39 ms·

As much as I wish for an open and non evil mobile device, GrapheneOS just gave me a chuckle - “GrapheneOS only officially supports Pixel devices” what a world w

As much as I wish for an open and non evil mobile device, GrapheneOS just gave me a chuckle - “GrapheneOS only officially supports Pixel devices” what a world we live in. To get away from Google, the only devices you do with are made by Google. I have given up. Regardless of how much tinkering you do at the OS level - hardened kernel, firewalls, VPNs, jailed apps whatever, the moment you want to make good use of your device doing common things we have come to expect - maps with turn-by-turn navigation that doesn’t suck, ability to write messages to other people where they are, without asking them to install some app first so that we can talk, we are bound to make a deal with the same devil we are fighting - Google, Facebook and other ad tracking machines. There is no point in keeping a hardened OS with Google Maps and WhatsApp installed. I made my deal with the devil that is Apple that atleast publicly pretends to care about privacy(of course, I have no way to verify that they do).

jacooper 3y ago
You can't win everything, but GrapheneOS + Pixel is the closest thing we have to a phone you can trust. They only support pixels because Google follows their own standards and doesn't make up shit on the go, so they can lock the bootloader and sign the OS correctly. It's very usable and far better than an iPhone.
- reacharavindh 3y ago
  I'll admit, the last time I tried copperheadOS or cyanogenMod was like a decade ago, and I should not be prejudiced. I'll see if I can play with a pixel device and grapheneOS and give it a chance to change my mind. The other part of my argument still stands... Do you use WhatsApp, Instagram etc for communication with friends? What Google services do you use on your phone? Google Maps, Youtube? Is there a way to use GrapheneOS on a Pixel device without sacrificing modern life social needs too much? Update: I thought about my need from phone a little more. I drive a VW Golf. The default infotainment stuff in the car is useless. I use Google Maps via Apple CarPlay to get driving directions in my car. Is there any way to satisfy this need with GrapheneOS without downloading the Playstore (which I consider as Game over and a submission stand to Google) given all the permissions the Playstore needs from the OS.
  - jacooper 3y ago
    Everything you mentioned works on GrapheneOS, I wouldn't use it if it didnt, I am personally kind of on the limit of my inconvenience tolerance regarding such things. And don't worry, google services are treated as normal user level apps (1), and are sandboxed like any other user app, so you get perfect compatibility with better privacy and security than your average phone. Even Android Auto works now, issues only arise when dealing with safety net, googles hardware attestation (2). It mostly only affects bank apps, but in my experience most of them work without issues, however Gpay won't work at all no matter what. Personally the only worry I have with GrapheneOS is its crazy dev, he said he will step down (3), but he still does a lot (4). 1. https://grapheneos.org/usage#sandboxed-google-play https://grapheneos.org/usage#sandboxed-google-play 2. https://grapheneos.org/usage#banking-apps https://grapheneos.org/usage#banking-apps 3. https://news.ycombinator.com/item?id=36089104 https://news.ycombinator.com/item?id=36089104 4. Just check the commit logs in any of the grapheneOS repos. For example https://github.com/GrapheneOS/hardened_malloc https://github.com/GrapheneOS/hardened_malloc
    - reacharavindh 3y ago
      Hmm thanks for the detailed response. It does sound interesting if Google Maps and WhatsApp can be had in an Android OS, but trustable locked down such that they cannot read location, files(other than the ones explicitly allowed to), microphone etc. It sounds truly compromise free if it also works with Android Auto. I’ll ask a colleague who posted his Pixel 6a for sale to loan it for a few days and try it out.
      - jacooper 3y ago
        Make sure to use their official webUSB installer https://grapheneos.org/install/web https://grapheneos.org/install/web And that you install Google services through the "apps" app, to get a usable phone. If gps isn't as fast as you expect, you may have to enable Google location services, I had to do that otherwise it almost never works indoors due to lack of support for local wifi scanning.
  - TheCoelacanth 3y ago
- chopin 3y ago
  I use a Fairphone 4 with e/OS on it. I am quite happy with it.
  - jacooper 3y ago
    It's still not as compromise free as a pixel + GrapheneOS, and isn't as secure.
ravenstine 3y ago
I had the same skepticism, but I realized the rationale behind targeting Pixel phones makes a lot of sense. It makes development much easier for a small development team, Pixel is a high quality phone that also is one of the easiest to install custom ROMs on, and I think there's some sort of integrity checking hardware on Pixels not present on other Android phones. It would be great if some sort of libre Pixel clone could be made so that Google is not needed at that level, but that simply doesn't exist yet. Otherwise, all you're doing is trading the devil of Google for some other devil like Samsung. > There is no point in keeping a hardened OS with Google Maps and WhatsApp installed. Sandboxed Google Maps using sandboxed non-system Play Services or MicroG on an OS with hardened memory allocation is better than Google Maps on a stock ROM.
sillystuff 3y ago
Pixel phones let you re-lock the bootloader using your own signing keys. This is the feature that graphene requires pixel for. Also, the easiest phones to de-google are the google branded ones. I don't use graphene, but all my android phones have been google branded, so they could run a de-googled aosp build.

