- https://forum.sailfishos.org/t/sailfish-os-clarifying-claims...
Edit: I'm well aware of the differences between typical Linux and Android (especially the security architecture!), and I'm willing to make some sacrifices in the name of FOSS... but only if it's actually FOSS.
I know the people behind SailfishOS, they’re not like, friends or anything: just ex-Nokia developers who got fucked by Microsoft (like I did, btw, which is how I know of them).
I feel like the big tech smartphone duopoly would have a reason to spread such rubbish, but its so patently obvious that I doubt they are so stupid.
"It acquired new investors in 2016, among them the Russian company Votron. In March 2018 they were joined by Rostelecom (which is state owned) as investor, which took over Votron and OMP."
Note that was after 2014 russian invasion into Ukraine.
It sought to disengage from any Russian ownership from early 2022, entered corporate restructuring at the Pirkanmaa District Court, and on 24 November 2023 the court approved a programme obligating a complete sale of the business.
In May 2024 the original Jolla company filed for bankruptcy, its activities having been taken over in 2023 by the Jollyboys company established by Jolla’s former management.
The current entity is owned by the management team, with no Russian stake. So as of now, the “Russian-owned” framing is substantially outdated.
I would really appreciate it if you could give some references - any at all - to back this claim.
All I have seen is GrapheneOS folks (or probably just a certain individual affiliated with the GrapheneOS org) accusing them of doing this.
FWIW, as someone who is not in the phone OS development world at all but has been reviewing phones with alternative OSes for about the last 4 years...
My impression is that everyone else in the phone-OS and deGoogled-Android world hates the GrapheneOS folks, and it's mutual. They seem to be borderline impossible to work with, very arrogant and protectionist, and the project's own support lifetime is "when Google no longer supports your phone, we don't either."
Personally, I'd choose something else. Anything else, in fact.
I don't think that is true. Team members regularly speak positively of iPhone security. E.g.:
https://grapheneos.social/@GrapheneOS/113874795519341571
They also do not post much on LineageOS and when they do it usually articulates the difference between both (with LineageOS focusing more on customizability, while being much less secure).
I think the strongest disagreement is with /e/OS, which is not surprising, because their founder goes around to various widely-viewed/read media insinuating that security hardening/GrapheneOS is only for pedophiles and spies.
They seem to be borderline impossible to work with, very arrogant and protectionist,
As a user, they seem to be responsive to bug reports and actively helping out people in their forums. Not sure what else I need.
and the project's own support lifetime is "when Google no longer supports your phone, we don't either."
But that makes sense, right? One of the main foci of GrapheneOS is security. If Google stops supporting a Pixel model, there will be no more updates of firmware bundles, etc. Most firmware has monthly CVEs, pretending that it doesn't would go counter one of the main goals of GrapheneOS. If you want to maintain such a phone as an insecure device after Google's update period, there are other options you could switch to.
I am also not sure how much this matters. Even Pixel budget devices (a-series) have 7 years of security updates now. It's not only one of the longest in the industry, it's probably beyond how long 95% of the population uses a phone.
As for Jolla, this is about the timeline:
2014 Russia attacks Crimea, temporarily occupies it
2016 Jolla grants Sailfish license to a private Open Mobile Platform LLC in Russia
2018 Rostelecom (state-owned Russian company) buys Open Mobile Platform
2020 Sailfish license to Rostelecom ends
2021 Jolla ceases all business in Russia -- at this point Rostelecom owns 32% of Jolla either directly or via subsidiaries
2022 Russia attacks rest of Ukraine in February
2022 Jolla starts dislodging from Russian ownership. Negotations with russian owners unsuccessful.
2023 Jollyboys Oy is formed, business restructuring of Jolla starts to move assets there
2024 Jolla files for bankruptcy to get finally rid of rest of the problematic ownership
So the current company around the new Jolla phone is technically a new company and has none of the previous baggage, but retains most of the non-russian owners and staff of Jolla.
The time between 2014-2022 was of course kind of problematic, but that was the reality in Europe. We still widely and naively gave Russia the benefit of the doubt back then. It seems to me that after Russia started the war in 2022, Jolla started immediately moving away from there.
