10 ms·

Yeah GrapheneOS is security over privacy, Calyx is privacy over security (and has a bit more mainstream appeal with MicroG, supporting push messaging and locati

Yeah GrapheneOS is security over privacy, Calyx is privacy over security (and has a bit more mainstream appeal with MicroG, supporting push messaging and location services etc). GrapheneOS has also pioneered a lot of security measures, a lot of which have been added to Android proper (if you see their feature log, a lot of it says "removed because it was introduced in Android"). I wonder if that wouldn't have been the case without them pioneering it. Finally, the big guys make a lot of mistakes too. Remember the time when you could sudo on macOS with a blank password :) Or that other time when they showed your actual password instead of the password hint. AFAIK, Graphene and Calyx have never made any mistakes even close to that severity.

Koshkin 5y ago
Don't privacy and security go hand in hand?
- natpalmer1776 5y ago
  I think the distinction is such that with a private (but not secure) application, the only person getting my data is a malicious actor. With a secure (but not private) application, the only person getting my data is the owner of the code & anyone they are willing to share it with (Governments, Ad-tech, etc.) So if your hard requirement is 'nobody can know anything about what I do with this software' you are correct. However in-practice, security requirements often exist somewhere between the above two scenarios.
  - grifball 5y ago
    Yeah. Mostly, the difference is whether you're protecting against big tech or smaller hackers. The only other difference is that computersecurity also protects your computer as a resource say against mining trojans.
- Saris 5y ago
  I see it as: Private = not sending data out of my device unless I want it to. Secure = resistant to someone trying to get into my device. They do overlap a bit, to be private a device needs some base level of security. But a device can be very secure and still not be private as it's sending data out for analytics, tracking, etc.
- corty 5y ago
  No. First, there are security measures that wreck privacy, e.g. sending all your data to some company's servers for virus scanning. Routing all your traffic through some filtering VPN provider. That kind of stuff. There are privacy measures that wreck security, e.g. not using personalized user accounts for certain things. Security is also mostly up to definition, a secure computer system is a system that only does what it is defined to do. What this definition entails is up to the vendor, which isn't necessarily the same definition a user might want for security or privacy. But generally, there is a large overlap between privacy and security.
  - chme 5y ago
    > No. First, there are security measures that wreck privacy, e.g. sending all your data to some company's servers for virus scanning. Routing all your traffic through some filtering VPN provider. That kind of stuff. There are privacy measures that wreck security, e.g. not using personalized user accounts for certain things. Aren't those examples more examples of bad security by introducing single points of failure?
    - corty 5y ago
      Maybe, but there are more examples along those lines that don't introduce single points of failure. E.g. very all-encompassing logging is generally good for security, and if the logs are stored in a secure fashion, there is also no security problem created. However, privacy suffers because one might log things one shouldn't log. In the other direction, file and traffic encryption is good for privacy, and the less "permeable" you make it, i.e. the less readable for admins, system task, scanners, the better for privacy. However, for security, encrypting just for the user's eyes is a huge problem, because you cannot do malware scanning, you cannot do exfiltration prevention. Having users bring their own device into a work network is good for privacy, because those devices don't have central admin access, but bad for security, because same reason.
- valiant-comma 5y ago
  Another way of looking at it: Privacy is what about you're trying to protect, security is about how you are protecting it.
- aryamaan 5y ago
  They don't go hand in hand in real life. Can imagine that happening in digital world too.
- strcat 5y ago
