4 ms·

Does anyone prefer CalyxOS over GrapheneOS or LineageOS?

Seirdy 5y ago
I'd pick Graphene over Calyx on privacy and security grounds, and Lineage over Calyx on device support or tweakability grounds. Graphene is honestly ahead on the security and privacy front. MicroG requires very strong privileges and weakens the comprehensive privsep you'd otherwise have; GrapheneOS offers sandboxed play services with the standard SELinux policies for unprivileged Android software. GrapheneOS also has hardened_malloc, which seems to have the best design for malloc hardening out of any alternatives I'm aware of. On the userspace side, Graphene uses several of its own apps. One is Vanadium for its webview and browser; it's a hardened fork of Chromium. Check the patchset; it's got a bunch of security improvements and cross-pollenates with Bromite. The most interesting feature they've been working on is per-site JIT toggles. The list goes on. Few other OSes come close. Now, if you want to tinker with your phone at the expense of security, Lineage is actually a great option. It has a big community of tweakers and ricers who root their phones and come up with some cool experiments. It also supports a wider variety of devices, including devices abandoned by their manufacturers. Don't expect security updates, though.
- colordrops 5y ago
  Isn't graphene a huge target for black hats and three letter agencies? I guess no more so than lineage.
  - lberrymage 5y ago
    There is no evidence to suggest this. GrapheneOS has multiple systemic privacy and security improvements over the stock OS (e.g. hardened_malloc, toggleable network permission, exec spawning), so it's a much harder target to develop a working exploit for when compared to devices running the stock OS.
- phh 5y ago
  > I'd pick Graphene over Calyx on privacy and security grounds, and Lineage over Calyx on device support or tweakability grounds. I'd pick Calyx over privacy grounds not Graphene. (I totally agree that Graphene beats anyone on security grounds by miles, and depending on your threat model, security could be related to your privacy) > MicroG requires very strong privileges and weakens the comprehensive privsep you'd otherwise have If we're speaking of FAKE_SIGNATURE.... No it doesn't? If implemented properly (I don't know how Calyx do it, but I know I do), only apps in firmware are allowed to use FAKE_SIGNATURE, and if you build your firmware with only microg that has FAKE_SIGNATURE, then only microg can fake signature. Also it can fake exactly one signature, which is Google's. It's probably possible to make that patch better, if some people gives us reasons it is a flaw. Really, please tell me in which threat model does using microg hinders security, maybe we can find a fix. So far, I've never heard any. > GrapheneOS offers sandboxed play services with the standard SELinux policies for unprivileged Android software. With regards to privacy, I take unprotected opensource software over Google trackware no matter the sandboxes you put under it. Windows has a better sandboxing model than Linux, yet I feel much better doing random apt installs, than downloading random Windows apps.
  - tholdem 5y ago
    How is Calyx more privacy respecting than GrapheneOS by default? Not sure about the defaults on Calyx, but AFAIK GrapheneOS has zero connections to Google. You choose to install sandboxed Play services only if you want to.
    - phh 5y ago
      By default, Calyx is privacy-preserving, because it doesn't connect automatically to WiFi. You choose to connect to WiFi only if you want to. Yes, I'm very exaggerating the comparison, but still. My point is that the comment I'm answering touts the sandboxed Google Play Services. You can't tout it *and* say it's privacy preserving, it's a XOR.
      - lberrymage 5y ago
        GrapheneOS doesn't automatically connect to Wi-Fi either unless you enable the option. It also has per-connection MAC randomization enabled by default so Wi-Fi is essentially anonymous when you use it anyway. > you can't tout it *and say it's privacy preserving. Why? Sandboxed Play Services has no special privileges on GrapheneOS and thus has the same level of access as any other app. How can it invade your privacy if you don't explicitly give it access to private information?
- joecool1029 5y ago
  >Don't expect security updates, though. For the binary blobs, but for the opensource components all supported builds are current on monthly android security patches. (well, in review for probably a few days on April: https://review.lineageos.org/q/topic:R_asb_2022-04 https://review.lineageos.org/q/topic:R_asb_2022-04 ) LineageOS maintainers also pull android servicing branch back to cm14.1 tree too if you wanted to try your hand at building on a previously supported device.
flexagoon 5y ago
It's definitely better than Lineage, since Lineage is the least private and secure out of all "degoogled" ROMs. However, it isn't as good as Graphene.
- strcat 5y ago
  CalyxOS recently went almost 4 months without shipping Chromium (including WebView) and Android security updates. CalyxOS is not "degoogled" and uses multiple Google services by default without an opt-out. Look at their documentation. It also has privileged Google service integration enabled by default. If using Google services is considered "degoogled", what does it mean? Not having Google Play as part of the OS? They do have a reimplementation of a small subset of it using Google's services and it's specially privileged.
  - flexagoon 5y ago
    Yes, I'm aware that Calyx isn't degoogled and neither is Lineage, that's why I wrote "degoogled" in quotation marks. And I also know about lack of security updates in Calyx, but it's still better than Lineage lol
h4waii 5y ago
I went through building LineageOS for my devices for years, then switched to Pixel + GrapheneOS and have been extremely happy with my decision. Unfortunately as you can see from these posts, there's a lot of in-fighting between developers and users, it's detrimental to everyone involved and drives away users, supporters, and other developers who would contribute but don't want to get involved in it. Regardless of all the garbage surrounding these projects, the technical work behind GrapheneOS speaks for itself and is how I ended up selecting it vs the other options.
- _emacsomancer_ 5y ago
  Graphene is indeed a lot less fiddly than dealing with microg etc. Much easier to use (and install - oh the headache that is dealing with firmware updates my Samsung tablet running Lineage).

