10 ms·

> Yeah GrapheneOS is security over privacy No, GrapheneOS is heavily focused on both privacy and security. See https://grapheneos.org/features https://graphene

by strcat 5y ago

> Yeah GrapheneOS is security over privacy No, GrapheneOS is heavily focused on both privacy and security. See https://grapheneos.org/features https://grapheneos.org/features for a list of the enhancements compared to the latest Android Open Source Project. GrapheneOS offers substantial privacy advantages over CalyxOS. It has a bunch of nice privacy improvements, carefully designed to work against real adversaries. Bypasses of privacy features are taken very seriously and prioritized as security vulnerabilities. GrapheneOS also doesn't integrate proprietary apps/services into the OS. We'd never stick WhatsApp support in the Dialer or ship Google services integrated into the OS in a special way not available to other apps. Services should be on an equal playing ground. That's the real issue with Play services and with iOS too. GrapheneOS has full MAC randomization, DHCP anonymity and doesn't reuse IPv6 addresses across networks. GrapheneOS has the Network permission toggle for disallowing both direct and indirect network access. Calyx takes an approach that allows apps to bypass it via APIs gated by the INTERNET permission. It also has other bypasses. They present it as a firewall app with a fancy name, but it's just a UI for the AOSP firewall and it doesn't really work as they present it. https://gitlab.com/CalyxOS/calyxos/-/issues/454 https://gitlab.com/CalyxOS/calyxos/-/issues/454 acknowledges the issue but presents an unworkable plan to address it. The approach doesn't work. Similarly, fine-grained filtering of domains/addresses in most firewalls even as a whitelist doesn't work due to DNS acting as 2-way communication via a permitted IP to arbitrary third parties. These indirect forms of access can't simply be ignored. GrapheneOS has the Sensors toggle to disallow apps from accessing the miscellaneous sensors usable for coarse movement (which can map to location) and audio recording among other things. It has substantially privacy improvements beyond these things, but they're some nice examples. I strongly recommend looking through https://grapheneos.org/features https://grapheneos.org/features and keep in mind it does not list AOSP features as most projects would. Avoiding bundling third party apps and services is explicitly listed as a feature rather than listing out integrating proprietary services and assorted apps. GrapheneOS is also focused on usability, and it's hard to deny that https://grapheneos.org/install/web https://grapheneos.org/install/web is a very nice way of performing the install. The fastboot.js library powering it is a project we funded. > and has a bit more mainstream appeal with MicroG, supporting push messaging and location services etc Location works properly on GrapheneOS, as do notifications. https://grapheneos.org/faq#notifications https://grapheneos.org/faq#notifications GrapheneOS has a sandboxed Play services compatibility layer for running Play services with zero special privileges: https://grapheneos.org/usage#sandboxed-play-services https://grapheneos.org/usage#sandboxed-play-services Despite being very new, it's already rapidly moving beyond what microG supports. It doesn't require making the security sacrifices of microG by losing the standard security checks and key pinning. It also doesn't make privacy sacrifices: it provides Play with zero additional access. Apps using Play include the Play client libraries. Many of these fully work without Play services installed, including Google's Ads library. That only has a hard dependency on Play services if apps use the Lite variant: https://developers.google.com/admob/android/lite-sdk https://developers.google.com/admob/android/lite-sdk. The claims about microG privacy/security benefits are not just overstated but backwards. It also only implements a tiny subset of the API. Sandboxed Play services compatibility layer is another much more broadly application project funded by us, among others. > GrapheneOS has also pioneered a lot of security measures, a lot of which have been added to Android proper (if you see their feature log, a lot of it says "removed because it was introduced in Android"). We're also implemented a lot of substantial privacy measures. There aren't really distinctions between these things. GrapheneOS helped get substantial app sandbox restrictions into AOSP restricting the information available to apps.

deleted 5y ago
[deleted]
emptysongglass 5y ago
Can you please stop attacking another Android distro under the umbrella of a project (the Calyx Institute) that has done a lot of good for others? It makes you look like an a**hole. There's plenty of room in this space for multiple visions of what a more-secure, more-private Android OS looks like. There's gradations of privacy and security and some users might prefer your gradient, whereas others might prefer CalyxOS'. You might try getting your act together and reach across the aisle so the world can benefit rather than this frankly stupid and childish infighting. And to pre-empt your honestly terrible, "but they started it", I don't see anyone from Calyx giving the mouth you're giving them, repeatedly, in this thread about their product. So please just stop.
- atatatat 5y ago
  Your comment leaves out the danger of advertising security and privacy when you cripple those things. All open source projects should be able to take GP's criticism, dev of "competitor" or otherwise — specifically because they're not products — they're public projects. Both projects should absolutely be encouraged — and steered, if a user knows a better way.
  - emptysongglass 5y ago
    > Your comment leaves out the danger of advertising security and privacy when you cripple those things. Nobody is doing this. Calyx is taking a measured approach, as they see it, and is making commensurate claims: "CalyxOS is an Android mobile operating system that puts privacy and security into the hands of everyday users." Right on their website. I am vehemently against absolutisms on security. Where that road goes is straight into a dick measuring contest and it's ugly. You only have to look at Moxie's terrible public behavior to see what the fallout from that approach looks like. It's a poison in the security industry and it needs to be called out and stopped now. It rewards grown adults for acting like children. It's enough now.

by strcat 5y ago

deleted 5y ago

[deleted]

emptysongglass 5y ago

Can you please stop attacking another Android distro under the umbrella of a project (the Calyx Institute) that has done a lot of good for others? It makes you look like an a**hole. There's plenty of room in this space for multiple visions of what a more-secure, more-private Android OS looks like. There's gradations of privacy and security and some users might prefer your gradient, whereas others might prefer CalyxOS'. You might try getting your act together and reach across the aisle so the world can benefit rather than this frankly stupid and childish infighting. And to pre-empt your honestly terrible, "but they started it", I don't see anyone from Calyx giving the mouth you're giving them, repeatedly, in this thread about their product. So please just stop.

atatatat 5y ago
Your comment leaves out the danger of advertising security and privacy when you cripple those things. All open source projects should be able to take GP's criticism, dev of "competitor" or otherwise — specifically because they're not products — they're public projects. Both projects should absolutely be encouraged — and steered, if a user knows a better way.
- emptysongglass 5y ago
  > Your comment leaves out the danger of advertising security and privacy when you cripple those things. Nobody is doing this. Calyx is taking a measured approach, as they see it, and is making commensurate claims: "CalyxOS is an Android mobile operating system that puts privacy and security into the hands of everyday users." Right on their website. I am vehemently against absolutisms on security. Where that road goes is straight into a dick measuring contest and it's ugly. You only have to look at Moxie's terrible public behavior to see what the fallout from that approach looks like. It's a poison in the security industry and it needs to be called out and stopped now. It rewards grown adults for acting like children. It's enough now.