  Yes, they do, and GrapheneOS is heavily focused on both. The purpose of the project and what it provides is being heavily misrepresented by the comment above. GrapheneOS treats bypasses of privacy features as security vulnerabilities. It offers substantial privacy advantages of CalyxOS and doesn't come with the privacy drawbacks it introduces. See https://news.ycombinator.com/item?id=28095033 https://news.ycombinator.com/item?id=28095033 (above) for a more in-depth explanation.
  - tentacleuno 5y ago
    Disclaimer: strcat is the GrapheneOS developer.
    - strcat 5y ago
      Disclaimer: tentacleuno is a member of a community engaged in harassment and bullying. GrapheneOS has a development team with a dozen developers and several of those are having their work funded. It's not a single person project. Please stop spreading your malicious talking points.
    - FieryBinary 5y ago
      He's not "the GrapheneOS developer", he's the lead developer and one of many developers. It's a collaborative open-source project which has made a production-grade OS and whose contributions have been upsteamed for AOSP.
  - GekkePrutser 5y ago
    I actually praised you here for pioneering important security features into AOSP :) Please don't view my comments as attacks or Calyx fanboi-ism. I'm not using either and I think you're doing great work. I just wanted to highlight the difference in approach as I saw it as a potential user when I was considering buying a pixel phone.
- temptemptemp111 5y ago
  Very. People can't think.
ineedasername 5y ago
Remember the time when you could sudo on macOS with a blank password :) Apple paid out a lot of free sandwiches on that one [0] Internationalization on that command was a mess though. Defaults were based on OS settings and the flags to override were based on a combination of country & postal code rather than the localized name of the ingredient. So, if I didn't want the default of an American cheese sandwich on white bread with mayo, I had to research each bread, meats, and cheese lineage to get, for example, provolone using the switches -c IT -r 26100. It got worse if you wanted multiple cheese types. In the end I just aliased a bunch of options. My favorite was meatloaf w/ swiss cheese... I have no idea where Apple sources their meatloaf for the US region, but I haven't had anything like it since. The cafeteria staff at Apple HQ have stopped taking my calls. [0] https://xkcd.com/149/ https://xkcd.com/149/
vngzs 5y ago
GrapheneOS, lacking MicroG in the default install, is therefore more private than CalyxOS. Keeping Google out of the loop entirely is necessary for true privacy.
- cdesai 5y ago
  On CalyxOS you do get an option to disable microG when setting it up for the first time, see https://calyxos.org/features/microg/#1-microg-disabled https://calyxos.org/features/microg/#1-microg-disabled microG being disabled but present is still enough for some apps to work, which makes sense given that you can disable Google Play Services on the stock OS.
  - folmar 5y ago
    It seems to miss my favourite with Lineage - microG enabled, but C2DM disabled, i.e. services present, but no talking to google servers (but maps api, locations and so on still work). Disclaimer: I've only read the linked webpage.
    - commoner 5y ago
      You're able to enable microG on CalyxOS while disabling Google device registration and Firebase Cloud Messaging (the current push messaging service which has replaced the deprecated C2DM). The microG Services Core app behaves on CalyxOS exactly as it does on LineageOS for microG.
  - strcat 5y ago
    GrapheneOS has https://grapheneos.org/usage#sandboxed-play-services https://grapheneos.org/usage#sandboxed-play-services so our users have the option to use Play services too, in a way that will provide more functionality and avoids losing the security checks and key pinning that are missing in microG. We'll be making it easy for users to install via our app repository rather than bundling Google services in the OS. Google's Play client libraries are still used on CalyxOS by the apps using Play services. The Ads SDK is a fat library and works without Play services. Only the Lite variant of that has a hard dependency on Play. GrapheneOS isn't giving any additional access to Play when it's installed compared to what the client libraries have available. WhatsApp is clearly a proprietary service too, and CalyxOS is integrating that into the Dialer app. Signal's server source code is not fully public either and went a whole year without even the incomplete releases that are now available again. Both are centralized, third party services integrated in a special way not available to other apps. Isn't that the problem with Play services? It is from our perspective.
