• rxbudian@lemmy.ca
    link
    fedilink
    English
    arrow-up
    84
    arrow-down
    4
    ·
    1 month ago

    GrapheOS now officially supports…

    [please… something other than Pixel…]

    Pixel 9

    • Staubsaugernasenmann@discuss.tchncs.de
      link
      fedilink
      English
      arrow-up
      87
      arrow-down
      1
      ·
      1 month ago

      The problem is that (as far as i know) only pixels fulfill their security requirements, for example that the bootloader is not only unlockable but also lockable. But I also would like to have more devices supporting it

        • FutileRecipe@lemmy.world
          link
          fedilink
          English
          arrow-up
          38
          arrow-down
          1
          ·
          1 month ago

          CalyxOS relocks the bootloader and they supported the FP5 right after launch.

          CalyxOS is not a hardened OS, and GrapheneOS requires more than than just relocking the bootloader.

          Fairphone’s devices do not meet basic security requirements for hardware, firmware and the software device support including drivers. Please look at the hardware requirements at https://grapheneos.org/faq#future-devices and check for yourself how many of those are provided by the Fairphone. Even the Fairphone 5 has a CPU core from 2021 without even PAC and BTI.

          Ref: https://discuss.grapheneos.org/d/7208-8y-security-updates-on-fairphone-5-will-the-devs-consider-porting-grapheneos

        • huginn@feddit.it
          link
          fedilink
          English
          arrow-up
          31
          ·
          1 month ago

          Fairphone should sell phones outside of Europe

          Unfortunately neither of us get what we want

            • wreckedcarzz@lemmy.world
              link
              fedilink
              English
              arrow-up
              1
              ·
              1 month ago

              Mmmhm. I’ve been eyeing them since their first phone. I’m sure they will offer even the most basic “international shipping with no warranty or support” any day now…

              my skeleton, 64 years from now, in front of a computer with the website loaded, waiting for the global debut

              • unexposedhazard@discuss.tchncs.de
                link
                fedilink
                English
                arrow-up
                3
                ·
                edit-2
                1 month ago

                Idk where you are, but looking at their shipping info they list some authorized resellers that ship to the US. As you said, they will have varying levels of warranty etc but yiu also have to check hardware stuff like mobile network compatibility etc

                • wreckedcarzz@lemmy.world
                  link
                  fedilink
                  English
                  arrow-up
                  1
                  ·
                  edit-2
                  1 month ago

                  Unfortunately, it’s only murena that I can see (https://murena.com/america/products/smartphones/?wcpbc-manual-country=US), which only has the FP4. It’s quite frustrating, I want to support the project and FP is just uninterested in doing so for NA. Even when the 4 came out, it was going to be a downgrade from my Pixel 5, but like 3y (?) later with no sign of the FP5 is oof.

                  (I forgot too that it’s only compatible with 1 of the 3 nationwide networks here, which I don’t currently use… but baby steps, just having availability here would be nice)

            • huginn@feddit.it
              link
              fedilink
              English
              arrow-up
              8
              ·
              1 month ago

              Paying full price for a phone that was weak when it released 3 years ago that is also missing most US cell bands and is locked to T-Mobile.

              Oh and also the parent company doesn’t ship anything to the US, so parts are aftermarket only.

              That’s not available in the US: that’s you can hack together a workaround.

              • sugar_in_your_tea@sh.itjust.works
                link
                fedilink
                English
                arrow-up
                4
                ·
                1 month ago

                Yup, I looked into them because so many people talked them up, but due to all of those issues you mentioned, I crossed it off my list. I ended up going with Pixel 8 due to long software support, GrapheneOS compatibility, and acceptable repairability, though I would have preferred a PinePhone Pro (if it had better speakers and software support) or FairPhone (if it had better support in the US).

                I guess we’ll see what happens when my phone goes out of support (so, 6+ years?) or I break it.

        • jet@hackertalks.com
          link
          fedilink
          English
          arrow-up
          6
          arrow-down
          1
          ·
          1 month ago

          gos is open source. If the fairphone people wanted to maintain a fork of GOS for their phones, they could.

          • sugar_in_your_tea@sh.itjust.works
            link
            fedilink
            English
            arrow-up
            2
            ·
            1 month ago

            And they could discuss w/ GrapheneOS devs about upstreaming changes and collaborating on longer-term support. I highly doubt GOS project has the resources and desire to support another phone line.

