5 ms·

Pixel stopped providing device trees, kernel history, Samsung has been doing this for a while now. Which are the devices/vendors that still allow / encourage

Pixel stopped providing device trees, kernel history, Samsung has been doing this for a while now. Which are the devices/vendors that still allow / encourage this? Even Graphene OS reported that they're in talks with some vendor... Have there been any updates towards that? The main reason i used to root devices are: * Get longer support/OS updates than what the vendor provided * System level adblock using adaway * Titanium backup These days firefox/brave browser gets me half way through adblocking and i lost interest in the ad filled apps.. Syncing gets me good level of syncing for backup on my NAS etc .

pentamassiv 1y ago
Fairphone does! https://www.fairphone.com/en/bootloader-unlocking-code-for-fairphone/ https://www.fairphone.com/en/bootloader-unlocking-code-for-f...
- lordofgibbons 1y ago
  Do anyone know why GrapheneOS doesn't support fairphone?
  - aeonik 1y ago
    I can't find the link, but a couple days ago, they said in a thread here it was due to their lack of support of some important security features, and remarked that it didn't look like they were even interested in supporting them.
    - sellerie 1y ago
      You cant re-lock the bootloader with a custom key which grapheneos considers a cornerstone of their security model.
      - gruez 1y ago
        Yeah, otherwise the bad guys can just wait till you're not looking at your phone, reflash your it with a backdoored version, and wait for you to unlock it (evil maid attack).
        BobaFloutist 1y ago
        >the bad guys can just wait till you're not looking at your phone, reflash your it with a backdoored version I hate it when the bad guys do this to my phone
        Arch-TK 1y ago
        The bad guys e.g. the police detaining you during a protest and temporarily seizing your property, or the border police "scanning" your phone.
        codedokode 1y ago
        If your phone was in hands of police you better sell it anyway because they could install a physical GPS tracker, etc. So locked bootloader doesn't change much. Also if you live in a truly democratic country you don't even need to set the PIN code - your rights are protected by the law.
        ThePowerOfFuet 1y ago
        >a physical GPS tracker Every mobile phone already is one.
        Arch-TK 1y ago
        It would be relatively difficult to add a physical GPS tracker to a modern phone. Also, it's unnecessary, the government just needs to take a note of the IMSI and/or IMEI and then use the cell tower records to track you (rather accurately I should add). The problem is not the tracking inherent in the design of mobile telephony networks, which you can circumvent by using burner phones. The problem is for example abuse of tools such as cellebrite to gain warrantless access to your phone at various opportunities. This is also why proper baseband isolation is important. Baseband firmware is unaudited and likely to have government backdoors. If the government wants to surveil me, they'll have to put in some actual effort instead of just taking opportunities.
    - plqbfbv 1y ago
      https://www.androidauthority.com/fairphone-gen-6-us-grapheneos-criticism-3578792/ https://www.androidauthority.com/fairphone-gen-6-us-graphene...
  - erremerre 1y ago
    The curious thing is that being GrapheneOS open source, I would think that somebody could potentially create a ROM for them, even if it is not as secure as GrapheneOS would like. However, absolutely nobody has done it yet...
    - NoGravitas 1y ago
      AXP.OS (axpos.org) is LineageOS-based (formerly DivestOS-based), but includes security backports from GrapheneOS and CalyxOS. No doubt it is less secure than GrapheneOS, but surely more secure than LineageOS, and supports bootloader relocking on some devices.
      - strcat 1y ago
        It's not a security upgrade over current AOSP overall and is definitely not a port of GrapheneOS to other devices. Someone could make a partial port of GrapheneOS to other devices but this is not that. > but includes security backports from GrapheneOS and CalyxOS It has a small portion of the GrapheneOS features, similar to DivestOS before it. However, it's not preserving or restoring the standard security reduced by LineageOS as much as DivestOS did. DivestOS was not a strict upgrade over AOSP either. CalyxOS isn't a hardened OS in the same space as GrapheneOS. It doesn't have similar exploit protections or privacy features. That's a misconception about it. They also haven't provided the June 2025 patches yet. https://eylenburg.github.io/android_comparison.htm https://eylenburg.github.io/android_comparison.htm > but surely more secure than LineageOS This doesn't imply it's as secure as AOSP though despite having additional security features. Starting from LineageOS as the baseline and adding more problematic changes makes it much messier than it just being AOSP with added security features. Android 16 is required for full Android privacy/security patches and the current privacy/security improvements. Soon there will be Android 16 QPR1.
  - protimewaster 1y ago
    As someone else mentioned, GOS requires that the bootloader properly support relocking with a custom key. Additionally, GOS has a rule that any device supported must keep up with all security and quarterly patches in a timely manner, and none of the Fairphone devices do.
  - Tharre 1y ago
    No secure element, no memory tagging support, no proper cellular baseband isolation, no verified boot, taking months to ship security updates .. the list is long. From a security/privacy perspective the fairphone is on the worse side of options unfortunately.
    - IshKebab 1y ago
      > no memory tagging support That's not a security feature though... We established that. Fair enough on the other points.
      - Tharre 1y ago