strcat 5y ago
> Yeah GrapheneOS is security over privacy No, GrapheneOS is heavily focused on both privacy and security. See https://grapheneos.org/features https://grapheneos.org/features for a list of the enhancements compared to the latest Android Open Source Project. GrapheneOS offers substantial privacy advantages over CalyxOS. It has a bunch of nice privacy improvements, carefully designed to work against real adversaries. Bypasses of privacy features are taken very seriously and prioritized as security vulnerabilities. GrapheneOS also doesn't integrate proprietary apps/services into the OS. We'd never stick WhatsApp support in the Dialer or ship Google services integrated into the OS in a special way not available to other apps. Services should be on an equal playing ground. That's the real issue with Play services and with iOS too. GrapheneOS has full MAC randomization, DHCP anonymity and doesn't reuse IPv6 addresses across networks. GrapheneOS has the Network permission toggle for disallowing both direct and indirect network access. Calyx takes an approach that allows apps to bypass it via APIs gated by the INTERNET permission. It also has other bypasses. They present it as a firewall app with a fancy name, but it's just a UI for the AOSP firewall and it doesn't really work as they present it. https://gitlab.com/CalyxOS/calyxos/-/issues/454 https://gitlab.com/CalyxOS/calyxos/-/issues/454 acknowledges the issue but presents an unworkable plan to address it. The approach doesn't work. Similarly, fine-grained filtering of domains/addresses in most firewalls even as a whitelist doesn't work due to DNS acting as 2-way communication via a permitted IP to arbitrary third parties. These indirect forms of access can't simply be ignored. GrapheneOS has the Sensors toggle to disallow apps from accessing the miscellaneous sensors usable for coarse movement (which can map to location) and audio recording among other things. It has substantially privacy improvements beyond these things, but they're some nice examples. I strongly recommend looking through https://grapheneos.org/features https://grapheneos.org/features and keep in mind it does not list AOSP features as most projects would. Avoiding bundling third party apps and services is explicitly listed as a feature rather than listing out integrating proprietary services and assorted apps. GrapheneOS is also focused on usability, and it's hard to deny that https://grapheneos.org/install/web https://grapheneos.org/install/web is a very nice way of performing the install. The fastboot.js library powering it is a project we funded. > and has a bit more mainstream appeal with MicroG, supporting push messaging and location services etc Location works properly on GrapheneOS, as do notifications. https://grapheneos.org/faq#notifications https://grapheneos.org/faq#notifications GrapheneOS has a sandboxed Play services compatibility layer for running Play services with zero special privileges: https://grapheneos.org/usage#sandboxed-play-services https://grapheneos.org/usage#sandboxed-play-services Despite being very new, it's already rapidly moving beyond what microG supports. It doesn't require making the security sacrifices of microG by losing the standard security checks and key pinning. It also doesn't make privacy sacrifices: it provides Play with zero additional access. Apps using Play include the Play client libraries. Many of these fully work without Play services installed, including Google's Ads library. That only has a hard dependency on Play services if apps use the Lite variant: https://developers.google.com/admob/android/lite-sdk https://developers.google.com/admob/android/lite-sdk. The claims about microG privacy/security benefits are not just overstated but backwards. It also only implements a tiny subset of the API. Sandboxed Play services compatibility layer is another much more broadly application project funded by us, among others. > GrapheneOS has also pioneered a lot of security measures, a lot of which have been added to Android proper (if you see their feature log, a lot of it says "removed because it was introduced in Android"). We're also implemented a lot of substantial privacy measures. There aren't really distinctions between these things. GrapheneOS helped get substantial app sandbox restrictions into AOSP restricting the information available to apps.
tearfang 5y ago
//GrapheneOS is security over privacy// Is this just in philosophy or are there actual concrete privacy features/things I can't do with Graphene?

