5 ms·

One thing that bothers me is the seeming lack of transparency about who is running GrapheneOS. Daniel Micay supposedly stepped down, so who is calling the shots

One thing that bothers me is the seeming lack of transparency about who is running GrapheneOS. Daniel Micay supposedly stepped down, so who is calling the shots now? Who runs the CI? Who owns the update servers and signing keys? Who am I trusting?

flexagoon 7mo ago
Daniel Micay is still running the project despite announcing he'd step down a while ago. You can see the entire team on their Github
- worldsavior 7mo ago
  For what I understood is that he's just stepped down as lead developer.
  - strcat 7mo ago
    You're correct. Dmytro Mukhomor is the lead developer of GrapheneOS.
- strcat 7mo ago
  The directors of the the GrapheneOS Foundation and the other things you're talking about are public information. I stepped down as lead developer due to relentless harassment preventing me from being productive. The same people targeting me with harassment misrepresented what was happening. You shouldn't get info about GrapheneOS from Hacker News comments especially when multiple regulars here are part of the attacks on GrapheneOS. Hacker News permits people to freely engage in libel and harassment towards me on nearly every post about GrapheneOS.
  - flexagoon 7mo ago
    I'm aware of what happened, and I'm getting GOS news directly, not from HN. However, you're still the biggest contributor of code to GOS (judging by commit history). That's what I meant.
    - gib444 7mo ago
      > and I'm getting GOS news directly, not from HN And from a director themselves! strcat is one of the directors in case you didn't know (Daniel). Which makes his reply quite bizarre
      - DaSHacka 7mo ago
        [flagged]
        joemazerino 7mo ago
        [flagged]
        DaSHacka 7mo ago
        It's a little ironic Daniel rails on and on about how he's being targeted in a mass-harassment conspiracy against him and the project (usually by "the CalyxOS community", or his old CopperheadOS business partner guy), then.... freely levies a group of his own to mass-flag/downvote critics with the intent to silence them? "Every accusation is a confession" or something, I guess.
        strcat 7mo ago
        The ongoing lies, bullying and harassment towards me is very real and you're directly participating in it. The reality which can be found through looking through actual content which hasn't been doctored is that joemazerino has engaged in years of lies and bullying towards me on Hacker News without moderators stepping up to end it. Ending this bullying showing up in every thread about GrapheneOS from the same small group of perpetrators is long overdue.
        DaSHacka 7mo ago
        So any criticism is "bullying" and you're justified in brigading threads to silence it? Many of the people with minor criticisms even use the project (such as myself), and going full nuclear to silence any dissidents is rarely looked favorably upon in hindsight.
  - gib444 7mo ago
    That is a pretty poor and disappointing reply to be honest. They asked a reasonable question and you barely even responded to anything they asked. The community deserves a response to the question. What with this new chapter, it might be better for someone else to handle PR and comms for the project (Signed, passionate GrapheneOS user of a few years)
    - deleted 7mo ago
      [deleted]
    - strcat 7mo ago
      > The community deserves a response to the question. You use GrapheneOS which we provide to you free of any cost but yet you're being nasty towards us throughout this thread. Why do you think you deserve anything from us? Why should we participate on this platform at all when we have name calling, bullying and links to harassment content directed towards us with nothing being done about it? https://news.ycombinator.com/item?id=47219293 https://news.ycombinator.com/item?id=47219293
      - gib444 7mo ago
        "nasty", "bulling", "harassment" ? Whatever. You seem to have a persecution complex. Ironically, baseless accusations of nastiness and harassment and weaponising language is also bullying. I'm out. Best of luck to the project, and to you personally.
      - renny56 7mo ago
        your ass is delusional my fella
codethief 7mo ago
+1 This complete lack of transparency is the same gripe I have with the Signal Foundation. FWIW, https://ised-isde.canada.ca/cc/lgcy/fdrlCrpDtls.html?p=0&corpId=14857577 https://ised-isde.canada.ca/cc/lgcy/fdrlCrpDtls.html?p=0&cor... lists three directors for the GrapheneOS Foundation: Khalykbek Yelshibekov, Daniel Micay, and Dmytro Mukhomor.
- ta9000 7mo ago
  How so wrt Signal?
  - codethief 7mo ago
    What are donations being spent on, who makes those decisions, what's the roadmap, what's up with MobileCoin, why the hell do they put so much trust into Intel SGX when there are so many known vulnerabilities, … I've been a Signal/TextSecure user since day one and have convinced many dozens of people to switch to Signal but, man, they don't exactly make it easy to be a fan.
    - mmooss 7mo ago
      Isn't their CEO well known?
      - codethief 7mo ago
        So?
        mmooss 7mo ago
        You said you don't know who makes the decisions.
        codethief 7mo ago
