7 ms·

GrapheneOS has minimal, private [1] system apps so you don't have to debloat anything yourself. Manual debloating is not a good solution at the user level. Som

GrapheneOS has minimal, private [1] system apps so you don't have to debloat anything yourself. Manual debloating is not a good solution at the user level. Some system apps are being overhauled, so that's something to look forward to. Gallery will be [2] based on ReFra [3]. [1] Except phone and messaging but that's the cell network. GrapheneOS recommends Signal/Molly or SimpleX instead. [2] https://nitter.net/GrapheneOS/status/2083724696722301266#m https://nitter.net/GrapheneOS/status/2083724696722301266#m [3] https://github.com/IacobIonut01/ReFra https://github.com/IacobIonut01/ReFra

mrbn100ful 2mo ago
What does GrapheneOS have to do with this? This is very useful on OEM ROMs with a bunch of scrapware, no one expects a custom ROM to have this issue.
nicman23 2mo ago
in grapheneOS you can disable or uninstall almost everything without adb anyways
Elfener 2mo ago
GrapheneOS or other custom ROMs don't solve the actual problem that you can't just buy a smartphone and install any operating system like you can with an actual computer, despite technically being one. Also, GrapheneOS supports device attestation (the non-google kind at least), which is still ridiculous as such systems have no benefit to people, only to technofeudalist corporations.
- gruez 2mo ago
  >which is still ridiculous as such systems have no benefit to people, only to technofeudalist corporations. GrapheneOS literally has an app that uses attestation and isn't for "technofeudalist corporations". https://attestation.app/about https://attestation.app/about
- hparadiz 2mo ago
  Device attestation is how you can use private keys you don't actually have access to. It has a lot of value to literally anyone who wants to store tokens or use one time authentication codes. Linux folks need to implement the full stack and offer an open alternative to payments, secrets, and tokens. In the age of LLMs there is no excuse. It is annoying as hell that I can't buy a System76 or Framework laptop with a fingerprint sensor but a Lenovo comes with one that works on Linux perfectly.
  - sophrosyne42 2mo ago
    Framework has a fingerprint sensor. [1] [1] https://frame.work/products/fingerprint-reader-kit?v=FRANTD0001 https://frame.work/products/fingerprint-reader-kit?v=FRANTD0...
    - hparadiz 2mo ago
      It needs to come stock on every Linux laptop from now going forward period. Like you expect a screen to come with your machine. Every Mac has one now and I'm not going back to typing my password in every single time.
    - jeroenhd 2mo ago
      Lots of laptop vendors do. Very few integrate fingerprint scanners into any kind of secure authentication flow, though. There are decent fingerprint drivers for various brands, but connecting fingerprints to authentication beyond basic login requires manual setup. You don't actually need biometrics to use key material, that's what (f)TPMs are for. They're not set up to be usable out of the box in any Linux distro I've tried, though.
      - sophrosyne42 2mo ago
        That's more of a problem on the distro side, no?
  - dingaling 2mo ago
    "Device attestation is how you can use private keys you don't actually have access to." Read that phrase back and then ask "is this the future of computing that we wanted?" The likes of passkeys, essentially user-hostile ssh keys that live on your device but aren't accessible by you, would have been an unbelievable dystopia to us in the 90s. "Linux folks need to implement the full stack" Nah it's fine thanks, I'd rather opt out of corporate serfdom than compromise my principles.
- subscribed 2mo ago
  If this is your stance it's trivial to have your cake and eat it. You can easily build your own GrapheneOS based image, which will then be unable to use attestation (because your own keys you'll use for the secure boot won't match). And I'm not trying to be snarky, if that's the only thing, it's solvable right now. Everything else will work. And concerning "you can't just buy a device and install is" - android and iOS are far more secure than any desktop os, and both pixel/iPhones are far more secure than any computer (or any other phone as well (we'll get the third one next year)). GrapheneOS actually explains "whys" in their hardware support faw section. Generally maintaining an os is a hard work, so that perhaps explains why there's not many mature offerings.
- spogbiper 2mo ago
  > install any operating system like you can with an actual computer This is in practice only true of IBM PC compatibles these days, you really can't install any OS on modern Macs. Maybe you can on (some?) Chomebooks?
  - smw 2mo ago
    You can install Linux on modern macs? That doesn't mean that driver info is available, but there's nothing stopping you from installing another os.
- AlienRobot 2mo ago
  A piece of wisdom I read here is that "install any operating system like you can with a [PC]" is something that you can only do with a PC. PC's are the exception. Every other device is controlled by the manufacturer.
- Gander5739 2mo ago