        For people out of the loop, parent is referring to TikTag[0], a side-channel speculative execution attack breaking MTE in a probabilistic defense scenario, and the weird cope coming from some people that "MTE was only supposed to be a debugging feature anyway". However, you need some form of code execution beforehand already for this attack, and more importantly it doesn't affect any of the deterministic guarantees of MTE. And those are the main appeal to GrapheneOS in the first place, preventing things like use-after-free by tagging the memory such that it simply can't be accessed anymore. So it's very much a security feature. [0] https://news.ycombinator.com/item?id=40715018 https://news.ycombinator.com/item?id=40715018
        IshKebab 1y ago
        > MTE was only supposed to be a debugging feature anyway It literally was. MTE is a padlock with 16 combinations.
        Tharre 1y ago
        The number of combinations is irrelevant if you're not relying on randomness. Graphene sets the tag to a static value on deallocation[0] to prevent use-after-free, you don't even need to guess! The same is true for a lot of buffer overflows, as their allocator ensures two adjacent allocations have different tags, so unless the vuln allows you to skip ahead you'll always trigger a fault. [0] https://github.com/GrapheneOS/hardened_malloc/blob/7481c8857faf5c6ed8666548d9e92837693de91b/h_malloc.c#L827 https://github.com/GrapheneOS/hardened_malloc/blob/7481c8857...
  - NoboruWataya 1y ago
    As others have said they have some security concerns (I don't know enough about that stuff to know how justified or surmountable those concerns are). However with the big manufacturers all locking down their devices more than ever I wonder will they have much of a choice in the end. We're going to need a manufacturer (or preferably several) to actively stand behind the possibility to use custom ROMs, and at the moment Fairphone seem like the only one who might do that.
- microtonal 1y ago
  Unfortunately, it's hard to make Fairphone secure. No separate secure element (so much easier to do brute force PIN attacks) and always lags in monthly security bulletin patches and major OS releases (remember that the monthly patches typically only address high/critical vulnerabilities, for the rest you need OS updates, QPRs, etc.). Until Graphene works out the deal with the OEM that they are talking to, Pixel is pretty much the only secure phone that allows installing alternative firmware.
  - karambanoonoo 1y ago
    Does that mean Graphene plans to support phones from other manufacturers than Google?
    - snvzz 1y ago
      Fingers crossed that's what it means and that it succeeds. I'd likely buy that.
    - strcat 1y ago
      Yes, but they need to meet our official requirements: https://grapheneos.org/faq#future-devices https://grapheneos.org/faq#future-devices We're working with a major Android OEM and it's going well so far. It's still in an early phase where they've assigned a small amount of resources to it to determine everything which needs to be done and then make the case for a much larger investment of resources. We expect that to happen and for it to go well.
      - karambanoonoo 1y ago
        Amazing. I just wish there was a device with an IPS display supported (for PWM flicker sensitive folks).
gavinray 1y ago
You can use AdGuard to block in-app ads on Android as an FYI
- pnutjam 1y ago
  You mean w/ DNS? or an app?
  - saidinesh5 1y ago
    It sets up a VPN and routes your Android traffic through it. But because of battery optimizations etc.. it has been a little flaky for me
  - arend321 1y ago
    Besides the VPN route you can set a Private DNS Server eg: dns.adguard-dns.com
RealStickman_ 1y ago
Here's an updated list of relatively popular phone manufactures and their bootloader unlocking potential. https://github.com/melontini/bootloader-unlock-wall-of-shame?tab=readme-ov-file https://github.com/melontini/bootloader-unlock-wall-of-shame...
- sugarpimpdorsey 1y ago
  Was anyone else shocked to see Microsoft in the top tier of their list of unlock-friendly phone manufacturers?
  - DoctorOW 1y ago
    I mean for the Microsoft Android phones it kinda makes sense, since they're not exactly shipping Android by choice. They'd much rather you use the Windows Phones which this says ARE locked down.
    - eddythompson80 1y ago
      Wasn’t windows phone discontinued like 10 years ago?
      - OoooooooO 1y ago
        Yes.
      - DoctorOW 1y ago
        Apologies for being unclear, it's true Microsoft didn't have the option of Windows Phone for their Surface Duo devices, so they had no choice but to use Android. To clarify, when I phrase something as being an unwilling outcome it does not mean both were equally viable options and they picked the one they wanted, rather that Microsoft's hand was forced due to this development. I hope this helps.
        eddythompson80 1y ago
dbcooper 1y ago
You can use nextdns for DNS adblocking.
subscribed 1y ago
So, notice Graphene OS was able to port Android 16 on all the supported devices (from Pixel 6 up) basically within a week without device trees already, without the early (OEM) access to the release. It's a big inconvenience but not a showstopper for them. Pixels are still viable. The only blocker with pixels would be if they stopped allowing OEM unlocking or relocking (which is a must).
fsflover 1y ago
> Which are the devices/vendors that still allow / encourage this? GNU/Linux phones (Librem 5 and Pinephone).
Jotalea 1y ago
You can block ads without root by using Adguard DNS.
strcat 1y ago
> Even Graphene OS reported that they're in talks with some vendor... Have there been any updates towards that? The startup we were working with before went bankrupt. In June, we started working with a major Android OEM which has provided resources for identifying everything which will need to be done to meet our requirements and provide official GrapheneOS support. They believe they can meet all our official requirements without much trouble and they're going to determine how much resources they want to put into it soon. We don't yet know how many resources are going to go into it. > The main reason i used to root devices are Note using GrapheneOS does not involve rooting. > System level adblock using adaway You can use RethinkDNS for filtering combined with still using a WireGuard VPN or multiple chained WireGuard VPNs. Android has a perfectly good API for this. > Titanium backup GrapheneOS has a built-in encrypted backup system we plan to significantly improve upon. The basics are there already.