        Meredith Whittaker is not a techie AFAIK. Either way, I'd just like to know more about the thought process going into Signal's product and engineering decisions. The Signal team seems extraordinarily tight-lipped and that doesn't exactly inspire trust from where I stand.
aniviacat 7mo ago
What I find particularity odd is that on their donation page [1], Daniel Micay's personal Github account is linked as a donation option (using Github sponsors). (I opted to donate via bank transfer instead, because that is at least addressed at the GrapheneOS Foundation, not one specific member.) [1] https://grapheneos.org/donate https://grapheneos.org/donate
strcat 7mo ago
The directors of the the GrapheneOS Foundation and the other things you're talking about are public information. I stepped down as lead developer due to relentless harassment preventing me from being productive. The same people targeting me with harassment misrepresented what was happening. You shouldn't get info about GrapheneOS from Hacker News comments especially when multiple regulars here are part of the attacks on GrapheneOS. Hacker News permits people to freely engage in libel and harassment towards me on nearly every post about GrapheneOS.
- joemazerino 7mo ago
  [flagged]
  - ta9000 7mo ago
    Seems like you’re proving his point. From what I can tell he founded the project and was bullied into leaving on social media. Happy to update my view if there’s additional information.
    - joemazerino 7mo ago
      [flagged]
    - DaSHacka 7mo ago
      [flagged]
      - nickburns 7mo ago
        No, by all means. Add a couple more paragraphs. Your rant seethes with credibility.
        unselect5917 7mo ago
        I actually don't regret going in and turning "show dead" on so I could see it. Knowing that someone is considered a lolcow is legitimately useful information. It might no be polite, you might not like it, but it is useful data to people who prefer their truths entirely unfettered by nosy busybodies who call themselves "moderators".
Avamander 7mo ago
They also have an overly reactive social media presence, somewhat similar to what ffmpeg has. Could end up being bad PR for Motorola. Funnily enough that same social media person has some odd ideas about trust and PKIs.
- ysnp 7mo ago
  >some odd ideas about trust and PKIs. Can you explain what you mean?
  - strcat 7mo ago
    Our project account posted a thread about our recent migration of our mail server to using our ASN and IP space. They replied to the thread by attacking Postfix, DNSSEC and DANE. They promoted the insecure MTA-STS approach promoted by Google despite them not fully adopting it for Gmail similarly to how they don't even use an enforcing DMARC policy despite punishing others for not doing it. We explained Domain Validation depends on DNS security. We also explained MTS-STS isn't the same as browser WebPKI due to an insecure bootstrapping and refreshing system along with lack of mandatory Certificate Transparency. We talked about Google's anti-competitive practices when it comes to email. Here's the thread, read it for yourself: https://x.com/Avamander/status/2025719336552284161 https://x.com/Avamander/status/2025719336552284161 The fact is that if you use the org TLD then you trust whoever runs it to issue certificates for your website and the same for your domain registrar. There's no point in pretending otherwise. It's very clearly how the system works. WebPKI does not truly add value over a TLSA record and DNSSEC beyond Certificate Transparency which is reactive and is NOT part of MTA-STS. MTA-STS also doesn't have mandatory encryption but rather opportunistic and can be stopped from using it. Gmail, the service which MTA-STS was created to be used with, has 1 day max-age for it. Gmail has a lot of quite blatant security weaknesses and phishing weaknesses. People largely repeat the mantra of it being secure because Google account login security is decent including an option to make it harder to hijack accounts via customer support missing elsewhere. Not really interested in a debate about it where someone repeats talking points often visible here and gets angry with us for not agreeing including getting angry because people like our replies. https://x.com/Avamander/status/2025719336552284161 https://x.com/Avamander/status/2025719336552284161
rkagerer 7mo ago
Without criticizing or implying any conspiracy theories, I did find it odd where the news release quoted "a spokesperson at GrapheneOS" without attributing it. We badly need alternative(s) like GrapheneOS, and I want to see it succeed. I hope as the project matures, the sense of professionalism and stability it projects will strengthen. For what it's worth, I personally feel the business partnership is a step toward that end, and am really happy to see some manufacturer diversity.
- strcat 7mo ago
  The statement was put together collaboratively by our COO, community manager and moderation team which is the case with a lot of our written responses to journalists and others. People with their real name tied to GrapheneOS are targeted with conspiracy theorizing and harassment. You can see it throughout this Hacker News thread. People personally target myself and other members of the team in very vile ways.

