Hacker News Reader

Comment by kernal | Hacker News Reader

Unless these devices have the ability to update their binary OEM blobs then these cannot be considered secure. This is why alternative OSs like GrapheneOS end their support when the Google Pixel is EOL. If you want long term support buy an iPhone or an Android phone that guarantees at least 5 years of security updates.

View on HN

Security isn't everything. Sometimes just having a working device you can use to access information takes priority.

Not everyone can buy a device.

Exactly! If security is your highest priority, buy a new Pixel and put GrapheneOS on it.

But if you have an EOL device, DivestOS seems to be an amazing alternative to just staying on the stock firmware that is not going to get any updates at all.

This is clearly documented see (and also the section above it): https://divestos.org/index.php?page=patch_levels#secure

That makes it even worse. They apparently do not even try to make it secure and willingly exclude some patches. Reminds me of "security by management risk acceptance"

They? This is my project, it is just me. There is not a single other project that achieves the scope of what DivestOS does for old devices.

So now the answer to security is to trust one lone developer?

This is more of a statement to the shit show of modern Android. A company worth $1T+ can’t be bothered to figure out how to support devices more than a couple of years and it’s left up to a random developer.

> They? This is my project, it is just me.

"They" has been an acceptable default third-person singular pronoun since at least the 1400s. If there's something you'd prefer, it might be wise to list it on one of your user profile pages.

I don't think the maintainer has a problem with pronoun choice in the sense you're implying - rather it seems that they are trying to emphasize that they are just one person and have limited time/resources

Yeah, that's clear given the context of who replied to whom. I somehow missed that summm was replying to SubzeroCarnage; in light of the context, what was meant to be me being lightheartedly pedantic comes across as a weird and preachy derail. (Shame Hacker News doesn't let one delete things.)

The comment was in direct response to me, but not addressed to me, so it was they as in "project members" (which there are none).

Right but you didn't say you were the project author anywhere so how would they have known that?

Isn't that implied? This is a "Show HN" post.

There are dozens of people commenting here and HN doesn't highlight the author of the post like Reddit does (it would be nice if it did).

Since the 1400s my arse. It's just an annoying trend among woke evangelists, and makes the english language uglier while conveying less information about the subject in question.

There is quite literally nothing "woke" about using "they" to refer to someone in a gender neutral way. That term is really overused nowadays.

Either way, I suppose "he/she" could be used instead if that really is an issue?

It would at least specify that you are talking about one single person, and not more than one, so it is ALWAYS better to use he/she.

Not if you're talking about a nonbinary person :(

They is more inclusive! ^^

No, this is a matter of historical fact. If you disagree, bring it up with the editors of the Oxford English Dictionary.[0] Or, if you prefer, the editors of the First Folio, a 1623 compilation of Shakespeare's works;[1] not quite as early, but easier for us mere mortals to verify.

> For your sake (Iewell) // I am glad at soule, I haue no other Child; // For thy escape would teach me Tirranie // To hang clogges on them.

[0]: https://www.oed.com/view/Entry/200700#eid1288185420

[1]: https://en.wikisource.org/wiki/Shakespeare_-_First_Folio_fac...

Don't bother with the naysayers and dickheads. I appreciate you trying to do something here for old devices, and 80% solutions are ok for most of us.

(I suppose postmarketOS is similar in spirit)

Does building a GSI make sense to cover more devices? Or would that not make sense in this context?

Two of the benefits of DivestOS, the kernel patching/hardening and the vendor blob removal, are not compatible with GSIs as a GSI includes neither the boot or vendor partition.

Hey, just thank you very much for revitalizing my Nexus 5, it's a usable device again ;)

Great Job and project, thanks again!

The title states "Long-term support for end-of-life Android devices". This "long term support" does not extend beyond cherry picked AOSP security patches and does not address the security issues in the drivers of these devices.

But it does what it can. It patches the system, the kernels, adds many hardening features, provides updated browser engines, and removes the proprietary unpatchable components that it can.

This is all well documented on the website, please read through it.

What would you suggest for using MicroG on a DOS-supported device? I see built-in support was removed in 18.1. Could just the DOS kernel be used with the official microg-lineageos on top?

microG was never supported in DivestOS.

You can get a fair bit of benefit from using the boot.img like you say, but it will only go so far.

While I wouldn't recommend it, there are flashable ZIP images of microG, but it'd be at the downsides noted here: https://divestos.org/index.php?page=faq#rootSupport

Don't forget that even supported phones can have unpatchable hardware bugs.

For example checkm8 back in 2019.

At least that required hardware access. If you had an exploitable bug in say some GPU firmware, then you'd realistically need to disable accelerated graphics everywhere no?

GPU firmware is not a security boundary on the vast majority of hardware.

With app to GPU communication being mediated by the kernel.

Reply on news.ycombinator.com