Hacker News Reader

Comment by mikece | Hacker News Reader

Apple wins points for being less evil than Google but I'm not going to abandon my Graphene OS phone for an iPhone anytime soon.

View on HN

Why do you think you can trust Graphene OS devs?

GrapheneOS is a project rather than just a few devs. They have exhibited very high focus on security and peer review before commits. The code is FOSS and heavily audited by the most paranoid people like me. It is one of many AOSP projects with a relatively small user base. Therefore it is not a valuable target for compromise or coercion from threat actors.

Apple on the other hand is the biggest corporation in the world beholden to governments, closed source, and with a massive user base.

If you enable automatic updates, you still have to trust that the GrapheneOS devs won’t push a malicious update to your phone, or sell that ability to someone else.

Yes some trust of the project is required. Consider what would motivate them to do something malicious. They do not know who is using the OS since these phones are anonymous and the user base is relatively small. Neither targeted surveillance nor bulk collection is really possible because of this.

The code is completely open source. With the most paranoid of us using and reviewing the code, any malicious code inserted would immediately kill the entire project. We can install and switch to another OS anytime we need to.

Why do you think you can trust the hardware? What about E911, etc.?

Yes we are using the same closed source hardware as 99% of people. Open source HW is ideal, but the options are currently very limited. I use rotating burner SIMs on occasions when I need cellular and never make calls with the SIM. The OS provides other SW mitigations for the HW such as no SW access to the device ID's, fine grained app firewall, and ability to turn off all cellular but enable WIFI.

Can you set my mom up with a Graphene phone? And deal with the inevitable support?

I think I’ll keep recommending Apple to 99% of people.

Can you not do it, why do you need some random person on HN to do it?

It was a rethorical question on their part. But they missed the point of a use case for one person doesn't mean a use case for everyone (his Mother). They were saying they want a plug and play option for family members cause they're the tech person in their lives it seems.

GrapheneOS has like step-by-step instructions that are pretty easy for almost anyone with maybe like a 6th grade comprehension to follow.

You expect the same people who don't even read the error popups they get to follow step-by-step instructions to install an alternative OS on their phone?

I love your optimism :)

You mean a person with early onset Alzheimer's? Yeah, even with an iPhone they are going to get scammed by robocallers, family, and friends.

I think the better argument is the sibling question about why would you believe you can trust the Graphene developers more than you can trust Apple. Certainly Apple has far more to lose by being shady.

That’s fair.

I also know which of the two could resist the FBI more than the other.

Apple also has infinitely more eyes looking at it.

Nobody is going to get a huge PR boost by finding a major security flaw in Graphene OS. But if you find a remote zero day from iOS, you're going to be rich and/or famous instantly.

> Nobody is going to get a huge PR boost by finding a major security flaw in Graphene OS

Among the public, no. Among the security community, yes.

Can you describe your phone and software setup? I’ve installed lineage before but lately have been a little stuck deciding on my next open phone. I’d like to be able to install microg. I don’t plan on necessarily using this as a daily phone all phone but have some medical automations that rely on Bluetooth and in a perfect world could have some water resistance or waterproofing.

I daily drive /e/ OS, I'm happy about it.

Very interesting!

I use grapheneos.org on a Pixel phone. I have tried many AOSP variants. Graphene is hands down the most secure, private, and functional. Couple this with Nextcloud and you have a superior setup.

I like grapheneOS and it's streets ahead from any other effort in the area. The problem i have with it is that it's hard/impossible for your average joe to install it. A small thing but big when it comes to privacy in general

Compared to installing the other AOSP versions, I find Graphene install the easiest. Yes it does require following the instructions and setting some things right. If anyone is hesitant about doing that themselves, they could buy one preinstalled on Ebay or from nitrophone.

Do you know whether it’s compatible with microg? If so, what version of pixel are you running.

I’m familiar with adb.

There is the Google Play compatibility layer on Graphene, so you probably don't need microg - https://grapheneos.org/features#sandboxed-google-play

I am not sure it is, but Graphene has an optional sandboxed Google Play Services that does not require signature spoofing and does not require a Google account. I have it installed on a work profile for some proprietary work apps that require it. My main profile contains all FOSS apps that use web sockets or Unified Push(Nextpush on Nextcloud) to deliver notifications.

Yeah. The point is that you're a somewhat technical person to manage to do that.

Yes you need to know how to open a web browser and place an order online. ;) The self install is really slick. You basically set the phone into developer mode, connect it via USB to your laptop or another phone, and just follow the web installer steps.

They needed to release pro-privacy news to balance out the bad press re: AirDrop in China.

Reply on news.ycombinator.com