  > you can't just buy a smartphone and install any operating system like you can with an actual computer, despite technically being one. What's stopping you from buying a phone, unlocking the bootloader, and flashing whatever ROM you want?
  - nsonha 2mo ago
    the "whatever ROM"s are all Android, what difference does it make? Many bank apps have this SafetyNet thing and will refuse to run on non-official ROMs, that too.
    - Gander5739 2mo ago
      Well, there's various linux options like postmarketOS. So long as you have the fundamental freedom, that is, an unlocked bootloader, everything else follows. If you decide to write a new OS for a phone, notning is stopping you.
      - nsonha 2mo ago
        The linux distros support very few devices officially. Even including community maintained ports, it's always old devices that you would not buy if you wanna maximize specs to run as a server. That is one of the reasons you want linux in the first place. I have several old Android phones, the newest one is s10e from 2019, decent specs but only supports an abandoned version of UBports, not the current one, and no port for postmarketOS.
        Gander5739 2mo ago
        Why would you buy a phone to run as a server anyway? If you really want linux you can root the phone and chroot.
        nsonha 2mo ago
        I don't need to root the phone to run linux, and even rooting it doesn't change the fact that you're running linux on top of android.
- teravor 2mo ago
  > GrapheneOS supports device attestation (the non-google kind at least) they have an app that does GOS to GOS attestation. they also run a remote attestation proxy to a google attestation intermediary (doesn't really accomplish anything). they unfortunately don't provide you with the option to disable the Android APIs that can be used to get a unique hardware identifier from your device (cryptographic identity burned into the silicon) with some extra steps. APIs such as remote attestation and DRM handshake initiation.
nekusar 2mo ago
And Graphene OS is also anti-user by being tremendously rude about NOT providing root and using the same tired "suck-u-rity" crap Google and Apple also use. If you're smart enough to buy a phone that supports GrapheneOS, AND install it, yeah you should have root. And tools like XPrivacy and plugins allow control of subsystems like GPS spoofing and lying to apps.
- justonenote 2mo ago
  If you are technical and want root its very easy to patch a build of GrapheneOS to include whatever mechanism you want. You can even automate this to continue to receive updates. I think the decision of GrapheneOS to maintain the attestation features and not providing user root is what gives it a fighting chance of being accepted as legitimate 3rd choice. See: Revolut and others adding GrapheneOS keys and trusting their attestation Like or not, for most users, having root access is a liability, especially with more and more important things being held on phones . Someone downloading a photo editing app and then having a rootkit installed in the background that waits to empty their bank account is not a workable situation.
  - gruez 2mo ago
    >If you are technical and want root its very easy to patch a build of GrapheneOS to include whatever mechanism you want. You can even automate this to continue to receive updates. You don't even need to patch it, AFAIK. You can just install magisk, which is how you're supposed to get root on LineageOS as well.
  - yjftsjthsd-h 2mo ago
    > Someone downloading a photo editing app and then having a rootkit installed in the background that waits to empty their bank account is not a workable situation. Yes, that would be absurd. Thankfully, that isn't how root access has worked in a very very long time if ever. If photo editing app requests root access... you click deny and uninstall it.
    - armadyl 2mo ago
belowavgiq 2mo ago
GrapheneOS has got absolutely nothing to do with any of this. LineageOS, pure AOSP, are all the same. No bloat, no locks. The way they've successfully marketed a more involved custom ROM as a special OS to tech illiterates is very funny I'll admit.
d3Xt3r 2mo ago
GrapheneOS also runs only on Google Pixels, which isn't an option for people who refuse to support Google, or live in a country where Google doesn't sell Pixels. I find it ironic that an organisation which touts "privacy" so much, asks you to financially support one of the biggest anti-privacy corporations, which is why I can't take GrapheneOS seriously. (And yes I'm aware of the upcoming Motorola partnership, but the release has already been delayed several times. I'll believe it when it actually ships).
- Cider9986 2mo ago
  >the release has already been delayed several times. I'll believe it when it actually ships Do you have evidence for this? Since the collaboration was announced, I've heard no delays and they're going to be available on the 2027 Razrs. >financially support one of the biggest anti-privacy corporations, which is why I can't take GrapheneOS seriously. You don't meaningfully financially support Google if you buy second hand or refurbished or Open Box. Google already likely has low margins if you buy their phones on significant discount from them. You don't understand GrapheneOS's rationale. They are focused on delivering a privacy focused OS, not avoiding Google.

