Hacker News Reader

I'm sure their concerns are valid but just because GrapheneOS don't consider the Fairphone to meet their standards for security doesn't mean it is not worth considering for other people who may have different priorities. Fairphones have certain advantages over Pixels such as better repairability and more ethically sourced labour/components. IMO it's good to see the Fairphone do well (and I hope GrapheneOS's partnership with Motorola also goes well).

Unfortunately it looks like it's not just a issue of missing hardware security features:

> Their partnership with Murena along with promoting it themselves with misleading marketing means no possibility of working with us.

I want to like GrapheneOS, but the pettiness of its leadership is a real problem for the long term prospect of the project.

Is it pettiness or just sticking to their morals? Murena, as they mentioned, forwards data to OpenAI which is against pretty much everything Graphene stands for.

> Murena, as they mentioned, forwards data to OpenAI which is against pretty much everything Graphene stands for.

How? In what way? Source?

https://community.e.foundation/t/voice-to-text-feature-using...

June 2025

Someone else shared the up to date info about this feature: https://doc.e.foundation/os/apps/voice-to-text

> The earlier Voice to Text was a Premium-only, online feature: it streamed your speech to a third-party AI transcription service through an anonymising proxy, so it required a Murena Workspace Premium subscription and an internet connection.

> The new Voice to Text is free, offline and on-device

/e/ has other privacy invasive services which are enabled by default. It gives highly privileged access to Google services which are always active and has user tracking in their update client.

/e/ and Murena repeatedly claiming privacy/security hardened devices mainly benefit criminals and falsely claiming they're mainly used by criminals shows what they believe:

https://www.clubic.com/actualite-604786-murena-e-os-intervie...

https://nitter.net/GrapheneOS/status/2040887784253141142

/e/ lacks many crucial standard privacy/security patches and protections:

https://nitter.net/GrapheneOS/status/2081837057433915603

Only for one voice to text feature which is completely optional to use and can be replaced with something else.

As another commenter mentioned, this voice to text feature is now an offline feature and no longer sends data outside the device.

As another note, this Fairphone can be purchased without /e/OS at all. It’s now being sold in the US without Murena being involved at all.

/e/ has other privacy invasive services which are enabled by default. It gives highly privileged access to Google services which are always active and has user tracking in their update client.

/e/ and Murena repeatedly claiming privacy/security hardened devices mainly benefit criminals and falsely claiming they're mainly used by criminals shows what they believe:

https://www.clubic.com/actualite-604786-murena-e-os-intervie...

https://nitter.net/GrapheneOS/status/2040887784253141142

/e/ lacks many crucial standard privacy/security patches and protections:

https://nitter.net/GrapheneOS/status/2081837057433915603

Fairphones don't provide a reasonable level of privacy and security without /e/ either:

https://news.ycombinator.com/item?id=49354807

You can stick to your morals without blowing things out of proportion.

“We are the only acceptable way to do things and no tradeoffs are acceptable” is fairly petty.

“We have a difference of opinion” isn’t.

That does not seem like pettiness to me. That seems like a very good reason to not work with someone.

>I want to like GrapheneOS, but the pettiness of its leadership is a real problem

I used to feel a bit similarly. But I've since realized they are one of the very few software projects that actually make sensible privacy and security choices.

Refusing to work with organizations or individuals that are detrimental to privacy and security is not petty.

Murena does not provide private or secure products and has positioned itself to be against what GrapheneOS provides. A partnership with a company opposed to GrapheneOS and spreading misinformation about it would not be beneficial, and it is not petty to make the smart choice for the benefit of privacy and security.

As someone that swapped from fairphone 5 to a pixel9a with graphene.

I have to side with graphene. Fairphone is a cool concept, but its a expensive phone, early on i had problem with the speakers and mic. Security updates are extremely slow, support is extremely slow.

Their missions is to make a fair phone, but is it fair if you are then forced to buy more ewaste because your phone breaks? Look at pixel software support, its really good, and eu made batteries replacement mandatory.