Koshkin 5y ago

Don't privacy and security go hand in hand?

natpalmer1776 5y ago
I think the distinction is such that with a private (but not secure) application, the only person getting my data is a malicious actor. With a secure (but not private) application, the only person getting my data is the owner of the code & anyone they are willing to share it with (Governments, Ad-tech, etc.) So if your hard requirement is 'nobody can know anything about what I do with this software' you are correct. However in-practice, security requirements often exist somewhere between the above two scenarios.
- grifball 5y ago
  Yeah. Mostly, the difference is whether you're protecting against big tech or smaller hackers. The only other difference is that computersecurity also protects your computer as a resource say against mining trojans.
Saris 5y ago
I see it as: Private = not sending data out of my device unless I want it to. Secure = resistant to someone trying to get into my device. They do overlap a bit, to be private a device needs some base level of security. But a device can be very secure and still not be private as it's sending data out for analytics, tracking, etc.
corty 5y ago
No. First, there are security measures that wreck privacy, e.g. sending all your data to some company's servers for virus scanning. Routing all your traffic through some filtering VPN provider. That kind of stuff. There are privacy measures that wreck security, e.g. not using personalized user accounts for certain things. Security is also mostly up to definition, a secure computer system is a system that only does what it is defined to do. What this definition entails is up to the vendor, which isn't necessarily the same definition a user might want for security or privacy. But generally, there is a large overlap between privacy and security.
- chme 5y ago
  > No. First, there are security measures that wreck privacy, e.g. sending all your data to some company's servers for virus scanning. Routing all your traffic through some filtering VPN provider. That kind of stuff. There are privacy measures that wreck security, e.g. not using personalized user accounts for certain things. Aren't those examples more examples of bad security by introducing single points of failure?
  - corty 5y ago
    Maybe, but there are more examples along those lines that don't introduce single points of failure. E.g. very all-encompassing logging is generally good for security, and if the logs are stored in a secure fashion, there is also no security problem created. However, privacy suffers because one might log things one shouldn't log. In the other direction, file and traffic encryption is good for privacy, and the less "permeable" you make it, i.e. the less readable for admins, system task, scanners, the better for privacy. However, for security, encrypting just for the user's eyes is a huge problem, because you cannot do malware scanning, you cannot do exfiltration prevention. Having users bring their own device into a work network is good for privacy, because those devices don't have central admin access, but bad for security, because same reason.
valiant-comma 5y ago
Another way of looking at it: Privacy is what about you're trying to protect, security is about how you are protecting it.
aryamaan 5y ago
They don't go hand in hand in real life. Can imagine that happening in digital world too.
strcat 5y ago
Yes, they do, and GrapheneOS is heavily focused on both. The purpose of the project and what it provides is being heavily misrepresented by the comment above. GrapheneOS treats bypasses of privacy features as security vulnerabilities. It offers substantial privacy advantages of CalyxOS and doesn't come with the privacy drawbacks it introduces. See https://news.ycombinator.com/item?id=28095033 https://news.ycombinator.com/item?id=28095033 (above) for a more in-depth explanation.
- tentacleuno 5y ago
  Disclaimer: strcat is the GrapheneOS developer.
  - strcat 5y ago
    Disclaimer: tentacleuno is a member of a community engaged in harassment and bullying. GrapheneOS has a development team with a dozen developers and several of those are having their work funded. It's not a single person project. Please stop spreading your malicious talking points.
  - FieryBinary 5y ago
    He's not "the GrapheneOS developer", he's the lead developer and one of many developers. It's a collaborative open-source project which has made a production-grade OS and whose contributions have been upsteamed for AOSP.
- GekkePrutser 5y ago
  I actually praised you here for pioneering important security features into AOSP :) Please don't view my comments as attacks or Calyx fanboi-ism. I'm not using either and I think you're doing great work. I just wanted to highlight the difference in approach as I saw it as a potential user when I was considering buying a pixel phone.
temptemptemp111 5y ago
Very. People can't think.

ineedasername 5y ago

Remember the time when you could sudo on macOS with a blank password :) Apple paid out a lot of free sandwiches on that one [0] Internationalization on that command was a mess though. Defaults were based on OS settings and the flags to override were based on a combination of country & postal code rather than the localized name of the ingredient. So, if I didn't want the default of an American cheese sandwich on white bread with mayo, I had to research each bread, meats, and cheese lineage to get, for example, provolone using the switches -c IT -r 26100. It got worse if you wanted multiple cheese types. In the end I just aliased a bunch of options. My favorite was meatloaf w/ swiss cheese... I have no idea where Apple sources their meatloaf for the US region, but I haven't had anything like it since. The cafeteria staff at Apple HQ have stopped taking my calls. [0] https://xkcd.com/149/ https://xkcd.com/149/

vngzs 5y ago

GrapheneOS, lacking MicroG in the default install, is therefore more private than CalyxOS. Keeping Google out of the loop entirely is necessary for true privacy.

cdesai 5y ago
On CalyxOS you do get an option to disable microG when setting it up for the first time, see https://calyxos.org/features/microg/#1-microg-disabled https://calyxos.org/features/microg/#1-microg-disabled microG being disabled but present is still enough for some apps to work, which makes sense given that you can disable Google Play Services on the stock OS.
- folmar 5y ago
  It seems to miss my favourite with Lineage - microG enabled, but C2DM disabled, i.e. services present, but no talking to google servers (but maps api, locations and so on still work). Disclaimer: I've only read the linked webpage.
  - commoner 5y ago
    You're able to enable microG on CalyxOS while disabling Google device registration and Firebase Cloud Messaging (the current push messaging service which has replaced the deprecated C2DM). The microG Services Core app behaves on CalyxOS exactly as it does on LineageOS for microG.
- strcat 5y ago
  GrapheneOS has https://grapheneos.org/usage#sandboxed-play-services https://grapheneos.org/usage#sandboxed-play-services so our users have the option to use Play services too, in a way that will provide more functionality and avoids losing the security checks and key pinning that are missing in microG. We'll be making it easy for users to install via our app repository rather than bundling Google services in the OS. Google's Play client libraries are still used on CalyxOS by the apps using Play services. The Ads SDK is a fat library and works without Play services. Only the Lite variant of that has a hard dependency on Play. GrapheneOS isn't giving any additional access to Play when it's installed compared to what the client libraries have available. WhatsApp is clearly a proprietary service too, and CalyxOS is integrating that into the Dialer app. Signal's server source code is not fully public either and went a whole year without even the incomplete releases that are now available again. Both are centralized, third party services integrated in a special way not available to other apps. Isn't that the problem with Play services? It is from our perspective.

