6 ms·
GrapheneOS accessed Android security patches but not allowed to publish sources
- mcflubbins 1y ago"They can easily get it from OEMs or even make an OEM."[0] I agree with their points in the thread, but could Graphene "become" an OEM to get access to the security patches sooner? Just curious. [0] https://grapheneos.social/@GrapheneOS/115164297480036952 https://grapheneos.social/@GrapheneOS/115164297480036952
- evgpbfhnr 1y agoThey have access to the patches. They just can't make an official release with it, because they can't publish the patch sources (embargoed) and their releases being open-source must match what they published...
- deleted 1y ago[deleted]
- qingcharles 1y agoThey have an OEM partner right now who funnels them the updates, which is how they get access to them.
- mcflubbins 1y agoWhat if that OEM stops giving them patches? Also, if they're asking an OEM to release the patches, why can't they become an OEM to do that?
- stebalien 1y agoThe bigger headline is that Google is effectively giving attackers 3-4 months of advanced access to security patches: https://grapheneos.social/@GrapheneOS/115164183840111564 https://grapheneos.social/@GrapheneOS/115164183840111564.
- goku12 1y agoHave you considered the possibility that this may not be motivated by security at all, given the recent spate of similarly illogical and somewhat hostile decisions?
- huflungdung 1y ago[dead]
- oneshtein 1y agoCIA wins!
- LinAGKar 1y agoSo basically to summarize, Google embargoes security patches for four months so OEMs can push out updates more slowly. And if those patches were immediately added to an open source project like GrapheneOS, attackers would gain info on the vulnerabilities before OEMs provide updates (the GrapheneOS project can see the patches, but they can't ship them). But a lot of patches end up being leaked anyway, so the delay ends up being pointless.
- lima 1y agoThe stupidest part is that, according to the thread, OEMs are allowed to provide binary only patches before the embargo ends, making the whole thing nonsensical since it's trivial to figure out the vulnerabilities from the binaries. Fun fact: Google actually owns the most commonly used tool, BinDiff ;)
- nroets 1y agoUnless the OEMs bundle numerous changes with the security patch(es). (I'm not saying it happens. I just theorise how the policy could have been envisaged)
- numpad0 1y agoIn the good old days, there were exploits patched years prior by some OEMs that were never upstreamed even to Google. New rooting apps come out and... just doesn't work. I don't know if that still happens, though.
- groggler 1y agoNot really.. numerous changes are still not a total redesign of whichever subsystem was affected so it's pretty obvious where some small security relevant changes are. A stupid embargo was always enough to ruin security by code analysis for white hats but never enough to stop attacks by code analysis for black hats.
- lima 1y ago
- 9cb14c1ec0 1y agoThis is ridiculous. Makes one wonder about the state of OEM development. It's not hard to build a CI pipeline for android. There is no good reason OEMs can't be running test builds of ROMs with security patches within hours, and have QA done in a day or two, or a week max.
- baby_souffle 1y ago> There is no good reason OEMs can't be running test builds of ROMs with security patches within hours That sounds like it costs money and doesn’t net the mfg new sales.
- all2 1y agoTrying to do software well at hardware centric companies is hard. Mostly for this reasoning.
- pixl97 1y ago>Makes one wonder about the state of OEM development. Why wonder at all, it sucks and it's security is generally in shambles. Security is rarely very high on their priorities as features/prettiness is what sells their phones.
- honeybadger1 1y agoi don't understand googles rationale here, what is the point in giving wind to the hackers sails while also driving home the narrative that android is a less secure system, especially after the recent changes related to the security of the latest iphone?
- Miaourt 1y agoYou mean the changes Pixels phones had since late 2021 ? /s https://grapheneos.social/@GrapheneOS/115176133102237994 https://grapheneos.social/@GrapheneOS/115176133102237994
- honeybadger1 1y agowe're talking about OEM devices aren't we?
- oneshtein 1y agoThey are giving a chance for government agencies to hack Graphene phones.
- stebalien 1y agoThe solution (heavily) alluded to by GrapheneOS in https://grapheneos.social/@GrapheneOS/115164212472627210 https://grapheneos.social/@GrapheneOS/115164212472627210 and https://grapheneos.social/@GrapheneOS/115165250870239451 https://grapheneos.social/@GrapheneOS/115165250870239451 is: 1. Release binary-only updates (opt-in). 2. Let the community (a) make GPL source requests for any GPLed components and (b) let the community reverse engineer the vulnerabilities from the binary updates. 3. Publish the source once everything is public anyways. Which just shows how utterly ridiculous all this is.