I'd pick Graphene over Calyx on privacy and security grounds, and Lineage over Calyx on device support or tweakability grounds. Graphene is honestly ahead on the security and privacy front. MicroG requires very strong privileges and weakens the comprehensive privsep you'd otherwise have; GrapheneOS offers sandboxed play services with the standard SELinux policies for unprivileged Android software. GrapheneOS also has hardened_malloc, which seems to have the best design for malloc hardening out of any alternatives I'm aware of. On the userspace side, Graphene uses several of its own apps. One is Vanadium for its webview and browser; it's a hardened fork of Chromium. Check the patchset; it's got a bunch of security improvements and cross-pollenates with Bromite. The most interesting feature they've been working on is per-site JIT toggles. The list goes on. Few other OSes come close. Now, if you want to tinker with your phone at the expense of security, Lineage is actually a great option. It has a big community of tweakers and ricers who root their phones and come up with some cool experiments. It also supports a wider variety of devices, including devices abandoned by their manufacturers. Don't expect security updates, though.

colordrops 5y ago
Isn't graphene a huge target for black hats and three letter agencies? I guess no more so than lineage.
- lberrymage 5y ago
  There is no evidence to suggest this. GrapheneOS has multiple systemic privacy and security improvements over the stock OS (e.g. hardened_malloc, toggleable network permission, exec spawning), so it's a much harder target to develop a working exploit for when compared to devices running the stock OS.
phh 5y ago
> I'd pick Graphene over Calyx on privacy and security grounds, and Lineage over Calyx on device support or tweakability grounds. I'd pick Calyx over privacy grounds not Graphene. (I totally agree that Graphene beats anyone on security grounds by miles, and depending on your threat model, security could be related to your privacy) > MicroG requires very strong privileges and weakens the comprehensive privsep you'd otherwise have If we're speaking of FAKE_SIGNATURE.... No it doesn't? If implemented properly (I don't know how Calyx do it, but I know I do), only apps in firmware are allowed to use FAKE_SIGNATURE, and if you build your firmware with only microg that has FAKE_SIGNATURE, then only microg can fake signature. Also it can fake exactly one signature, which is Google's. It's probably possible to make that patch better, if some people gives us reasons it is a flaw. Really, please tell me in which threat model does using microg hinders security, maybe we can find a fix. So far, I've never heard any. > GrapheneOS offers sandboxed play services with the standard SELinux policies for unprivileged Android software. With regards to privacy, I take unprotected opensource software over Google trackware no matter the sandboxes you put under it. Windows has a better sandboxing model than Linux, yet I feel much better doing random apt installs, than downloading random Windows apps.
- tholdem 5y ago
  How is Calyx more privacy respecting than GrapheneOS by default? Not sure about the defaults on Calyx, but AFAIK GrapheneOS has zero connections to Google. You choose to install sandboxed Play services only if you want to.
  - phh 5y ago
    By default, Calyx is privacy-preserving, because it doesn't connect automatically to WiFi. You choose to connect to WiFi only if you want to. Yes, I'm very exaggerating the comparison, but still. My point is that the comment I'm answering touts the sandboxed Google Play Services. You can't tout it *and* say it's privacy preserving, it's a XOR.
    - lberrymage 5y ago
      GrapheneOS doesn't automatically connect to Wi-Fi either unless you enable the option. It also has per-connection MAC randomization enabled by default so Wi-Fi is essentially anonymous when you use it anyway. > you can't tout it *and say it's privacy preserving. Why? Sandboxed Play Services has no special privileges on GrapheneOS and thus has the same level of access as any other app. How can it invade your privacy if you don't explicitly give it access to private information?
joecool1029 5y ago
>Don't expect security updates, though. For the binary blobs, but for the opensource components all supported builds are current on monthly android security patches. (well, in review for probably a few days on April: https://review.lineageos.org/q/topic:R_asb_2022-04 https://review.lineageos.org/q/topic:R_asb_2022-04 ) LineageOS maintainers also pull android servicing branch back to cm14.1 tree too if you wanted to try your hand at building on a previously supported device.

flexagoon 5y ago

It's definitely better than Lineage, since Lineage is the least private and secure out of all "degoogled" ROMs. However, it isn't as good as Graphene.

strcat 5y ago
CalyxOS recently went almost 4 months without shipping Chromium (including WebView) and Android security updates. CalyxOS is not "degoogled" and uses multiple Google services by default without an opt-out. Look at their documentation. It also has privileged Google service integration enabled by default. If using Google services is considered "degoogled", what does it mean? Not having Google Play as part of the OS? They do have a reimplementation of a small subset of it using Google's services and it's specially privileged.
- flexagoon 5y ago
  Yes, I'm aware that Calyx isn't degoogled and neither is Lineage, that's why I wrote "degoogled" in quotation marks. And I also know about lack of security updates in Calyx, but it's still better than Lineage lol

h4waii 5y ago

I went through building LineageOS for my devices for years, then switched to Pixel + GrapheneOS and have been extremely happy with my decision. Unfortunately as you can see from these posts, there's a lot of in-fighting between developers and users, it's detrimental to everyone involved and drives away users, supporters, and other developers who would contribute but don't want to get involved in it. Regardless of all the garbage surrounding these projects, the technical work behind GrapheneOS speaks for itself and is how I ended up selecting it vs the other options.

_emacsomancer_ 5y ago
Graphene is indeed a lot less fiddly than dealing with microg etc. Much easier to use (and install - oh the headache that is dealing with firmware updates my Samsung tablet running Lineage).