Sources:
https://www.is.fi/taloussanomat/art-2000010451277.html
https://en.wikipedia.org/wiki/Jolla
https://suomimobiili.fi/jollyboys-oy-ostaa-sailfish-os-kaytt...
Then again, SailfishOS is a linux with much of the usual linux stuff like userland with bash, coreutils, glibc, systemd, wayland, pulseaudio etc.
https://github.com/sailfishos/sailjail-permissions/blob/mast...
Given how sensitive information most people have on their phones (banking, chats, and whatnot), it's a disaster in the making.
The typical answer is "but I'll only use open source apps that I trust". Sandboxing doesn't only protect you against rogue apps, it primarily protects you against 0-days in apps that you do trust.
If you are worried about big players profiling you (hard to avoid, high likelihood of happening, low likelihood of damage), then you want Sailfish.
If you are worried about apps profiling you (easy to avoid, high likelihood of happening, moderate likelihood of damage), you want Android or iOS.
Graphene and Sailfish sit on different points on that spectrum, just like OpenBSD and Linux do.
Even if you choose not to install Play Services/Play Store, you will still have access to many more apps than on SailfishOS - from many open source Android apps to proprietary apps that you can download without the Play Store. Plus, with the Linux terminal support in Pixels (note: not all Android phones support this, e.g. Snapdragons don't support privileged virtualization), you can also run Linux desktop apps.
Android (and by extension GrapheneOS) uses Linux as a kernel, but it lives in its own world and is completely unrecognizable. I'd say it's even more alien than macOS. For most users, the differences don't matter. If you're a programmer or a sysadmin with reasonable expectations, you feel like a fish out of water very fast. And I cannot honestly the changes are for the better.
Everything I listed was an advantage. Now see, I don't think Unix is the be-all end-all of operating systems design. I don't particularly care for Linux, the BSDs, macOS, etc. But Android is a definite regression in the strongest terms. Give me a PIMOS or Genera or Squeak phone that works well. I'll be happier than I would with a Linux phone.
Only iOS comes anywhere close.
The practical downside, however, is that this phone does not natively run Android apps, while GrapheneOS runs all Android apps bar those that require Play Integrity. Desktop GNU/Linux programs are either unusable or a terrible experience on a mobile device with a small screen and no mouse.
If you say, rely on google maps, banking apps, apps for your IoT appliances, etc. it's certainly relevant. I don't have any of that though.
For me the most and truest pressing issue is that cell modems are very, very tightly coupled with Android. It's still true for the Jolla Phone that it simply is a worse phone because the modem drivers are buggy. This is a complicated issue that isn't getting better, and is mostly to do with legislation legally mandating the tivoization of cell modems, a weird line in the sand on what responsibilities fall to the hardware or to what software, as well as the modem manufacturers themselves not really caring.
My impression (also for Ubuntu Touch, etc.) is that all these systems use the upstream vendors' Linux kernels trees and firmware blobs for Android.
Unfortunately, since we are not talking about Samsung or Google, but just some random Chinese ODMs, it's usually years old Linux versions and ancient firmware blobs full of known holes (e.g. the C2 is running a Linux tree from October 2022). It's only thanks to the tireless work of postmarketOS etc. that some devices boot on modern kernels.
Is this an assumption or coming from your experience? Because I'm typing this on a GNU/Linux phone in a desktop browser and use a bunch of desktop applications daily and haven't noticed.
Of course if you run GIMP or something like that it won't fit unless you plug an external screen and a mouse in, but all the applications I use daily are perfectly usable. There's a lot of Kirigami and libadwaita programs these days that just work well on a phone, and if I need to launch my bank's application there's always Waydroid.
See also: https://linuxphoneapps.org/
There are more, not every application that works fine has metadata filled up (and not everything is on Flathub either).
I do use some webapps, but with Epiphany rather than Firefox.
The app will also build and run on your desktop without any/many changes, if you need that.
I got a fairly nice linphone GTK4 phone frontend app this way. So it's not just for toy apps. FOSS/Linux phones are well positioned for this self-building/self-updating prompt based software development, because you don't need separate computer and shitton of SDKs and a permission from the overseer to build/install the apps, and while phone UI is shit for manual programming, it's not at all shit for writing prompts.
