyx takes lots of precautions to prevent that. GrapheneOS with their security-first approach don't deem this worth the risk. So with apps requiring play services you don't get push messages and network-based location checks, among others. So, do you want an allround phone to use everyday (and use things like Uber, Facebook, etc) but more private and secure than AOSP, take Calyx. Do you want security over everything and are willing to compromise a bit on functionality and app compatibility (some apps will refuse to run without google play), pick Graphene. Either way you'll need a Google Pixel by the way.
- cdesai 5y ago
  The microG creator goes into more detail about signature spoofing at https://github.com/microg/GmsCore/issues/1467#issuecomment-840711695 https://github.com/microg/GmsCore/issues/1467#issuecomment-8... The concerns usually raised against that are due to the "default" patch included in their repository, which has a specific purpose. We don't use that, https://calyxos.org/about/tech/microg/ https://calyxos.org/about/tech/microg/ are the precautions we take to try and prevent abuse. I made it a privileged permission because that's a standard Android thing to gate things (such as reading of IMEI) - My thought process being that if you somehow managed to get around privileged permissions, we have much bigger problems than signature spoofing.
  - GekkePrutser 5y ago
    Yeah I agree, it's a good compromise and I definitely use MicroG despite that (though not on Calyx but Lineage for MicroG, as I don't have a Pixel phone). I think the Calyx precautions are more than adequate. And better than Lineage's. I just wanted to highlight the difference in focus, GrapheneOS will always pick the security side when a compromise needs to be made. Another example is the "We don't lie about security features" stance about SafetyNet. Even though a GrapheneOS phone is arguably more secure than a random manufacturer-modified Android rom. I agree that signature spoofing has an unnecessarily bad name. Probably because some mainstream roms like Lineage eschewing it. Personally I think it's a great tradeoff between privacy and functionality.
- kelnos 5y ago
  This is the trade off that I hate having to make, and I'm glad to see something like Calyx here. I want a phone that respects my privacy and is secure, but I also want to use apps like Google Photos (my favorite app that I use more than anything, aside from Firefox), Lyft, Netflix, Slack, banking apps, airline apps, and, critically, Google Pay. I get that using many of those apps might increase my exposure to tracking and privacy leaks, but I just want an OS behind them that I know I can trust in isolation, and that may have measures in place that at least try to mitigate some of the worst privacy abuses from the apps. (And if it can't always succeed at that, that's fine, I'll live.) Meanwhile, my only real choices are stock Android, which I know I can't trust to protect my privacy (since Google's business model depends on that), and iOS, which will treat me like a child and not let me do what I want with my phone unless Apple approves. (I'm also really concerned about the privacy implications of Apple's plan to do client-side scanning for CSAM material, assuming that's true.) So I just don't feel like there's anything out there right now that will let me run the apps I want, that is built in top of an OS that I feel I can trust. Calyx seems to be one of the few I've seen that looks like they're actually trying to be that.
  - GekkePrutser 5y ago
    I agree, this is my stance as well,. Though I don't think Calyx tries to limit tracking on installed apps. I would recommend using something like TrackerControl to limit those.
    - ignoramous 5y ago
      TrackerControl doesn't encrypt your DNS queries, though. You'd need to proxy DNS requests to another app like http://github.com/ch4t4r/Nebulo http://github.com/ch4t4r/Nebulo which supports DoT / DoH3 / DoH for that. (disclosure: I co-develop a FOSS TrackerControl alternative)
      - privacyking 5y ago
        What is your trackercontrol alternative called? What makes it better or worse?
- throwaway888abc 5y ago
  > you don't get push messages and network-based location checks, among others. This should be advertised as major feature.
- strcat 5y ago
  > Calyx has more focus on functionality and privacy rather than security. That's not true. GrapheneOS is heavily focused on privacy and offers much better privacy than CalyxOS. See https://grapheneos.org/features https://grapheneos.org/features for the privacy and security features offered beyond AOSP. Unlike CalyxOS, we aren't listing AOSP features as our own. CalyxOS has a leaky firewall which apps can bypass and a leaky VPN tethering implementation. GrapheneOS has a Network toggle without those leaks and prefers the approach of fine-grained VPNs rather than using the same tunnel for everything. We want real per-profile VPNs rather than making more devices use the same VPN, especially in a leaky way. > For example: Calyx provides MicroG. This means you can talk to Google Play services, though in a better, more privacy-conscious way. MicroG is an open implentation of Google Play Services. GrapheneOS has https://grapheneos.org/usage#sandboxed-play-services https://grapheneos.org/usage#sandboxed-play-services which is able to provide much better app compatibility, far more functionality and without the privacy/security sacrifices of microG. microG lacks the same security checks and key pinning of Play. It doesn't avoid trusting Play because the apps using Play are using the Play client libraries. microG is an additional trusted party. > This could technically be abused, though Calyx takes lots of precautions to prevent that. They simply limit it to microG and the Play services signature, which was our suggestion. That isn't taking a lot of precautions. It is abused because apps are tricked into giving their data to an app without the same security model/checks and key pinning (microG) is > GrapheneOS with their security-first approach don't deem this worth the risk. No, we took a better approach instead. https://grapheneos.org/usage#sandboxed-play-services https://grapheneos.org/usage#sandboxed-play-services > So with apps requiring play services you don't get push messages and network-based location checks, among others. Push works fine with many apps without Play. GrapheneOS has support for using Play in a sandbox. > So, do you want an allround phone to use everyday (and use things like Uber, Facebook, etc) but more private and secure than AOSP, take Calyx. Those apps work fine on GrapheneOS. CalyxOS isn't more private and more secure than AOSP. CalyxOS includes a lot more proprietary services (Google, WhatsApp, etc.) than AOSP. For the most part, they're making changes which quite easily hurt privacy and security. > Do you want security over everything and are willing to compromise a bit on functionality and app compatibility (some apps will refuse to run without google play), pick Graphene. This is a highly inaccurate portrayal of what GrapheneOS provides and the decision making process. GrapheneOS values privacy and usability very highly. It balances those with security. What really defines GrapheneOS is that we aim to implement things in a proper way that cannot be bypassed by adversaries. A privacy feature that's simply worked around is not much of a privacy feature.
strcat 5y ago
GrapheneOS has the substantial privacy and security features documented at https://grapheneos.org/features https://grapheneos.org/features. This is a list of differences from AOSP. We've landed assorted privacy/security upstream in AOSP and AOSP upstream projects like the Linux kernel. Those features are NOT listed on that page, because they aren't differences from AOSP anymore. We're confident enough in our ability to implement substantial improvements that we can land features upstream. GrapheneOS has an easy to use web installer: https://grapheneos.org/install/web https://grapheneos.org/install/web which is based on the fastboot.js library created with our funding. We also now has a sandboxed Play services compatibility layer implementing a no compromises approach to providing app compatibility: https://grapheneos.org/usage#sandboxed-play-services https://grapheneos.org/usage#sandboxed-play-services This will provide much more functionality than microG with better security and without sacrificing privacy by not giving Play any additional access than it has via the client libraries used by apps. It runs as a normal, sandboxed app and we provide fallback code for it to work that way. We return placeholder values for most of the privileged APIs and implement certain APIs like dynamite modules in an unprivileged way. No need to bypass security checks in apps as has to be done to make microG work. That's a problem because microG doesn't uphold the same security model and checks as Play services. For example, it's not pinning component and server keys for important cases. GrapheneOS currently has a much more barebones fresh install, but it's easier to install due to the web installer. The barebones installer is by design. We don't bundle proprietary services. We also don't bundle 3rd party apps and services unnecessarily rather than leaving it up to the user. We'll be providing a first party app repository with modern metadata signing, key rotation, delta update, stable/beta release channels, etc. within the next few months to make it easy for users to install an initial set of apps. High standards will be applied to the apps we choose to build for our repository. Play Store requires API 29+ at the moment and that will be required to use the much safer unattended upgrade approach in Android 12 as opposed to the risky approach used by the Play Store, Aurora Store and F-Droid. We'll likely require API 30+ though. F-Droid itself if API 25 (Android 7.1). The API level is the privacy/security level of an app. API 28 introduces a much stronger SELinux sandbox with per-app SELinux MLS domains protecting the app from others and other apps from it. There are many other improvements, with each API level making things better. For apps not distributed via the Play Store, this is a simple health check to see how much an app prioritizes privacy and security compared to simply getting it working.