The Graphene devs can be a bit obsessive about security, but with a starting price above $600, I think the average user is probably better off with a Pixel 10a bought on sale closer to $300. The stock Fairphone OS seems to include Google services, which is kind of surprising and at odds with the focus on user control and all that.

Fairphones don't provide bare minimum privacy and security. Expecting that is not being obsessive. The flaws are increasingly glaring and easier than ever to exploit thanks to advances in AI models. People should care about this and should get a device with reasonable privacy and security such as an iPhone instead.

Fairphone 5 and earlier having an end-of-life Linux kernel with the Fairphone 6 coming up next is a disaster. Many months of delays for standard Android userspace patches from when they can first be shipped and years of delays for the full patches is also a major problem. An increasingly small portion of the patches is backported to older releases and they have months of delays for those.

Fairphones are also missing crucial industry standard hardware security features. People have come to expect their device will provide strong encryption with a random 6 digit PIN rather than a very strong passphrase but that's not the case with a Fairphone.

More information:

https://news.ycombinator.com/item?id=49354623

Fairphones have atrocious updates, privacy and security. They lag many months and even years behind on providing crucial standard privacy and security patches. They've failed to respond to the discovery of severe security issues including multiple of their devices using publicly available private keys for signing.

Fairphone lags months behind on providing Android Security Bulletin patches which are themselves delayed by months compared to when OEMs are first provided and allowed to ship the patches. They lag a year or more behind on major OS updates and count this as additional support time compared to other OEMs. For example, a final major OS update being delayed for 3 years is marketed as providing 3 more years of support compared to shipping it on time.

Fairphone 5 and earlier have an end-of-life kernel branch and the same fate awaits the Fairphone 6. Pixels move to newer kernel branches and are currently moving to 6.12 and then on to 6.18. Other OEMs are also beginning to use newer kernels and move to new branches. Linux LTS branches are only going to have 2 years of support going forward.

Fairphones are designed and assembled by an ODM. Fairphone has very limited involvement in engineering the devices. The working conditions and supply chain are also largely up to T2Mobile rather than Fairphone. Whether either of those are better than Pixels or especially iPhones should be demonstrated with evidence. There's extremely little information available on the working conditions, pay and other aspects of the assembly and supply chain for Fairphones.

Fairphone replaced their own open source OS without Google Mobile Services with /e/ as part of a close partnership with Murena. /e/ and Murena have repeatedly claimed highly private and secure devices mainly benefit criminals and pedophiles along with peddling other authoritarian talking points. They've falsely claimed GrapheneOS devices are mainly used by criminals and aren't useful to regular people.

https://www.clubic.com/actualite-604786-murena-e-os-intervie...

https://nitter.net/GrapheneOS/status/2040887784253141142

Despite the marketing, /e/ has very poor privacy and security. /e/ has their own invasive services with tracking, gives highly privileged access to default enabled Google services and doesn't keep up with basic updates. It greatly rolls back privacy and security compared to the Android Open Source Project.

https://codeberg.org/divested-mobile/divestos-website/raw/co...

https://eylenburg.github.io/android_comparison.htm

https://discuss.grapheneos.org/d/24134-devices-lacking-stand...

Here's a post with more specific allegations:

https://discuss.grapheneos.org/d/24134-devices-lacking-stand...

One thing in the story is that the SPU - the secure enclave on Qualcomm chips that is separate from just running on TrustZone on the main processor - is only available on Snapdragon 8 and X tier products. It's market segmented away from 7 series and below.

Also, I think Qualcomm has only started supporting MTE on Snapdragon 8 Elite Gen 5. Older and cheaper SoCs do not support it yet. Outside that, I think only Google Tensor, recent Exynos generations, and Apple A-series support MTE (though IIRC Apple has an improved extension of it).