I have a pinephone and try it out year after year.. Well, let's just say that there is so many areas of improvement to make "GNU/linux" run on a mobile device (that sorta includes laptops as well, even though I have done so for years) that we might as well start over from statch.
For example one can't just let everything run whenever it wants, wasting battery life. Android's "more complicated" system and binder was criticized in this thread, but that's exactly what ties together the whole thing to be able to run on a device that fits in your hand, with centrally managed "let's pause this app now" etc
Also, I'm perfectly capable of deciding whether I need an application to be running at a given moment myself, I don't need the OS to make dubious decisions for me.
Which are you using, can you recommend it?
But I hate phones. All I want is navigation, sms/call, signal, steam and firefox.
https://commodore.net/callback/
It's pretty cool looking! Very optimistic about it.
Of course, if your goal is to run SailfishOS, there is currently not much of another option.
My phone would have a screen time of a few mins per day. I can't stand doing anything on these tiny touch screens or browsing the web on a phone screen.
A cheaper 6a would be EOL next year.
They also came later vs 6/6Pro
6a is a 2022 phone, 7a is $150 on Swappa.
Where are we going with this?
All I can give you is my reasoning for picking it. Not giving google my money is always a plus in my book.
and I don’t consider buying used and flashing “giving Google my money”.
Although it definitely enables the market for Pixels, they definitely don’t make much (if any) money selling Pixels, due to they’re being cheap-yet-flagship devices.
It might even hurt Google for you to buy them and not capture all your data with their OS!
Compared to Samsungs, they seem to have comparable prices for less performing hardware, to me.
But what about all the other phones?
Are all Chinese manufacturers selling at a loss?
Pixels are manufactured in China, Vietnam and India.
Maybe their flash gates are made by hand, given how much more they ask for decent storage amounts...
so not sold at the same rate.
Price goes down when you do a run of 10 million boards
vs 1 million.
(and or the facility making them is yours!)
Not to mention that the Pixels were a lot more convenient years ago, when they sold a lot less.
I think you're clutching at straws here, Pixels were cheapish in the first versions, but are not anymore ;)
Most people will fill that up in a glimpse without using cloud services
Our desktop OSes are just incompatible with running untrusted software, and you're gonna want to do that.
So you're saying people should only use walled garden closed source OSes? Sounds like tyranny to me.
2) The point still stands, desktop operating systems like Windows and desktop Linux distributions are much less secure than Android or iOS. Read https://privsec.dev/posts/linux/linux-insecurities/
You should have a look at https://qubes-os.org
I know how this looks like, but I really wish a more precise term, like e.g. GNU/Linux would have catched on...
The kernel is necessary for the OS, but for the user freedom kind of not that important, as can be seen by Google/Linux aka. Android.
https://forum.sailfishos.org/t/open-sourcing-proceeding/2468...
https://github.com/sailfishos/sailfish-weather/
https://github.com/sailfishos/jolla-camera
It's still more open than AOSP
I don't think this is true at all? AOSP is completely open source modulo driver blobs (which Sailfish has too) and Google services.
One can make a fully functional system, modulo drivers, out of only open-source components using AOSP. It's not possible to do this using Sailfish; the compositor, UI libraries (Silica), and most of the "core" apps are still closed source.
A true AOPS image is missing most core Apps.
The main point is that AOSP as a system (modulo firmware) is open source and SailfishOS is not. Also, even though Sailfish has an Android compatibility layer (though only for official devices), compatibility is most likely always going to be worse than 'real' Android.
That said, I hope that Jolla Phone becomes a success, more competition is good. Hopefully being funded better will move them to fully open source the base system.
And OSS projet based on the SFOS core exist : https://nemomobile.net/, https://github.com/nemomobile-ux
If we're going to start counting forks, we get to count LineageOS and GrapheneOS for Android, and then the goalposts really move.
Uh, no? How are you getting this idea?
This is the manifest file for GrapheneOS: https://github.com/GrapheneOS/platform_manifest/blob/17/defa...
It literally contains links to all the AOSP repos or GrapheneOS forks of them. You can clone these exact repos and build the OS from source. GrapheneOS provides instructions for it: https://grapheneos.org/build