            • jet@hackertalks.com
              link
              fedilink
              English
              arrow-up
              4
              ·
              1 month ago

              https://grapheneos.org/faq

              Many other devices are supported by GrapheneOS at a source level, and it can be built for them without modifications to the existing GrapheneOS source tree. Device support repositories for the Android Open Source Project can simply be dropped into the source tree, with at most minor modifications within them to support GrapheneOS. In most cases, substantial work beyond that will be needed to bring the support up to the same standards. For most devices, the hardware and firmware will prevent providing a reasonably secure device, regardless of the work put into device support.

              if fair phone wanted to, they could, but gos will not volunteer for the work.

              • sugar_in_your_tea@sh.itjust.works
                link
                fedilink
                English
                arrow-up
                2
                ·
                1 month ago

                And that’s completely fair IMO. If FairPhone did do the work and supported US customers as first-class on their platform, I’d probably buy my next phone from them.

      • gwilikers@lemmy.ml
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 month ago

        What does a lockable bootloader mean? Is it just encrypted so the kernel never gets loaded without the user?

  • taaz@biglemmowski.win
    link
    fedilink
    English
    arrow-up
    22
    arrow-down
    1
    ·
    edit-2
    1 month ago

    I am currently in the market for a new mobile phone. The current’s one battery is basically dead and because of security patches now being about 2 years old I have to replace it whole instead of just getting the battery replaced again.

    Pixel with GrapheneOS has been my number one choice for some time but…

    1. there is no (privacy friendly & legal) replacement for Google Play Protect. My banking app won’t work without it as well as one other app I kind of need too.
    2. I am also just too used to having a phone in the 250-300 EUR range in the sense that I don’t have to care about it that much.
      It’s a “consumable” product for me. Loosing/drowning it is not a big deal, where drowning 800 euros is just hard to justify no matter how much money I make.

    I will probably just get the OnePlus Nord 4 instead because of their pledge to do 6 years of updates.

    • NoDignity@lemmy.world
      link
      fedilink
      English
      arrow-up
      41
      arrow-down
      1
      ·
      1 month ago

      I’m not sure about over in Europe but around here the trick to an affordable Pixel is to just buy last years model since you can usually find them lightly used or even new in the $300 - $400 range and updates are only incremental anyway and since they get 7 years of updates now it should be good for quite a while.

      For google play protect yeah thats a bummer, I just use my banks website but I don’t know if European banks allow that.

      Personally though I love Graphene OS it turned my phone from a device I hated due to anxitey I feel around corporate surveillance into a device I genuinely like again.

      • asdfasdfasdf@lemmy.world
        link
        fedilink
        English
        arrow-up
        2
        ·
        1 month ago

        I’m very close to pulling the trigger on Graphene. One question though - usually when I try open source / secure alternatives to some popular software the UI is janky and super old looking.

        Is Graphene like this with their custom apps / UI stuff? Will I notice? Or is it identical to the stock OS UI design?

        • NoDignity@lemmy.world
          link
          fedilink
          English
          arrow-up
          2
          ·
          1 month ago

          The os and the apps that are built in are quite nice basically just look and feel like stock android. Beyond the built in stuff it is a bit more hit and miss if you want to stick to FOSS only like osmand is ok for maps but not really close to google maps. Personally I stick to only FOSS apps but you dont need to be as paranoid as me even while using graphene you can install apps from the play store including google apps. Graphene does have additional privacy protections when using google apps and you can take that a step further by having a separate profile for apps you dont trust. Really though you should read through some of the docs on the graphene website because only you can decide whether the convenience tradeoffs are worth it for your specific case.

      • Laborer3652@reddthat.com
        link
        fedilink
        English
        arrow-up
        2
        ·
        1 month ago

        I’m still rocking my 4a5g and honestly its great. Don’t really want to get rid of it tbh but I’ll probably pickup an 8a sometime next year. Don’t really like giving Google money but they make good phones.

    • pandapoo@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      14
      ·
      edit-2
      1 month ago

      Buy used, and/or buy an “a” model.

      GrapheneOS is clearly the ideal ROM/OS, but alternatively there is another privacy and security centric ROM that supports a lot more devices, with the trade-off being it’s not GrapheneOS.

      Check out DivestOS and it’s supported device list to see if that’s a better fit for you. It’s from the same developer as the Mulch and Mull browser forks.

      As far SafetyNet/Play Project and other anticonsumer “security attestation” features, some bank apps will work fine, what others won’t.

      Does their website provide PWA support?