Snapdragon 8 Elite Gen 5 has at support for MTE. It doesn't yet support running the whole kernel and userspace with it in practice as GrapheneOS requires but we're going to be working on it with Motorola and Qualcomm.

i dont get it, they are comparing eOS to graphene, not talking about the hardware.

this would be like grapheneOS not using pixel because the stock android that ships with it does not respect privacy.

am i missing something?

You still need to rely on the OEM to properly configure the bootloader, not leak the keys, and provide updated vendor blobs.

It should be doable with cooperation between the two, right?

If we add that FSF aims to provide free alternatives to some vendor blobs the landscape begins to look promising.[0]

One party to provide needed specs for hardware, one party to free the hardware from vendor blobs and another party to merge this into a working product.

[0] https://www.fsf.org/campaigns/librephone

Fairphones have awful updates for the firmware and drivers with months of delays. They end up with an end-of-life Linux kernel and hardware components. Fairphone 5 and earlier have end-of-life kernels which aren't receiving the vast majority of important privacy and security patches.

They're missing crucial industry standard hardware security features. They don't provide proper encryption protecting user data for the vast majority of users not setting a very strong passphrase.

The main hardware and update requirements for GrapheneOS are listed here:

https://grapheneos.org/faq#future-devices

We left another reply at https://news.ycombinator.com/item?id=49354807 with more details on how Fairphone doesn't meet those requirements.

You're making me want one.

Fairphone also had the publicly available test key flagged as trusted by the boot loader at one point, which probably discourages projects like GOS, since it makes it harder to trust the hardware to not be a weak link in security.

Fairphones lack the updates and hardware-based security features expected by GrapheneOS.

They're missing hardware security features needed to provide strong encryption for the vast majority of users not using a very strong passphrase. They're similarly missing hardware-based protections heavily used in GrapheneOS to protect from exploitation including remote attacks.

Fairphones have atrocious updates, privacy and security. They lag many months and even years behind on providing crucial standard privacy and security patches. They've failed to respond to the discovery of severe security issues including multiple of their devices using publicly available private keys for signing.

Fairphone lags months behind on providing Android Security Bulletin patches which are themselves delayed by months compared to when OEMs are first provided and allowed to ship the patches. They lag a year or more behind on major OS updates and count this as additional support time compared to other OEMs. For example, a final major OS update being delayed for 3 years is marketed as providing 3 more years of support compared to shipping it on time.

Fairphone 5 and earlier have an end-of-life kernel branch and the same fate awaits the Fairphone 6. Pixels move to newer kernel branches and are currently moving to 6.12 and then on to 6.18. Other OEMs are also beginning to use newer kernels and move to new branches. Linux LTS branches are only going to have 2 years of support going forward.

Fairphones are designed and assembled by an ODM. Fairphone has very limited involvement in engineering the devices. The working conditions and supply chain are also largely up to T2Mobile rather than Fairphone. Whether either of those are better than Pixels or especially iPhones should be demonstrated with evidence. There's extremely little information available on the working conditions, pay and other aspects of the assembly and supply chain for Fairphones.

Fairphone replaced their own open source OS without Google Mobile Services with /e/ as part of a close partnership with Murena. /e/ and Murena have repeatedly claimed highly private and secure devices mainly benefit criminals and pedophiles along with peddling other authoritarian talking points. They've falsely claimed GrapheneOS devices are mainly used by criminals and aren't useful to regular people. Fairphone has chosen to stand with this company included when contacted by the media about criticism.

https://nitter.net/GrapheneOS/status/2040887784253141142

https://clubic.com/actualite-604786-murena-e-os-interview.ht...

Despite the marketing, /e/ has very poor privacy and security. /e/ has their own invasive services with tracking, gives highly privileged access to default enabled Google services and doesn't keep up with basic updates. It greatly rolls back privacy and security compared to the Android Open Source Project.

https://codeberg.org/divested-mobile/divestos-website/raw/co...

https://eylenburg.github.io/android_comparison.htm

https://discuss.grapheneos.org/d/24134-devices-lacking-stand...