flexagoon 7mo ago

Daniel Micay is still running the project despite announcing he'd step down a while ago. You can see the entire team on their Github

worldsavior 7mo ago
For what I understood is that he's just stepped down as lead developer.
- strcat 7mo ago
  You're correct. Dmytro Mukhomor is the lead developer of GrapheneOS.
strcat 7mo ago
The directors of the the GrapheneOS Foundation and the other things you're talking about are public information. I stepped down as lead developer due to relentless harassment preventing me from being productive. The same people targeting me with harassment misrepresented what was happening. You shouldn't get info about GrapheneOS from Hacker News comments especially when multiple regulars here are part of the attacks on GrapheneOS. Hacker News permits people to freely engage in libel and harassment towards me on nearly every post about GrapheneOS.
- flexagoon 7mo ago
  I'm aware of what happened, and I'm getting GOS news directly, not from HN. However, you're still the biggest contributor of code to GOS (judging by commit history). That's what I meant.
  - gib444 7mo ago
    > and I'm getting GOS news directly, not from HN And from a director themselves! strcat is one of the directors in case you didn't know (Daniel). Which makes his reply quite bizarre
    - DaSHacka 7mo ago
      [flagged]
      - joemazerino 7mo ago
        [flagged]
        DaSHacka 7mo ago
        It's a little ironic Daniel rails on and on about how he's being targeted in a mass-harassment conspiracy against him and the project (usually by "the CalyxOS community", or his old CopperheadOS business partner guy), then.... freely levies a group of his own to mass-flag/downvote critics with the intent to silence them? "Every accusation is a confession" or something, I guess.
        strcat 7mo ago
        The ongoing lies, bullying and harassment towards me is very real and you're directly participating in it. The reality which can be found through looking through actual content which hasn't been doctored is that joemazerino has engaged in years of lies and bullying towards me on Hacker News without moderators stepping up to end it. Ending this bullying showing up in every thread about GrapheneOS from the same small group of perpetrators is long overdue.
        DaSHacka 7mo ago
        So any criticism is "bullying" and you're justified in brigading threads to silence it? Many of the people with minor criticisms even use the project (such as myself), and going full nuclear to silence any dissidents is rarely looked favorably upon in hindsight.
- gib444 7mo ago
  That is a pretty poor and disappointing reply to be honest. They asked a reasonable question and you barely even responded to anything they asked. The community deserves a response to the question. What with this new chapter, it might be better for someone else to handle PR and comms for the project (Signed, passionate GrapheneOS user of a few years)
  - deleted 7mo ago
    [deleted]
  - strcat 7mo ago
    > The community deserves a response to the question. You use GrapheneOS which we provide to you free of any cost but yet you're being nasty towards us throughout this thread. Why do you think you deserve anything from us? Why should we participate on this platform at all when we have name calling, bullying and links to harassment content directed towards us with nothing being done about it? https://news.ycombinator.com/item?id=47219293 https://news.ycombinator.com/item?id=47219293
    - gib444 7mo ago
      "nasty", "bulling", "harassment" ? Whatever. You seem to have a persecution complex. Ironically, baseless accusations of nastiness and harassment and weaponising language is also bullying. I'm out. Best of luck to the project, and to you personally.
    - renny56 7mo ago
      your ass is delusional my fella

codethief 7mo ago

+1 This complete lack of transparency is the same gripe I have with the Signal Foundation. FWIW, https://ised-isde.canada.ca/cc/lgcy/fdrlCrpDtls.html?p=0&corpId=14857577 https://ised-isde.canada.ca/cc/lgcy/fdrlCrpDtls.html?p=0&cor... lists three directors for the GrapheneOS Foundation: Khalykbek Yelshibekov, Daniel Micay, and Dmytro Mukhomor.

ta9000 7mo ago
How so wrt Signal?
- codethief 7mo ago
  What are donations being spent on, who makes those decisions, what's the roadmap, what's up with MobileCoin, why the hell do they put so much trust into Intel SGX when there are so many known vulnerabilities, … I've been a Signal/TextSecure user since day one and have convinced many dozens of people to switch to Signal but, man, they don't exactly make it easy to be a fan.
  - mmooss 7mo ago
    Isn't their CEO well known?
    - codethief 7mo ago
      So?
      - mmooss 7mo ago
        You said you don't know who makes the decisions.
        codethief 7mo ago
        Meredith Whittaker is not a techie AFAIK. Either way, I'd just like to know more about the thought process going into Signal's product and engineering decisions. The Signal team seems extraordinarily tight-lipped and that doesn't exactly inspire trust from where I stand.

