4 ms·

All of the defensiveness is warranted. They speak neutrally and objectively. The project is not going to relinquish control to any 3rd party. Not even the Moto

All of the defensiveness is warranted. They speak neutrally and objectively. The project is not going to relinquish control to any 3rd party. Not even the Motorola partnership is given control over the GOS project. The hypothetical you describe is not possible by design. The GOS project takes no issue with critical thinking, and encourages it. But that is often used as an excuse to handwave attacks. There is a very big difference between criticism/critical thinking and attacking them. Note that there are more individuals in the project than Micay. Multiple people handle multiple responsibilities, its not one person.

ryandrake 6mo ago
> The GOS project takes no issue with critical thinking, and encourages it. But that is often used as an excuse to handwave attacks. There is a very big difference between criticism/critical thinking and attacking them. Responding to attacks so defensively is almost alway a bad look for organizations. They could really use a PR person with a more measured voice that corrects facts and projects confidence, and does not convey victimhood, insecurity or defensiveness. Take a look at the tone of press releases issued by companies when some tech press bozo writes a hit piece on them, for good examples of dealing with people attacking you.
- HybridStatAnim8 6mo ago
  I would not use those words to describe the approach they take. They make the effort to speak neutrally and objectively, but the issues they are making light of are often exactly as extreme and common as they describe. Many people have voiced appreciation that they decide against a "corporate-speak" approach. The GrapheneOS accounts are meant to be accounts that let project members speak to users, rather than take on a corporate appearance.
neilv 6mo ago
I'm sure you realize that confident assurances of a random new pseudonymous account on a Web site isn't sufficient for anything of importance. Is there an authoritative source of information about how a takeover like that isn't possible by design, which people can verify, analyze, hold parties accountable for the pieces that require it, etc.?
- HybridStatAnim8 6mo ago
  I am a GrapheneOS user and community member, and I am active in the chat rooms. I made this account to assist with misinformation. As for how such a thing would not be possible; -GrapheneOS updates do not trust the network, so any compromise of update servers for OS and app updates would not be able to push malicious updates. Only those who hold the signing keys are capable of pushing updates that will be accepted. -Multiple people review the code that gets included in the OS. There is not one point of failure when it comes to social engineering. -GOS supports reproducible builds, so the code that is published can be verified to be the code that is built for the official builds. So in other words, you would need to convince multiple people who are consciously protecting against this, and who have a proven track record of burning the keys if the privacy and security of their users are in jeopardy. On top of that, you need to conceal this from every developer, moderator, and community member who would raise the alarm at the slightest indication of compromise.
ForHackernews 6mo ago
[flagged]
- aphorism 6mo ago
  Calyx Institute and GrapheneOS are both really great projects. I support them both. I rely on products from both. You're not doing either project any favors by pretending that hastily generalizing nerd dramas and autism over-corrections is somehow a broad statement on the neutrality and objectivity of GrapheneOS's team or the high-quality product it produces. This kind of bad faith posting is bad for the whole FOSS/libre community, and it's both dumb and rude, in contradiction of HN's site guidelines.
  - ForHackernews 6mo ago
    [flagged]
    - aphorism 6mo ago
      Not a sock, just finally annoyed enough to actually login and say something. I can see you can't engage about this without hurling wild accusations, so peace out.
    - spring-onion 6mo ago
      The author of that blog got mad we didn't want to implement a feature they wished for. Their duplicate issue was closed and later deleted and they made a public drama out of it for... what reason? Let me tell you something. I personally reached out to them just a few weeks ago. I didn't argue, I didn't blame them. That was not my intention and I communicated that clearly. Those were not empty words, I went into it with a genuine open mind and with the goal of finding a solution. After all they consider themselves an open source enthusiast. It didn't go anywhere. They did not seem willing to discuss anything at all really. You see, even if we assume they are 100% in the right, i.e. they did nothing wrong, why would they oppose our attempt at resolving the conflict? I've come to the conclusion there is no good faith argument to be made here. They spread their post all over the internet, heck they even linked it on Facebook.

ryandrake 6mo ago

> The GOS project takes no issue with critical thinking, and encourages it. But that is often used as an excuse to handwave attacks. There is a very big difference between criticism/critical thinking and attacking them. Responding to attacks so defensively is almost alway a bad look for organizations. They could really use a PR person with a more measured voice that corrects facts and projects confidence, and does not convey victimhood, insecurity or defensiveness. Take a look at the tone of press releases issued by companies when some tech press bozo writes a hit piece on them, for good examples of dealing with people attacking you.

HybridStatAnim8 6mo ago
I would not use those words to describe the approach they take. They make the effort to speak neutrally and objectively, but the issues they are making light of are often exactly as extreme and common as they describe. Many people have voiced appreciation that they decide against a "corporate-speak" approach. The GrapheneOS accounts are meant to be accounts that let project members speak to users, rather than take on a corporate appearance.

neilv 6mo ago

I'm sure you realize that confident assurances of a random new pseudonymous account on a Web site isn't sufficient for anything of importance. Is there an authoritative source of information about how a takeover like that isn't possible by design, which people can verify, analyze, hold parties accountable for the pieces that require it, etc.?

HybridStatAnim8 6mo ago
I am a GrapheneOS user and community member, and I am active in the chat rooms. I made this account to assist with misinformation. As for how such a thing would not be possible; -GrapheneOS updates do not trust the network, so any compromise of update servers for OS and app updates would not be able to push malicious updates. Only those who hold the signing keys are capable of pushing updates that will be accepted. -Multiple people review the code that gets included in the OS. There is not one point of failure when it comes to social engineering. -GOS supports reproducible builds, so the code that is published can be verified to be the code that is built for the official builds. So in other words, you would need to convince multiple people who are consciously protecting against this, and who have a proven track record of burning the keys if the privacy and security of their users are in jeopardy. On top of that, you need to conceal this from every developer, moderator, and community member who would raise the alarm at the slightest indication of compromise.

ForHackernews 6mo ago

[flagged]

aphorism 6mo ago
Calyx Institute and GrapheneOS are both really great projects. I support them both. I rely on products from both. You're not doing either project any favors by pretending that hastily generalizing nerd dramas and autism over-corrections is somehow a broad statement on the neutrality and objectivity of GrapheneOS's team or the high-quality product it produces. This kind of bad faith posting is bad for the whole FOSS/libre community, and it's both dumb and rude, in contradiction of HN's site guidelines.
- ForHackernews 6mo ago
  [flagged]
  - aphorism 6mo ago
    Not a sock, just finally annoyed enough to actually login and say something. I can see you can't engage about this without hurling wild accusations, so peace out.
  - spring-onion 6mo ago
    The author of that blog got mad we didn't want to implement a feature they wished for. Their duplicate issue was closed and later deleted and they made a public drama out of it for... what reason? Let me tell you something. I personally reached out to them just a few weeks ago. I didn't argue, I didn't blame them. That was not my intention and I communicated that clearly. Those were not empty words, I went into it with a genuine open mind and with the goal of finding a solution. After all they consider themselves an open source enthusiast. It didn't go anywhere. They did not seem willing to discuss anything at all really. You see, even if we assume they are 100% in the right, i.e. they did nothing wrong, why would they oppose our attempt at resolving the conflict? I've come to the conclusion there is no good faith argument to be made here. They spread their post all over the internet, heck they even linked it on Facebook.