jacooper 3y ago

You can't win everything, but GrapheneOS + Pixel is the closest thing we have to a phone you can trust. They only support pixels because Google follows their own standards and doesn't make up shit on the go, so they can lock the bootloader and sign the OS correctly. It's very usable and far better than an iPhone.

reacharavindh 3y ago
I'll admit, the last time I tried copperheadOS or cyanogenMod was like a decade ago, and I should not be prejudiced. I'll see if I can play with a pixel device and grapheneOS and give it a chance to change my mind. The other part of my argument still stands... Do you use WhatsApp, Instagram etc for communication with friends? What Google services do you use on your phone? Google Maps, Youtube? Is there a way to use GrapheneOS on a Pixel device without sacrificing modern life social needs too much? Update: I thought about my need from phone a little more. I drive a VW Golf. The default infotainment stuff in the car is useless. I use Google Maps via Apple CarPlay to get driving directions in my car. Is there any way to satisfy this need with GrapheneOS without downloading the Playstore (which I consider as Game over and a submission stand to Google) given all the permissions the Playstore needs from the OS.
- jacooper 3y ago
  Everything you mentioned works on GrapheneOS, I wouldn't use it if it didnt, I am personally kind of on the limit of my inconvenience tolerance regarding such things. And don't worry, google services are treated as normal user level apps (1), and are sandboxed like any other user app, so you get perfect compatibility with better privacy and security than your average phone. Even Android Auto works now, issues only arise when dealing with safety net, googles hardware attestation (2). It mostly only affects bank apps, but in my experience most of them work without issues, however Gpay won't work at all no matter what. Personally the only worry I have with GrapheneOS is its crazy dev, he said he will step down (3), but he still does a lot (4). 1. https://grapheneos.org/usage#sandboxed-google-play https://grapheneos.org/usage#sandboxed-google-play 2. https://grapheneos.org/usage#banking-apps https://grapheneos.org/usage#banking-apps 3. https://news.ycombinator.com/item?id=36089104 https://news.ycombinator.com/item?id=36089104 4. Just check the commit logs in any of the grapheneOS repos. For example https://github.com/GrapheneOS/hardened_malloc https://github.com/GrapheneOS/hardened_malloc
  - reacharavindh 3y ago
    Hmm thanks for the detailed response. It does sound interesting if Google Maps and WhatsApp can be had in an Android OS, but trustable locked down such that they cannot read location, files(other than the ones explicitly allowed to), microphone etc. It sounds truly compromise free if it also works with Android Auto. I’ll ask a colleague who posted his Pixel 6a for sale to loan it for a few days and try it out.
    - jacooper 3y ago
      Make sure to use their official webUSB installer https://grapheneos.org/install/web https://grapheneos.org/install/web And that you install Google services through the "apps" app, to get a usable phone. If gps isn't as fast as you expect, you may have to enable Google location services, I had to do that otherwise it almost never works indoors due to lack of support for local wifi scanning.
- TheCoelacanth 3y ago
chopin 3y ago
I use a Fairphone 4 with e/OS on it. I am quite happy with it.
- jacooper 3y ago
  It's still not as compromise free as a pixel + GrapheneOS, and isn't as secure.

ravenstine 3y ago

I had the same skepticism, but I realized the rationale behind targeting Pixel phones makes a lot of sense. It makes development much easier for a small development team, Pixel is a high quality phone that also is one of the easiest to install custom ROMs on, and I think there's some sort of integrity checking hardware on Pixels not present on other Android phones. It would be great if some sort of libre Pixel clone could be made so that Google is not needed at that level, but that simply doesn't exist yet. Otherwise, all you're doing is trading the devil of Google for some other devil like Samsung. > There is no point in keeping a hardened OS with Google Maps and WhatsApp installed. Sandboxed Google Maps using sandboxed non-system Play Services or MicroG on an OS with hardened memory allocation is better than Google Maps on a stock ROM.

sillystuff 3y ago

Pixel phones let you re-lock the bootloader using your own signing keys. This is the feature that graphene requires pixel for. Also, the easiest phones to de-google are the google branded ones. I don't use graphene, but all my android phones have been google branded, so they could run a de-googled aosp build.