GekkePrutser 5y ago

Yeah GrapheneOS is security over privacy, Calyx is privacy over security (and has a bit more mainstream appeal with MicroG, supporting push messaging and location services etc). GrapheneOS has also pioneered a lot of security measures, a lot of which have been added to Android proper (if you see their feature log, a lot of it says "removed because it was introduced in Android"). I wonder if that wouldn't have been the case without them pioneering it. Finally, the big guys make a lot of mistakes too. Remember the time when you could sudo on macOS with a blank password :) Or that other time when they showed your actual password instead of the password hint. AFAIK, Graphene and Calyx have never made any mistakes even close to that severity.

Koshkin 5y ago
Don't privacy and security go hand in hand?
- natpalmer1776 5y ago
  I think the distinction is such that with a private (but not secure) application, the only person getting my data is a malicious actor. With a secure (but not private) application, the only person getting my data is the owner of the code & anyone they are willing to share it with (Governments, Ad-tech, etc.) So if your hard requirement is 'nobody can know anything about what I do with this software' you are correct. However in-practice, security requirements often exist somewhere between the above two scenarios.
  - grifball 5y ago
    Yeah. Mostly, the difference is whether you're protecting against big tech or smaller hackers. The only other difference is that computersecurity also protects your computer as a resource say against mining trojans.
- Saris 5y ago
  I see it as: Private = not sending data out of my device unless I want it to. Secure = resistant to someone trying to get into my device. They do overlap a bit, to be private a device needs some base level of security. But a device can be very secure and still not be private as it's sending data out for analytics, tracking, etc.

LukeShu 5y ago

> Nick Calyx (worth a look his Wikipedia page) For those struggling to do this: "Nicholas Merrill" is the name you'll need to look up on Wikipedia.