    • sugartits@lemmy.world
      link
      fedilink
      English
      arrow-up
      12
      arrow-down
      1
      ·
      1 month ago

      Just buy an older supported device if grapheneos is important to you. Something like a 6 pro would be fine.

      • NoDignity@lemmy.world
        link
        fedilink
        English
        arrow-up
        16
        arrow-down
        1
        ·
        1 month ago

        To anyone reading this a 6 is a great pick but its worth knowing that the 7 year update promise only began with the pixel 8 so if you buy a 6 in 2024 it probably only has about 2 years of updates left. However they are only like $150 used I think so the value is probably there even if you only get 2 years of use out of it.

        • vii@lemmy.ml
          link
          fedilink
          English
          arrow-up
          4
          ·
          1 month ago

          What’s the point of Goggle’s security support when you’re buying the phone for GrapheneOS?

          • Laborer3652@reddthat.com
            link
            fedilink
            English
            arrow-up
            5
            ·
            1 month ago

            Graphene only supports devices for as long as the manufacturer does, maybe slightly longer.

            Doesn’t seem like the old CyanogenMod days where you could slap that shit on there forever.

              • iopq@lemmy.world
                link
                fedilink
                English
                arrow-up
                1
                ·
                1 month ago

                You expect them to backport security updates to pixel 3 or whatever for free when even the manufacturer doesn’t?

              • Laborer3652@reddthat.com
                link
                fedilink
                English
                arrow-up
                1
                ·
                edit-2
                1 month ago

                Yeah kinda! My pixel is still going strong, but I kind of feel forced to get rid of it now. I would much prefer to just flash a new ROM and get a few more years out of it. The hardware is (still) really good for the performance I expect out of my phone.

                Eh. Maybe I’ll get a new phone, wipe this one and use it for traveling.

          • Noxious@fedia.io
            link
            fedilink
            arrow-up
            2
            ·
            1 month ago

            To get Android into a fully patched state, you need both firmware updates that come from your phone’s vendor, as well as OS patches that come from your OS developer (in this case GrapheneOS). GrapheneOS usually only provides OS updates as long as Google provides firmware updates, because they don’t want people to run outdated and potentially insecure devices with old, unpatched firmware. But they have extended update cycles for some EOL devices like the Pixel 4a (5G) and Pixel 5.

      • EngineerGaming@feddit.nl
        link
        fedilink
        English
        arrow-up
        5
        arrow-down
        1
        ·
        1 month ago

        7a was the sweet spot for me, even if $300 is frankly a lot by my measure. But I think it was a worthy investment for me.

        Would definitely not get a pro since the 7a is already on the edge of what I can use with one hand. Same for 7 but downplayed, I didn’t opt for this one because it has a glass back.

    • Persen@lemmy.world
      link
      fedilink
      English
      arrow-up
      2
      arrow-down
      7
      ·
      edit-2
      1 month ago

      You can replace the battery easily and there are roms like calyx and divestos, which support bl relocking. Although divestos doesn’t look very stable, but I haven’t tried it.

  • deadcade@lemmy.deadca.de
    link
    fedilink
    English
    arrow-up
    39
    arrow-down
    35
    ·
    edit-2
    1 month ago

    Lead dev of grapheneos is extremely toxic in communication. I don’t trust someone like that developing the software running on a phone.

    EDIT: This comment seems to be particularly controversial, with many people praising GrapheneOS as a project, while ignoring the developers views and actions. Although my opinion of the main developer is negative, the project itself and its goals are great. To clear up some confusion, I want to add to my previous statement:

    At first, this seems like the standard “separating art from the artist”, however, GrapheneOS is a ton of code, not just art. When it comes to other forms of art, like literature or paintings, an artist maliciously hiding their personal beliefs in their otherwise “unbiased” work might degrade the quality of the final result, but does not have much significant impact outside of that. When it comes to code, programs, OSes, this changes. The artist (programmer) changing their art (code) based on their personal beliefs is not just a degradation in quality, but a security risk for anyone running the code and trusting the developer. Having seen the way the GOS dev speaks about its community and even people in support of him (see Louis Rossman’s video), it becomes clear that the mentioned “risk” of malware is very much present. Like many others, I don’t have the time to verify the source code of an entire Android rom myself, which means I would have to trust the GOS dev to not insert anything malicious, after the statements he’s made. I’d have to trust him after he’s grouped a majority of his community into “people who are after him and are swatting him”. It’s a very real possibility that someone with beliefs like that would add malicious code to his project, and I’m personally not willing to run that risk.