- g-b-r 1y agoIf the smart plan of having others reverse-engineer the fixes won't work, I imagine they'll turn into a delayed-source product. To my recollection, they always maintained that being open-source doesn't matter for security, after all
- g-b-r 1y ago(I strongly disagree)
- transpute 1y agoRelated discussion earlier this week, https://news.ycombinator.com/item?id=45158523 https://news.ycombinator.com/item?id=45158523
- Velocifyer 1y agoDon't trust these guys.
- ibeff 1y agoThat's not helpful without context and substance.
- dcow 1y agoThe only responsible disclosure is full disclosure.
- t1234s 1y agoI currently use LineageOS on my pixel. Is it worth trying GraphineOS?
- Freak_NL 1y agoOn a Pixel from 6 upwards? Absolutely. GrapheneOS is what Android should be in terms of privacy and security. Its major drawback is only being available on Pixels, but if that is what you have… I bought my Pixel 6 specifically to run GrapheneOS, and I really hope I can repeat that for my next device.
- skeaker 1y agoIt's a crying shame that there isn't a Graphene compatible phone that also has a micro SD slot and headphone jack. The perfect phone just doesn't exist in our timeline
- lawn 1y agoGrapheneOS is by far the better OS security and privacy wise. It should be the default choice for everyone IMO, as long as they have a phone that supports it. See this comparison: https://eylenburg.github.io/android_comparison.htm https://eylenburg.github.io/android_comparison.htm
- palata 1y agoMy rule is: if you can run GrapheneOS, you should run GrapheneOS. My second rule is: if you are buying a new phone and can afford one that supports GrapheneOS (at the moment it means a Pixel), then you should go for that.
- jcul 1y agoI haven't used LineageOS for a long time, but I remember it being really good. And I used cyanogenmod which IIRC was it's predecessor. GraapheneOS is a different ball game IMO, especially if you need to use Google play services etc, banking apps etc. I'm not sure what the current state of microg is or Google services on lineage. I bought a second hand pixel 6, just for Graphene and when that died I bought another pixel.
- mkesper 1y agoThe CRA should help here hopefully. See cyber resilience act Article 14 – Reporting obligations of manufacturers https://www.cyberresilienceact.eu/the-cyber-resilience-act/# https://www.cyberresilienceact.eu/the-cyber-resilience-act/#
- cyberkendra 1y ago[dead]
- palata 1y agoOne thing that seems positive is that it is now possible to release binary patches earlier than before, isn't it? My understanding is that before, OEMs had to wait for 1 month, and now they can release the binary patches right away. I see a lot of people saying how the whole thing is completely ridiculous, but this part seems like a win.
- llyou_m1233 1y agollyou_m1233
- ChocolateGod 1y ago> Android security patches are almost entirely quarterly instead of monthly to make it easier for OEMs. They're giving OEMs 3-4 months of early access which we know for a fact is being widely leaked including to attackers. Android is is over 15 years old and Google still hasn't fixed the update mess. Google should be in charge and ship security updates, not OEMs. You don't see Dell responsible for Windows security updates.
- pjmlp 1y agoYou see when using laptops, with their custom installations, and hence why not using OEM drivers might turn into lost weekends.
- dangus 1y agoI wish we had more choices beyond Android and iPhone. I think this thread makes it quite clear that Android is not a secure OS, period. Like, maybe it’s safer on a Pixel with Google’s own distribution, but even still, Graphene is claiming that Google’s team is stretched thin and isn’t fixing issues from 2024. Meanwhile, Apple is allegedly building the most secure devices you can connect to the Internet: https://techcrunch.com/2025/09/11/apples-latest-iphone-security-feature-just-made-life-more-difficult-for-spyware-makers/ https://techcrunch.com/2025/09/11/apples-latest-iphone-secur...
- pjmlp 1y agoI was happy on Symbian land, then on Windows Phone land, but alas that isn't how things turned out.
- zxv 1y ago> Companies like NSO can easily obtain access. It's not a safe system. If NSO group develops exploits, why would they have early access?