i'd like to see some more info about the quic as obfuscation claim. imo this isn't really useful for people living in countries with restrictive firewalls. quic is blocked or throttled quite easily.
It's because Fairphone doesn't fulfil GOS's hardware requirements. If Fairphone addresses that, there's no reason for GOS to not support a Fairphone device.
I don't think they can, even if they wanted to. From the GrapheneOS device requirements:
Device support code updated to new monthly, quarterly and yearly releases of AOSP within several months to provide new security improvements (Pixels receive these in the month they're released)
Fairphone's hardware and software is developed by a Chinese ODM (T2Mobile), who even have difficulty pushing out monthly patches very timely. They don't even do QPR2s, major Android updates are very late (usually almost a year), they rarely do driver firmware or kernel updates. There is no way they could fulfill this guarantee unless they started doing software development in-house and paid Qualcomm for monthly firmware updates.
I don't understand the issue. If Fairphone wants GOS can't they just compile it themselves with whatever unsupported hardware based security features disabled? Ditto for any given end user. It's not as though we're talking about a device with hardware specs locked behind an NDA and drivers that only support outdated kernel versions.
An incredibly incomplete port without many of the core security features and decent updates is not GrapheneOS. It isn't possible to bring GrapheneOS to Fairphone devices.
> It's not as though we're talking about a device with hardware specs locked behind an NDA and drivers that only support outdated kernel versions.
Fairphone 5 and earlier have an end-of-life Linux kernel. Fairphone 6 is approaching the same fate. None of their devices keep up with the incomplete security backports to older releases, let alone the full security updates via new major releases. All of their devices are missing important hardware security features which should be standard. They're repeatedly said they don't consider any of this a significant issue and have no plans to significantly change it.
Yes, I realize that the official stance is that it isn't grapheneos without the security features. That doesn't change the fact that someone who won't have the security features either way (and presumably doesn't care because otherwise he would switch to a different piece of hardware) might want the option of using a build of grapheneos that isn't officially condoned by the maintainers. (That's kind of the whole point of FOSS, right?)
I didn't realize fairphone was stuck on an EoL kernel. I guess that means that even if the build can be made to work right now (far from certain given an old kernel) it would likely break in the future.
> might want the option of using a build of grapheneos
An OS without the core features and updates of GrapheneOS clearly isn't GrapheneOS. It's not permitted to refer to it as such.
> That's kind of the whole point of FOSS, right?
No, the point of FOSS is that you can take all of our code and use it for other purposes. Calling an incomplete port to another device GrapheneOS is misleading users. It isn't GrapheneOS and must have a unique name.
No one was suggesting that your trademark should be infringed when marketing to users. If I do my own custom build of firefox referring to it as such in casual conversation is entirely separate from marketing it under that name for others to use (see ex icecat).
Honestly while grapheneos is a useful thing that I'm glad exists you're being absolutely insufferable.
Forking GOS and porting it to a new device is a huge and unreasonable ask for an individual user. Even less so when you include the fact that you'll need to keep it up to date.
I understand that bringing AOSP to an unsupported device is a huge endeavor. But fairphone already has the driver situation sorted out. What's the complexity here? (Genuine question, I'd like to correct any misconceptions about the android ecosystem that I have.)
You are dependent on Qualcomm for hardware firmware updates and apparently they charge quite a bit extra if you want continuous monthly security updates [1]. This is possibly one of the reasons that smaller OEMs like Fairphone do not update firmware regularly and instead choose to keep their customers vulnerable to many known CVEs.
They're getting remarkably good at reverse engineering. I wonder if the relevant firmware updates can be provided by the user or OEM or if they're blobs that have to be signed by qualcomm?
> Fairphone has said they don't plan to add a secure element. It can be seen from their current devices that they don't fully keep up with privacy/security backports and lag a year behind on shipping yearly OS releases. They skip over the monthly and quarterly releases entirely. They replaced their own non-GMS Fairphone OS with a dramatically less secure /e/OS option in partnership with Murena. They clearly demonstrate that security and even privacy are not the priorities.
They replaced their own non-GMS Fairphone OS with a dramatically less secure /e/OS
it sounds like they are saying that /e/OS is less secure than fairphone's own OS. with all criticism against /e/OS taken into account, i highly doubt that fairphone would have been able to make their own version of android more secure than /e/OS when they are not even interested in working on that.
It starts with simply rolling major releases out earlier than /e/OS. Remember that to get security fixes for vulnerabilities not marked high/critical, you need the QPR/major updates. Those vulnerabilities may not be an immediate RCE, but they might get used in exploit chains after an RCE. Also, Fairphone and /e/OS will have many known RCEs, because they do not roll out embargoed patches like GrapheneOS and to some extend Samsung & Pixel do.
Android 16 was released on Fairphone 6 on March 16 2026. Yes, I know, way too late. The Android 16 build of /e/OS for Fairphone 6 was released on July 20 2026. Four months later. This was exactly the point of my comment.
fairphone probably rolls out a stock android release with little change whereas /e/OS has to forward port all its changes and patches on all the phones they support. maybe taking 4 months is to much for that, but that's most likely a resource problem that can probably best be solved by buying more murena phones.
It should be noted that GrapheneOS had similar criticisms about almost every smartphone vendor, including Motorola before their upcoming cooperation IIRC.
Most of their criticisms are valid, but they seem to be absolutely unwilling to make any compromise at all.
Not sure if they want to protect their brand, if any of those criticised issues would increase the work needed by them significantly, or why they are like that.
But I would prefer to have a slightly less secure GrapheneOS on many phones, that helps many many more users than just Pixel owners, over the current all or nothing situation.