strcat 5y ago

> Yeah GrapheneOS is security over privacy No, GrapheneOS is heavily focused on both privacy and security. See https://grapheneos.org/features https://grapheneos.org/features for a list of the enhancements compared to the latest Android Open Source Project. GrapheneOS offers substantial privacy advantages over CalyxOS. It has a bunch of nice privacy improvements, carefully designed to work against real adversaries. Bypasses of privacy features are taken very seriously and prioritized as security vulnerabilities. GrapheneOS also doesn't integrate proprietary apps/services into the OS. We'd never stick WhatsApp support in the Dialer or ship Google services integrated into the OS in a special way not available to other apps. Services should be on an equal playing ground. That's the real issue with Play services and with iOS too. GrapheneOS has full MAC randomization, DHCP anonymity and doesn't reuse IPv6 addresses across networks. GrapheneOS has the Network permission toggle for disallowing both direct and indirect network access. Calyx takes an approach that allows apps to bypass it via APIs gated by the INTERNET permission. It also has other bypasses. They present it as a firewall app with a fancy name, but it's just a UI for the AOSP firewall and it doesn't really work as they present it. https://gitlab.com/CalyxOS/calyxos/-/issues/454 https://gitlab.com/CalyxOS/calyxos/-/issues/454 acknowledges the issue but presents an unworkable plan to address it. The approach doesn't work. Similarly, fine-grained filtering of domains/addresses in most firewalls even as a whitelist doesn't work due to DNS acting as 2-way communication via a permitted IP to arbitrary third parties. These indirect forms of access can't simply be ignored. GrapheneOS has the Sensors toggle to disallow apps from accessing the miscellaneous sensors usable for coarse movement (which can map to location) and audio recording among other things. It has substantially privacy improvements beyond these things, but they're some nice examples. I strongly recommend looking through https://grapheneos.org/features https://grapheneos.org/features and keep in mind it does not list AOSP features as most projects would. Avoiding bundling third party apps and services is explicitly listed as a feature rather than listing out integrating proprietary services and assorted apps. GrapheneOS is also focused on usability, and it's hard to deny that https://grapheneos.org/install/web https://grapheneos.org/install/web is a very nice way of performing the install. The fastboot.js library powering it is a project we funded. > and has a bit more mainstream appeal with MicroG, supporting push messaging and location services etc Location works properly on GrapheneOS, as do notifications. https://grapheneos.org/faq#notifications https://grapheneos.org/faq#notifications GrapheneOS has a sandboxed Play services compatibility layer for running Play services with zero special privileges: https://grapheneos.org/usage#sandboxed-play-services https://grapheneos.org/usage#sandboxed-play-services Despite being very new, it's already rapidly moving beyond what microG supports. It doesn't require making the security sacrifices of microG by losing the standard security checks and key pinning. It also doesn't make privacy sacrifices: it provides Play with zero additional access. Apps using Play include the Play client libraries. Many of these fully work without Play services installed, including Google's Ads library. That only has a hard dependency on Play services if apps use the Lite variant: https://developers.google.com/admob/android/lite-sdk https://developers.google.com/admob/android/lite-sdk. The claims about microG privacy/security benefits are not just overstated but backwards. It also only implements a tiny subset of the API. Sandboxed Play services compatibility layer is another much more broadly application project funded by us, among others. > GrapheneOS has also pioneered a lot of security measures, a lot of which have been added to Android proper (if you see their feature log, a lot of it says "removed because it was introduced in Android"). We're also implemented a lot of substantial privacy measures. There aren't really distinctions between these things. GrapheneOS helped get substantial app sandbox restrictions into AOSP restricting the information available to apps.

tearfang 5y ago

//GrapheneOS is security over privacy// Is this just in philosophy or are there actual concrete privacy features/things I can't do with Graphene?