mrbn100ful 2mo ago

What does GrapheneOS have to do with this? This is very useful on OEM ROMs with a bunch of scrapware, no one expects a custom ROM to have this issue.

nicman23 2mo ago

in grapheneOS you can disable or uninstall almost everything without adb anyways

Elfener 2mo ago

GrapheneOS or other custom ROMs don't solve the actual problem that you can't just buy a smartphone and install any operating system like you can with an actual computer, despite technically being one. Also, GrapheneOS supports device attestation (the non-google kind at least), which is still ridiculous as such systems have no benefit to people, only to technofeudalist corporations.

gruez 2mo ago
>which is still ridiculous as such systems have no benefit to people, only to technofeudalist corporations. GrapheneOS literally has an app that uses attestation and isn't for "technofeudalist corporations". https://attestation.app/about https://attestation.app/about
hparadiz 2mo ago
Device attestation is how you can use private keys you don't actually have access to. It has a lot of value to literally anyone who wants to store tokens or use one time authentication codes. Linux folks need to implement the full stack and offer an open alternative to payments, secrets, and tokens. In the age of LLMs there is no excuse. It is annoying as hell that I can't buy a System76 or Framework laptop with a fingerprint sensor but a Lenovo comes with one that works on Linux perfectly.
- sophrosyne42 2mo ago
  Framework has a fingerprint sensor. [1] [1] https://frame.work/products/fingerprint-reader-kit?v=FRANTD0001 https://frame.work/products/fingerprint-reader-kit?v=FRANTD0...
  - hparadiz 2mo ago
    It needs to come stock on every Linux laptop from now going forward period. Like you expect a screen to come with your machine. Every Mac has one now and I'm not going back to typing my password in every single time.
  - jeroenhd 2mo ago
    Lots of laptop vendors do. Very few integrate fingerprint scanners into any kind of secure authentication flow, though. There are decent fingerprint drivers for various brands, but connecting fingerprints to authentication beyond basic login requires manual setup. You don't actually need biometrics to use key material, that's what (f)TPMs are for. They're not set up to be usable out of the box in any Linux distro I've tried, though.
    - sophrosyne42 2mo ago
      That's more of a problem on the distro side, no?
- dingaling 2mo ago
  "Device attestation is how you can use private keys you don't actually have access to." Read that phrase back and then ask "is this the future of computing that we wanted?" The likes of passkeys, essentially user-hostile ssh keys that live on your device but aren't accessible by you, would have been an unbelievable dystopia to us in the 90s. "Linux folks need to implement the full stack" Nah it's fine thanks, I'd rather opt out of corporate serfdom than compromise my principles.
subscribed 2mo ago
If this is your stance it's trivial to have your cake and eat it. You can easily build your own GrapheneOS based image, which will then be unable to use attestation (because your own keys you'll use for the secure boot won't match). And I'm not trying to be snarky, if that's the only thing, it's solvable right now. Everything else will work. And concerning "you can't just buy a device and install is" - android and iOS are far more secure than any desktop os, and both pixel/iPhones are far more secure than any computer (or any other phone as well (we'll get the third one next year)). GrapheneOS actually explains "whys" in their hardware support faw section. Generally maintaining an os is a hard work, so that perhaps explains why there's not many mature offerings.
spogbiper 2mo ago
> install any operating system like you can with an actual computer This is in practice only true of IBM PC compatibles these days, you really can't install any OS on modern Macs. Maybe you can on (some?) Chomebooks?
- smw 2mo ago
  You can install Linux on modern macs? That doesn't mean that driver info is available, but there's nothing stopping you from installing another os.
AlienRobot 2mo ago
A piece of wisdom I read here is that "install any operating system like you can with a [PC]" is something that you can only do with a PC. PC's are the exception. Every other device is controlled by the manufacturer.
Gander5739 2mo ago
> you can't just buy a smartphone and install any operating system like you can with an actual computer, despite technically being one. What's stopping you from buying a phone, unlocking the bootloader, and flashing whatever ROM you want?
- nsonha 2mo ago
  the "whatever ROM"s are all Android, what difference does it make? Many bank apps have this SafetyNet thing and will refuse to run on non-official ROMs, that too.
  - Gander5739 2mo ago
    Well, there's various linux options like postmarketOS. So long as you have the fundamental freedom, that is, an unlocked bootloader, everything else follows. If you decide to write a new OS for a phone, notning is stopping you.
    - nsonha 2mo ago
      The linux distros support very few devices officially. Even including community maintained ports, it's always old devices that you would not buy if you wanna maximize specs to run as a server. That is one of the reasons you want linux in the first place. I have several old Android phones, the newest one is s10e from 2019, decent specs but only supports an abandoned version of UBports, not the current one, and no port for postmarketOS.
      - Gander5739 2mo ago
        Why would you buy a phone to run as a server anyway? If you really want linux you can root the phone and chroot.
        nsonha 2mo ago
        I don't need to root the phone to run linux, and even rooting it doesn't change the fact that you're running linux on top of android.
teravor 2mo ago
> GrapheneOS supports device attestation (the non-google kind at least) they have an app that does GOS to GOS attestation. they also run a remote attestation proxy to a google attestation intermediary (doesn't really accomplish anything). they unfortunately don't provide you with the option to disable the Android APIs that can be used to get a unique hardware identifier from your device (cryptographic identity burned into the silicon) with some extra steps. APIs such as remote attestation and DRM handshake initiation.