pentamassiv 1y ago

Fairphone does! https://www.fairphone.com/en/bootloader-unlocking-code-for-fairphone/ https://www.fairphone.com/en/bootloader-unlocking-code-for-f...

lordofgibbons 1y ago
Do anyone know why GrapheneOS doesn't support fairphone?
- aeonik 1y ago
  I can't find the link, but a couple days ago, they said in a thread here it was due to their lack of support of some important security features, and remarked that it didn't look like they were even interested in supporting them.
  - sellerie 1y ago
    You cant re-lock the bootloader with a custom key which grapheneos considers a cornerstone of their security model.
    - gruez 1y ago
      Yeah, otherwise the bad guys can just wait till you're not looking at your phone, reflash your it with a backdoored version, and wait for you to unlock it (evil maid attack).
      - BobaFloutist 1y ago
        >the bad guys can just wait till you're not looking at your phone, reflash your it with a backdoored version I hate it when the bad guys do this to my phone
        Arch-TK 1y ago
        The bad guys e.g. the police detaining you during a protest and temporarily seizing your property, or the border police "scanning" your phone.
        codedokode 1y ago
        If your phone was in hands of police you better sell it anyway because they could install a physical GPS tracker, etc. So locked bootloader doesn't change much. Also if you live in a truly democratic country you don't even need to set the PIN code - your rights are protected by the law.
        ThePowerOfFuet 1y ago
        >a physical GPS tracker Every mobile phone already is one.
        Arch-TK 1y ago
        It would be relatively difficult to add a physical GPS tracker to a modern phone. Also, it's unnecessary, the government just needs to take a note of the IMSI and/or IMEI and then use the cell tower records to track you (rather accurately I should add). The problem is not the tracking inherent in the design of mobile telephony networks, which you can circumvent by using burner phones. The problem is for example abuse of tools such as cellebrite to gain warrantless access to your phone at various opportunities. This is also why proper baseband isolation is important. Baseband firmware is unaudited and likely to have government backdoors. If the government wants to surveil me, they'll have to put in some actual effort instead of just taking opportunities.
  - plqbfbv 1y ago
    https://www.androidauthority.com/fairphone-gen-6-us-grapheneos-criticism-3578792/ https://www.androidauthority.com/fairphone-gen-6-us-graphene...
- erremerre 1y ago
  The curious thing is that being GrapheneOS open source, I would think that somebody could potentially create a ROM for them, even if it is not as secure as GrapheneOS would like. However, absolutely nobody has done it yet...
  - NoGravitas 1y ago
    AXP.OS (axpos.org) is LineageOS-based (formerly DivestOS-based), but includes security backports from GrapheneOS and CalyxOS. No doubt it is less secure than GrapheneOS, but surely more secure than LineageOS, and supports bootloader relocking on some devices.
    - strcat 1y ago
      It's not a security upgrade over current AOSP overall and is definitely not a port of GrapheneOS to other devices. Someone could make a partial port of GrapheneOS to other devices but this is not that. > but includes security backports from GrapheneOS and CalyxOS It has a small portion of the GrapheneOS features, similar to DivestOS before it. However, it's not preserving or restoring the standard security reduced by LineageOS as much as DivestOS did. DivestOS was not a strict upgrade over AOSP either. CalyxOS isn't a hardened OS in the same space as GrapheneOS. It doesn't have similar exploit protections or privacy features. That's a misconception about it. They also haven't provided the June 2025 patches yet. https://eylenburg.github.io/android_comparison.htm https://eylenburg.github.io/android_comparison.htm > but surely more secure than LineageOS This doesn't imply it's as secure as AOSP though despite having additional security features. Starting from LineageOS as the baseline and adding more problematic changes makes it much messier than it just being AOSP with added security features. Android 16 is required for full Android privacy/security patches and the current privacy/security improvements. Soon there will be Android 16 QPR1.