GrapheneOS making compromises on their requirements would signal that vendors producing low quality, less secure hardware and software is OK. On something as important as a secure and private smartphone, GrapheneOS not making compromises is actually beneficial to everyone. Maybe it is pushing these vendors to actully care a little more about secure hardware and software. The good thing is that if you actually want a good secure smartphone, you can buy a Pixel and install GrapheneOS.
One of the reasons I haven't switched to Graphene is this kind of drama. I wish there was more middle ground. I don't think the post is in any way constructive and will lead to fairphone to consider adding a secure element.
I don't see their post as 'drama' or nonconstructive at all. It's simply a list of well-founded criticisms of Fairphone's extremely lax position on security that is incompatible with Graphene's. If being critiqued for it doesn't lead to them considering adding a secure element, that's a problem on Fairphone's side imo.
The core criticism to the vendor is the missing security element. This is a fair point.
However, calling out on e/OS in the same post, seems to me very counter-productive. We need more OS vendors and less infighting. Calling all custom ROMs insecure and claiming to be the only one is IMHO 'drama'. Particular there are contributions of me microG that are helpful if you want to de-Google ones phone. Graphene has a different approach: fair. People will use GrapheneOS if they share their goals.
Fairphone is about sustainability and a bit about not supporting major tech like Google. I don't think this hurts. In an ideal world we could have both. But sustainability seems to be a non-goal of GrapheneOS.
I think in this context it's fair to call out /e/.
In some ways /e/ and GOS are trying to achieve different things (/e/ is not hardened and does not claim to be), but /e/ is severely lacking security wise compared to AOSP.
This [0] is, in my opinion, a fair review that mentions many of the issues. That Fairphone is ok with these is telling about their position on privacy and security.
> Calling all custom ROMs insecure and claiming to be the only one is IMHO 'drama'.
No, what it is is true. microG lets you de-Google a phone, but the resulting phone is provably less secure. If stating the truth causes "drama", the problem isn't the person or entity saying the true thing. If that truth shakes people, if it upsets them, they should look into the problem that truth has revealed (not created, as truth isn't something that exists only after someone speaks it) rather than blame those who are speaking it.
Can you provide evidence that GrapheneOS is less secure than LineageOS or other custom ROMs? Because GrapheneOS (and even leaked documentation from commercial adversarial phone hacking tools) provide a hell of a lot of evidence that it is, in fact, considerably more secure than just about every other phone OS in existence.
I am not saying that what they say is wrong. However, this is about current phones. If your goal is supporting aftermarket phones the case looks very different. It is the only way to get a decent level of security. The problem is IMHO how graphene communicates. It is mixing tons of different things to always make their communication more 'bold'. Then they complain about people complaining about their communication style. It is my personal choice, but I accept less security while not having to care about GrapheneOS announcements. I value their work in a similar way that I value WikiLeaks.
What I've seen (that doesn't outwardly appear astroturfed) is largely people getting their feelings hurt because of an opinion they've expressed about the qualities of project they're involved in, or just a user/fan of. Their dislike of the Linux kernel or the relative insecurity of desktop Linux projects in general tends to piss people off, even though the negative points they make are invariably detailed and well communicated.
Because of that, instead of refuting the actual argument being made, discussion always swings towards their tone.
What it is, exactly, that is objectionable? Are there personal attacks being made? Yeah. Towards the GrapheneOS developers. It's something I've seen for myself and if you get into these threads on HN early, you can see how the comment deletions pile up. When they say they are the target of organized disinfo and targeted attacks by malignant third parties, it's pretty easy to believe them. It is in the best interests of many, many very powerful people that GrapheneOS is destroyed.
No one who takes infosec seriously cares about GOS' PR filling their communication with tummy rubs and head pats. Infosec is a nightmare, adversaries are everywhere, all anyone should want to know is whatever is as close to the truth as possible.
To be honest, I am happy that a somewhat influential account is raising these issues. I have tried to explain for probably two decades now that the Linux desktop has poor security and the Linux kernel has issues. But somehow a significant portion of the Linux community lives with the delusion that the Linux desktop is the most secure OS. The whole idea that a vulnerability in some image parser that their Mastodon client uses could give an attacker access to their full user account, simply doesn't occur to them.
I want the open source desktop to succeed, but we can only make progress if we accept that there are a lot of security, UX, and UI issues and start tackling them.
When they say they are the target of organized disinfo and targeted attacks by malignant third parties, it's pretty easy to believe them. It is in the best interests of many, many very powerful people that GrapheneOS is destroyed.
Yeah. There it's clear that there is a lot of organized disinformation, probably by government actors and certainly by other open source and phone vendors that try to sell privacy/eurowashed phones (one Volla astroturfer outed themselves accidentally on Mastodon by sharing information only an employee could know).
there's a tool for extracting chat history from signal desktop, you could build a plaintext and attachment archive with that if it runs regularly on your pc and appends new chats from the last run.
I'd be pretty angry if I found out someone I chatted to on Signal was running a service to workaround my message expiry choice and archive my messages. And breaking that trust just to run it through an LLM?
Be angry then, IM communication is not a contract with terms unilaterly decided by one party. Or put a confidential signature with every message, see how well that works for you
Be a better person. Or at least put a message in your status that you record everything and send it to Google for analysis for minimum personal gain. Do you also carry a second phone to take a photo just in case someone sends you a disappearing photo?
google? signal desktop is not on android, is it? no, its on a pc, as could be a local llm. did i even say i did this before you wanted to assume that you are a better person because what your preferences should be universally obeyed?
reply