nekusar 2mo ago

And Graphene OS is also anti-user by being tremendously rude about NOT providing root and using the same tired "suck-u-rity" crap Google and Apple also use. If you're smart enough to buy a phone that supports GrapheneOS, AND install it, yeah you should have root. And tools like XPrivacy and plugins allow control of subsystems like GPS spoofing and lying to apps.

justonenote 2mo ago
If you are technical and want root its very easy to patch a build of GrapheneOS to include whatever mechanism you want. You can even automate this to continue to receive updates. I think the decision of GrapheneOS to maintain the attestation features and not providing user root is what gives it a fighting chance of being accepted as legitimate 3rd choice. See: Revolut and others adding GrapheneOS keys and trusting their attestation Like or not, for most users, having root access is a liability, especially with more and more important things being held on phones . Someone downloading a photo editing app and then having a rootkit installed in the background that waits to empty their bank account is not a workable situation.
- gruez 2mo ago
  >If you are technical and want root its very easy to patch a build of GrapheneOS to include whatever mechanism you want. You can even automate this to continue to receive updates. You don't even need to patch it, AFAIK. You can just install magisk, which is how you're supposed to get root on LineageOS as well.
- yjftsjthsd-h 2mo ago
  > Someone downloading a photo editing app and then having a rootkit installed in the background that waits to empty their bank account is not a workable situation. Yes, that would be absurd. Thankfully, that isn't how root access has worked in a very very long time if ever. If photo editing app requests root access... you click deny and uninstall it.
  - armadyl 2mo ago

belowavgiq 2mo ago

GrapheneOS has got absolutely nothing to do with any of this. LineageOS, pure AOSP, are all the same. No bloat, no locks. The way they've successfully marketed a more involved custom ROM as a special OS to tech illiterates is very funny I'll admit.

d3Xt3r 2mo ago

GrapheneOS also runs only on Google Pixels, which isn't an option for people who refuse to support Google, or live in a country where Google doesn't sell Pixels. I find it ironic that an organisation which touts "privacy" so much, asks you to financially support one of the biggest anti-privacy corporations, which is why I can't take GrapheneOS seriously. (And yes I'm aware of the upcoming Motorola partnership, but the release has already been delayed several times. I'll believe it when it actually ships).

Cider9986 2mo ago
>the release has already been delayed several times. I'll believe it when it actually ships Do you have evidence for this? Since the collaboration was announced, I've heard no delays and they're going to be available on the 2027 Razrs. >financially support one of the biggest anti-privacy corporations, which is why I can't take GrapheneOS seriously. You don't meaningfully financially support Google if you buy second hand or refurbished or Open Box. Google already likely has low margins if you buy their phones on significant discount from them. You don't understand GrapheneOS's rationale. They are focused on delivering a privacy focused OS, not avoiding Google.