aniviacat 7mo ago

What I find particularity odd is that on their donation page [1], Daniel Micay's personal Github account is linked as a donation option (using Github sponsors). (I opted to donate via bank transfer instead, because that is at least addressed at the GrapheneOS Foundation, not one specific member.) [1] https://grapheneos.org/donate https://grapheneos.org/donate

strcat 7mo ago

The directors of the the GrapheneOS Foundation and the other things you're talking about are public information. I stepped down as lead developer due to relentless harassment preventing me from being productive. The same people targeting me with harassment misrepresented what was happening. You shouldn't get info about GrapheneOS from Hacker News comments especially when multiple regulars here are part of the attacks on GrapheneOS. Hacker News permits people to freely engage in libel and harassment towards me on nearly every post about GrapheneOS.

joemazerino 7mo ago
[flagged]
- ta9000 7mo ago
  Seems like you’re proving his point. From what I can tell he founded the project and was bullied into leaving on social media. Happy to update my view if there’s additional information.
  - joemazerino 7mo ago
    [flagged]
  - DaSHacka 7mo ago
    [flagged]
    - nickburns 7mo ago
      No, by all means. Add a couple more paragraphs. Your rant seethes with credibility.
      - unselect5917 7mo ago
        I actually don't regret going in and turning "show dead" on so I could see it. Knowing that someone is considered a lolcow is legitimately useful information. It might no be polite, you might not like it, but it is useful data to people who prefer their truths entirely unfettered by nosy busybodies who call themselves "moderators".

Avamander 7mo ago

They also have an overly reactive social media presence, somewhat similar to what ffmpeg has. Could end up being bad PR for Motorola. Funnily enough that same social media person has some odd ideas about trust and PKIs.

ysnp 7mo ago
>some odd ideas about trust and PKIs. Can you explain what you mean?
- strcat 7mo ago
  Our project account posted a thread about our recent migration of our mail server to using our ASN and IP space. They replied to the thread by attacking Postfix, DNSSEC and DANE. They promoted the insecure MTA-STS approach promoted by Google despite them not fully adopting it for Gmail similarly to how they don't even use an enforcing DMARC policy despite punishing others for not doing it. We explained Domain Validation depends on DNS security. We also explained MTS-STS isn't the same as browser WebPKI due to an insecure bootstrapping and refreshing system along with lack of mandatory Certificate Transparency. We talked about Google's anti-competitive practices when it comes to email. Here's the thread, read it for yourself: https://x.com/Avamander/status/2025719336552284161 https://x.com/Avamander/status/2025719336552284161 The fact is that if you use the org TLD then you trust whoever runs it to issue certificates for your website and the same for your domain registrar. There's no point in pretending otherwise. It's very clearly how the system works. WebPKI does not truly add value over a TLSA record and DNSSEC beyond Certificate Transparency which is reactive and is NOT part of MTA-STS. MTA-STS also doesn't have mandatory encryption but rather opportunistic and can be stopped from using it. Gmail, the service which MTA-STS was created to be used with, has 1 day max-age for it. Gmail has a lot of quite blatant security weaknesses and phishing weaknesses. People largely repeat the mantra of it being secure because Google account login security is decent including an option to make it harder to hijack accounts via customer support missing elsewhere. Not really interested in a debate about it where someone repeats talking points often visible here and gets angry with us for not agreeing including getting angry because people like our replies. https://x.com/Avamander/status/2025719336552284161 https://x.com/Avamander/status/2025719336552284161

rkagerer 7mo ago

Without criticizing or implying any conspiracy theories, I did find it odd where the news release quoted "a spokesperson at GrapheneOS" without attributing it. We badly need alternative(s) like GrapheneOS, and I want to see it succeed. I hope as the project matures, the sense of professionalism and stability it projects will strengthen. For what it's worth, I personally feel the business partnership is a step toward that end, and am really happy to see some manufacturer diversity.

strcat 7mo ago
The statement was put together collaboratively by our COO, community manager and moderation team which is the case with a lot of our written responses to journalists and others. People with their real name tied to GrapheneOS are targeted with conspiracy theorizing and harassment. You can see it throughout this Hacker News thread. People personally target myself and other members of the team in very vile ways.