Hacker News Reader

Comment by prophesi | Hacker News Reader

Not to discredit the article, but it would be nice to know from the get-go that it's written by a contributor to GrapheneOS and gives a plug to their upcoming App Repository at the end.

View on HN

I'm not saying that the author has never contributed a PR (there'd be a lot of repos for me to look through), but AFAICT the author is just a user/fan of GrapheneOS, not a contributor to GrapheneOS itself or to the GraphenOS App Repository.

After reading the article, I clicked the link to their Github and saw a @GrapheneOS tab in their contribution graph. But taking a second look, I see that they haven't contributed to any of their repos in quite some time.

Note that just filing an issue shows up on the contribution graph.

Looking a little closer, AFAICT, they have only filed 2 GrapheneOS PRs ever: https://github.com/GrapheneOS/platform_packages_apps_Setting... and https://github.com/GrapheneOS/platform_packages_apps_SetupWi...

I was already under the impression that the GrapheneOS developer(s) were overworked, but still they insist in doing everything themselves because no other project is good enough

I have been using for the past year, and the 'advanced' user experience is not great. Updates are forced to the latest version of android, does not seem safe, and definitely does not feel stable, less customization than other roms, a bit aggressive towards root

I will probably go back to lineageos microg f-droid and some hardened configurations

F-Droid is provides invaluable service for android, privacy, open-source, android developers. GrapheneOS seems like an exercise in craziness a bit to extreme for me

> they insist in doing everything themselves because no other project is good enough

They are making an alternative store with better security and privacy properties than both Google Play and F-Droid. Why is this problematic?

> Updates are forced to the latest version of Android

On Pixels (the only devices GrapheneOS supports at the moment), only the latest version of Android receives security updates, so GrapheneOS must stay on the latest version to meet a baseline level of security. Each Android release also comes with security and privacy improvements along with further restrictions to the app sandbox.

> does not seem safe

How is GrapheneOS not safe?

> does not feel stable?

In what way?

> less customization than other ROMs

Yes, because GrapheneOS is not focused on customizability. This will be improved in Android 12L.

> a bit aggressive towards root

Root fundamentally cripples the Android security model, so being a security-focused project, this is the proper stance to take.

Honestly I'm not sure why you're complaining about GrapheneOS in this thread. The article is written about F-Droid by someone who is not a GrapheneOS developer. They pointed out F-Droid's issues and mentioned upcoming alternatives without these issues. I don't see how one of those alternatives is an "exercise in craziness," nor how GrapheneOS itself is relevant to the article.

Author here. I'm neither a GrapheneOS project member or an Accrescent developer. I'm trying to push these solutions because I think they actually do things right. It's really frustrating that the first reaction for some would be to think that my motivation is to push alternative solutions for my own benefit. Let's try to move past this and other irrelevant personal judgments.

As I said, my comment wasn't to discredit the article by revealing a hidden motive. When reading any review, it's simply good to know what the reviewer's biases are. Which I would say contributing to the GrapheneOS repos, letting the GrapheneOS community proofread your article, and mentioning the project's F-Droid alternative is a proof of bias, not that it's necessarily a bad thing, but would have cleared the air if it was shown upfront.

Well, surely there are biases in some ways, including some I may not even be conscious of. That being said, I try to follow a fact-based approach: yes, the conclusion is biased in the sense that it was written in a personal context (again, this article wasn't meant to be shared on several platforms like HN), but I can assure you the rest of the article follows this fact-based approach as much as possible. I even mention build reproducibility and Play App Signing: both mentions could be seen in favor of F-Droid (yet the reality is more nuanced than that).

I'm perfectly aware of the FOSS culture and why some want to use F-Droid to promote this. This is just not what I had in mind when writing the article. I simply intended to address some flaws or deliberate choices from F-Droid that I think are in opposition to the practical approach to modern privacy/security. It happens that I think GrapheneOS and modern Android in general follow that approach. Last month, a reddit troll tried to portrait me as a GrapheneOS developer (when I'm an occasional contributor) and used the article to explain how GrapheneOS would be "anti-FOSS". That is so wrong. GrapheneOS is FOSS at its core, and I personally value FOSS solutions. Not sure how someone would extrapolate the opposite from my article.

Knowing that, I then stumbled upon this thread and noticed people digging up random contributions in my GitHub account instead of reacting to the content. Contributing to an alternative project doesn't mean bias or endorsement. Contributing doesn't necessarily mean code, GitHub issues, or money. You could even see this article as a contribution to F-Droid in some ways (but I'm sure they're aware of the majority of the underlined issues, and I don't have the pretention to do better than them). Then again, I deeply think GrapheneOS and Accrescent are paving the way for modern FOSS solutions.

This person isn't a grapheneOS developer. I'm unsure why people keep saying that.

In the GOS chatrooms this article has come up a few times but I've seen them say they don't know why people keep saying this person is a GOS dev. I mean look at the author's github. They sponsor the lead dev but have no commits or forks in the project to show for.

Reply on news.ycombinator.com