- protimewaster 1y ago
  As someone else mentioned, GOS requires that the bootloader properly support relocking with a custom key. Additionally, GOS has a rule that any device supported must keep up with all security and quarterly patches in a timely manner, and none of the Fairphone devices do.
- Tharre 1y ago
  No secure element, no memory tagging support, no proper cellular baseband isolation, no verified boot, taking months to ship security updates .. the list is long. From a security/privacy perspective the fairphone is on the worse side of options unfortunately.
  - IshKebab 1y ago
    > no memory tagging support That's not a security feature though... We established that. Fair enough on the other points.
    - Tharre 1y ago
      For people out of the loop, parent is referring to TikTag[0], a side-channel speculative execution attack breaking MTE in a probabilistic defense scenario, and the weird cope coming from some people that "MTE was only supposed to be a debugging feature anyway". However, you need some form of code execution beforehand already for this attack, and more importantly it doesn't affect any of the deterministic guarantees of MTE. And those are the main appeal to GrapheneOS in the first place, preventing things like use-after-free by tagging the memory such that it simply can't be accessed anymore. So it's very much a security feature. [0] https://news.ycombinator.com/item?id=40715018 https://news.ycombinator.com/item?id=40715018
      - IshKebab 1y ago
        > MTE was only supposed to be a debugging feature anyway It literally was. MTE is a padlock with 16 combinations.
        Tharre 1y ago
        The number of combinations is irrelevant if you're not relying on randomness. Graphene sets the tag to a static value on deallocation[0] to prevent use-after-free, you don't even need to guess! The same is true for a lot of buffer overflows, as their allocator ensures two adjacent allocations have different tags, so unless the vuln allows you to skip ahead you'll always trigger a fault. [0] https://github.com/GrapheneOS/hardened_malloc/blob/7481c8857faf5c6ed8666548d9e92837693de91b/h_malloc.c#L827 https://github.com/GrapheneOS/hardened_malloc/blob/7481c8857...
- NoboruWataya 1y ago
  As others have said they have some security concerns (I don't know enough about that stuff to know how justified or surmountable those concerns are). However with the big manufacturers all locking down their devices more than ever I wonder will they have much of a choice in the end. We're going to need a manufacturer (or preferably several) to actively stand behind the possibility to use custom ROMs, and at the moment Fairphone seem like the only one who might do that.
microtonal 1y ago
Unfortunately, it's hard to make Fairphone secure. No separate secure element (so much easier to do brute force PIN attacks) and always lags in monthly security bulletin patches and major OS releases (remember that the monthly patches typically only address high/critical vulnerabilities, for the rest you need OS updates, QPRs, etc.). Until Graphene works out the deal with the OEM that they are talking to, Pixel is pretty much the only secure phone that allows installing alternative firmware.
- karambanoonoo 1y ago
  Does that mean Graphene plans to support phones from other manufacturers than Google?
  - snvzz 1y ago
    Fingers crossed that's what it means and that it succeeds. I'd likely buy that.
  - strcat 1y ago
    Yes, but they need to meet our official requirements: https://grapheneos.org/faq#future-devices https://grapheneos.org/faq#future-devices We're working with a major Android OEM and it's going well so far. It's still in an early phase where they've assigned a small amount of resources to it to determine everything which needs to be done and then make the case for a much larger investment of resources. We expect that to happen and for it to go well.
    - karambanoonoo 1y ago
      Amazing. I just wish there was a device with an IPS display supported (for PWM flicker sensitive folks).