    Please note that I am not encouraging people to “go harass the dev”, that is an immoral action nobody should be doing. I am trying to inform people of the developers behavior online, past and current, so they can make a decision for themselves whether to run his software on their personal devices.

    • sugar_in_your_tea@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      36
      arrow-down
      5
      ·
      1 month ago

      Honestly, a lot of lead devs in fantastic FOSS software have pretty limited patience. I’ve read plenty of that guy’s discourse, and while I think he could be more diplomatic, I don’t see any reason to suspect he’s doing anything malicious with the project.

      I’m personally totally fine using GrapheneOS. If you aren’t, there are plenty of alternatives.

      • deadcade@lemmy.deadca.de
        link
        fedilink
        English
        arrow-up
        11
        arrow-down
        3
        ·
        1 month ago

        “Limited patience” is understandable, but the behavior of the GrapheneOS dev is completely different. I’ve personally interacted with them not too long ago, and nothing has changed since the public accusations from a year ago.

        • sugar_in_your_tea@sh.itjust.works
          link
          fedilink
          English
          arrow-up
          5
          arrow-down
          2
          ·
          1 month ago

          That’s fair. I personally don’t interact with him, nor do I plan to (why would I?), so it really doesn’t bother me. As long as the other devs can manage dealing with him and the quality of the code stays high, I’m happy. If the other devs leave the project, I’ll look for forks.

    • Kopy@lemmy.world
      link
      fedilink
      English
      arrow-up
      30
      arrow-down
      2
      ·
      edit-2
      1 month ago

      He isn’t on the project since last year. androguru Edit: Sorry, meant “he isn’t the project lead since last year”. He is still part of the GitHub team and actively developing.

        • FutileRecipe@lemmy.world
          link
          fedilink
          English
          arrow-up
          24
          arrow-down
          2
          ·
          1 month ago

          You can still be part of a project without being lead, to be part of the “we.” Did he contribute and/or is he part of GrapheneOS, yes? So he’s part of the “we.”

          Or does only the lead developer get the “we?” Wouldn’t that make it more of an “I” instead?

          • airglow@lemmy.world
            link
            fedilink
            English
            arrow-up
            2
            ·
            1 month ago

            I was responding to a comment that claimed “he isn’t on the project since last year”. Based on his activity on social media, he is clearly still in the project.

          • vga@sopuli.xyz
            link
            fedilink
            English
            arrow-up
            2
            arrow-down
            3
            ·
            1 month ago

            You should remember that he founded the original CopperheadOS project (from which he was violently ousted by his cofounder) and has been working on it and this for a decade.

        • Kopy@lemmy.world
          link
          fedilink
          English
          arrow-up
          8
          arrow-down
          2
          ·
          1 month ago

          It states that he is the “Founder of @GrapheneOS”, not the current lead developer. So I don’t get your point

          • deadcade@lemmy.deadca.de
            link
            fedilink
            English
            arrow-up
            7
            arrow-down
            2
            ·
            1 month ago

            His activity on GrapheneOS repositories, issues, etc. indicates he’s still very active in development and in the community.

            • asdfasdfasdf@lemmy.world
              link
              fedilink
              English
              arrow-up
              7
              arrow-down
              2
              ·
              1 month ago

              IMO he can contribute all he wants. His PRs will still have to go through someone else (i.e. the new maintainer / lead dev). I don’t care if he adds new code. That’s much appreciated.

              Toxicity is more of an issue if you’re the maintainer since you have control over the project.

    • vga@sopuli.xyz
      link
      fedilink
      English
      arrow-up
      24
      arrow-down
      4
      ·
      edit-2
      1 month ago

      I know Daniel somewhat from some years back, and calling him extremely toxic is just wrong. He is and has always been rather bad at communication under stress and is clearly on the spectrum in some way. Technically a genius person, but perhaps doesn’t have the right set of qualities to lead things, except from a strictly technical pov.

      Very good decision from him to withdraw from social media. I hope he manages to contribute in the future.

  • gwilikers@lemmy.ml
    link
    fedilink
    English
    arrow-up
    1
    ·
    1 month ago

    What are some good alternatives to GOS? I want something that can run on most androids that deGoogles while providing general privacy and security. I know nothing will be as good. Bur what is the next best thing?

    • Noxious@fedia.io
      link
      fedilink
      arrow-up
      3
      arrow-down
      1
      ·
      1 month ago

      DivestOS is pretty good. I’d stay away from /e/OS, CalyxOS and LineageOS though, as they have some pretty serious security problems.