GrapheneOS needs OEM partner access | Hacker News Reader

GrapheneOS needs OEM partner access

xcancel.com

34 pointsudev409617 comments

I do feel bad for the situation in which these guys have landed, but it’s also something that seemed inevitable long ago.

They focused on delivering a secure user-controlled operating system for phones. They used as a base an OS stewarded by an advertising and spyware company which couldn’t have values more directly opposed to theirs. They focused primarily on hardware by that same company. Other hardware was not supported in what sounds like “perfect being the enemy of good”. Eg: other devices might have been less suitable if you were targeted by a nation-state, but would have been superb for the 99%, and also avoided funding their opposition.

They let their antithesis have all the cards. It’s been an uphill battle which they’ve managed to push hard. But it’s hard to see a future, just as it’s always been hard to see a long term future for GrapheneOS.

There is so much misinformation about GrapheneOS. Other hardware is not supported for very good reasons. Mainly because the most basic security features are simply not available on other hardware. Google goes out of their way to support other operating systems with proper verified boot using custom signing keys. Also Pixels have proper dedicated security module, Titan M, which I believe are missing from most, if not all other options. Also MTE support. Hardware security is important and none of the current options match Pixels.

GrapheneOS devs should approach the EU for support here in my opinion. Right about now the EU, or at least many member nations, are very interested in ensuring ability to take ownership of important/critical solutions.

I don’t see how the EU can help. They need access to source code that belongs to Google and Google is under no obligation to legal disclose.

The legal changes require to force then to do so are wildly beyond what we can expect from the EU.

I was actually thinking funding and networking. I do agree with what you said.

EU is actively seeking mandatory backdoors into phones among others (look up ProtectEU). EU is the last entity they should be in contact with.

"Experts "deeply concerned" by the EU plan to weaken encryption" https://www.techradar.com/computing/cyber-security/experts-d...

I mean yeah, that's bad, but enemy of my enemy? Asking the EU for something doesn't imply that you endorse everything they do. Also, they've already reached out to the EU, IIRC. (Not sure if that went anywhere.)

As for whether or not the EU can or will help them, I have no idea.

These things i am also against. But there is at the same time an interest in allowing data security and ability to repair, f.x. I would never suggest an EU led or controlled version, but the EU has many types of resource and overlapping goals I think.

What they mean seems to be that one of their main developers was detained so their development slows down. Additionally GrapheneOS has made many breaking changes. So they need to start adapting Android 16 more earlier.

I hate to sound like a jerk, but this comes across like a whining four year old. (The repetitiveness, pleading, shifting appeals, awkward negotiation attempts...)

What's stopping the GrapheneOS team from negotiating similar access contracts as OEM's enjoy?

I would have hoped they'd have some clout given what they've achieved to date and the quantity and impact of bug fixes they've effected upstream.

Are they short on funds? (The posts seem to imply they have some budget available, at least for hiring?)

Is there some kind of sorted history between Google and the GrapheneOS team of which I'm unaware?

Could they commandeer some about-to-be-abandoned, low-end hardware product, as a means to meeting contrived requirements to become a legit OEM?

Or embark on a more organized and deliberate PR campaign (perhaps even legal avenues eg. platform gatekeeper legislation) to pressure Google to maintain Android's open-sourcedness?

They mentioned that Google wants commitments from them that would undermine what GrapheneOS is.

That is - they would have to pass GMS test suite which enforces Play Services and other Google app functionality and wouldn't be compatible with their sandboxing of Play Services.

They also couldn't ship without Google apps.

> What's stopping the GrapheneOS team from negotiating similar access contracts as OEM's enjoy?

Google themselves.

> Is there some kind of sorted history between Google and the GrapheneOS team of which I'm unaware?

https://www.androidauthority.com/google-android-development-...

Google is starting to move AOSP private if not in preparation to kill off the "OS" part of it.

GrapheneOS is in dire need of an OEM partner access which can provide them with the latest source which Google has put behind a paywall. Otherwise, GrapheneOS will not be able to continue the development and eventually shut down

It sounds like early access will speed things up for them/their users. I read nothing in the thread about a general inability to continue nor the danger of having to shut it down?

I very much applaud the goal of trying to be up to date within a few days of new releases and I hope they find both good devs and gain access. I can also see how that may impact morale in the longer term if they don’t.

The rumor is that Android will be going almost completely closed source. If that happens, there'll be no new releases.

Yeah, they haven't posted about shutting down on twitter. It was posted in the matrix room:

> We previously let the community know we need Android partner access in order to port to Android 16 early and for other reasons. We have not received Android partner access. Now that Android 16 has been released, it has become clear that we are going to need it more than before going forward. At the moment, it's clear that GrapheneOS development will be unable to continue in the way it was going before. This the last call for people to share partner access with us if you want to see GrapheneOS continue. Otherwise, be prepared for the final release of GrapheneOS to be today. It's up to the people who have this access to decide if they want the project to go on after today. In order to continue without this, we would need to do substantially more work that we have not had to do previously.

EDIT: More context from the GrapheneOS team on their public Twitter communications

>In the past, the main issue with AOSP was them forking AOSP apps into Google apps and then sometimes abandoning the AOSP apps. This increased over time, leaving behind a bunch of legacy apps we need to replace. There have been similar issues to this, but all things we can handle.

>They've added more and more functionality to Google Play which ends up being considered required, but they haven't ever gone out of the way to gut parts of AOSP. Android 16 has changed this. They ripped out all of the device repositories, despite promising to do the opposite.

More contextual information potentially coming from a community member (not GrapheneOS) on their forum:

>Google apparently hasn't released the kernel code and Pixel device specific code yet, and GrapheneOS team seem to be panicking over that latter part right now, as Google seemingly have removed that code from the AOSP tree entirely, possibly permanently. The next few days will be exciting.

Reply on news.ycombinator.com