gavinray 1y ago

You can use AdGuard to block in-app ads on Android as an FYI

pnutjam 1y ago
You mean w/ DNS? or an app?
- saidinesh5 1y ago
  It sets up a VPN and routes your Android traffic through it. But because of battery optimizations etc.. it has been a little flaky for me
- arend321 1y ago
  Besides the VPN route you can set a Private DNS Server eg: dns.adguard-dns.com

RealStickman_ 1y ago

Here's an updated list of relatively popular phone manufactures and their bootloader unlocking potential. https://github.com/melontini/bootloader-unlock-wall-of-shame?tab=readme-ov-file https://github.com/melontini/bootloader-unlock-wall-of-shame...

sugarpimpdorsey 1y ago
Was anyone else shocked to see Microsoft in the top tier of their list of unlock-friendly phone manufacturers?
- DoctorOW 1y ago
  I mean for the Microsoft Android phones it kinda makes sense, since they're not exactly shipping Android by choice. They'd much rather you use the Windows Phones which this says ARE locked down.
  - eddythompson80 1y ago
    Wasn’t windows phone discontinued like 10 years ago?
    - OoooooooO 1y ago
      Yes.
    - DoctorOW 1y ago
      Apologies for being unclear, it's true Microsoft didn't have the option of Windows Phone for their Surface Duo devices, so they had no choice but to use Android. To clarify, when I phrase something as being an unwilling outcome it does not mean both were equally viable options and they picked the one they wanted, rather that Microsoft's hand was forced due to this development. I hope this helps.
      - eddythompson80 1y ago

dbcooper 1y ago

You can use nextdns for DNS adblocking.

subscribed 1y ago

So, notice Graphene OS was able to port Android 16 on all the supported devices (from Pixel 6 up) basically within a week without device trees already, without the early (OEM) access to the release. It's a big inconvenience but not a showstopper for them. Pixels are still viable. The only blocker with pixels would be if they stopped allowing OEM unlocking or relocking (which is a must).

fsflover 1y ago

> Which are the devices/vendors that still allow / encourage this? GNU/Linux phones (Librem 5 and Pinephone).

Jotalea 1y ago

You can block ads without root by using Adguard DNS.

strcat 1y ago

> Even Graphene OS reported that they're in talks with some vendor... Have there been any updates towards that? The startup we were working with before went bankrupt. In June, we started working with a major Android OEM which has provided resources for identifying everything which will need to be done to meet our requirements and provide official GrapheneOS support. They believe they can meet all our official requirements without much trouble and they're going to determine how much resources they want to put into it soon. We don't yet know how many resources are going to go into it. > The main reason i used to root devices are Note using GrapheneOS does not involve rooting. > System level adblock using adaway You can use RethinkDNS for filtering combined with still using a WireGuard VPN or multiple chained WireGuard VPNs. Android has a perfectly good API for this. > Titanium backup GrapheneOS has a built-in encrypted backup system we plan to significantly improve upon. The basics are there already.