GrapheneOS

Open source privacy and security focused mobile OS with Android app compatibility.

Public Key

npub1235tem4hfn34edqh8hxfja9amty73998f0eagnuu4zm423s9e8ksdg0ht5

NIP-05 Address

GrapheneOS_at_grapheneos.social@mostr.pub

Profile Code

nprofile1qqs9g69ua6m5ec6ukstnmnyewj7a4j0gjjn5hu75f7w23d64gczunmgpz4mhxue69uhhyetvv9ujumt0wd68ytnsw43qzxrhwden5te0wfjkccte9ehx7umhdpjhyefwvdhk6uzwdm2

Publishing to

relay.mostr.pub

relay.noswhere.com

nos.lol

Author Public Key

npub1235tem4hfn34edqh8hxfja9amty73998f0eagnuu4zm423s9e8ksdg0ht5

Show more details

Last Notes

2024-09-04 14:19:00

- reply

@npub1578…c8qd @npub1f2j…78qn Most carriers don't lock the devices they sell. It's mainly an issue in the US.

2024-09-03 06:32:32

GrapheneOS support for the Pixel 9 Pro Fold is no longer marked experimental and is now available through our production site:
https://grapheneos.org/releases https://grapheneos.org/install/web
Our 2024083100 release has been confirmed to be working and to have a working future upgrade path.

2024-08-24 22:43:04

Telegram has full access to all of the content of group chats and regular one-to-one chats due to lack of end-to-end encryption. Their opt-in secret chats use homegrown end-to-end encryption with weaknesses. Deleting the content from the app likely won't remove all copies of it.

2024-08-18 00:35:07

GmsCompatConfig (sandboxed Google Play compatibility layer configuration) version 129 released:
https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-129
See the linked release notes for a summary of the improvements over the previous release and a link to the full changelog.
Forum discussion thread:
https://discuss.grapheneos.org/d/15042-gmscompatconfig-version-129-released
#GrapheneOS #privacy #security #gmscompat

2024-08-16 17:55:33

https://x.com/cryps1s/status/1824077327577591827
This is a fake story. Turns out that getting security information from the CISO of a mass surveillance company trying to build a dystopian police state providing police with "predictive policing" software largely based on racial stereotypes is a bad move.

2024-08-15 17:53:07

- reply

Wired should retract the article and explain how they're going to do better. They keep publishing this kind of fearmongering misinformation from information security industry charlatans. There are real remote code execution flaws being fixed in Android and iOS but they push this.

2024-08-15 17:53:01

- reply

"The most straightforward way to do this would involve having physical access to a victim's phone as well as their system password or another exploitable vulnerability that would allow them to make changes to settings. Google's Fernandez emphasized this limiting factor as well."

2024-08-15 17:52:54

- reply

"iVerify vice president of research [...] points out that while Showcase represents a concerning exposure for Pixel devices, it is turned off by default. This means that an attacker would first need to turn the application on in a target's device before being able to exploit it."

2024-08-15 17:52:48

- reply

This is one of multiple carrier apps in the stock Pixel OS which we don't include in GrapheneOS. We were aware of it already since we had to go through them and figure out why they exist. We could embrace this fearmongering and leverage it for marketing, but we aren't dishonest.

2024-08-15 17:52:42

- reply

iVerify are scammers and anyone paying them money should rapidly stop doing it and remove their malware from their devices. The real security risk is giving remote code execution on your devices to one of these sketchy EDR companies lying about their capabilities and discoveries.

2024-08-15 17:52:34

Wired was manipulated into spreading misinformation to market Palantir and iVerify by misrepresenting a vulnerability in a disabled demo app as being a serious problem which could be exploited in the real world. They should retract the article but won't.
https://wired.com/story/google-android-pixel-showcase-vulnerability/

2024-08-14 01:37:16

GmsCompatConfig (sandboxed Google Play compatibility layer configuration) version 128 released:
https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-128
See the linked release notes for a summary of the improvements over the previous release and a link to the full changelog.
Forum discussion thread:
https://discuss.grapheneos.org/d/14946-gmscompatconfig-version-128-released
#GrapheneOS #privacy #security #gmscompat

2024-08-06 20:52:16

- reply

@npub1w52…rqkr Do you think apps like Signal/Molly or Organic Maps are spying on you? You choose which apps you use.

2024-08-06 20:36:34

- reply

@npub1w52…rqkr You won't have privacy/security using carrier-based calls rather than end-to-end encrypted messaging. Decent smartphones are also much more secure than desktops or laptops.

2024-07-30 23:36:58

https://arstechnica.com/gadgets/2024/07/loss-of-popular-2fa-tool-puts-security-minded-grapheneos-in-a-paradox/
The article unfortunately leaves out most of the points we made in the thread.
GrapheneOS supports hardware-based attestation and it's entirely possible for Google to allow it as part of the Play Integrity API. They choose to ban using GrapheneOS.

2024-06-30 22:59:08

Chromium's V8 Optimizer toggle for disabling JavaScript JIT compilation was changed to only disable the 2 higher tiers of JIT compilation while still leaving the baseline JIT compiler enabled. This also caused the device management policy for JIT predating this to change meaning.

2024-06-23 22:30:27

- reply

@npub1w0w…a0uu Only to fetch release notes, but it caches them once it does.

2024-06-23 19:59:34

GrapheneOS Info app is now available through our app repository and will be included in the next release of the OS. It supports viewing recent OS release notes, provides info on our chat rooms, forum and active social media accounts along with offering all the donations methods.
https://grapheneos.social/system/media_attachments/files/112/667/706/471/647/917/original/fb7ab68053c67eb1.png

2024-06-21 00:38:10

GrapheneOS version 2024062000 released:
https://grapheneos.org/releases#2024062000
See the linked release notes for a summary of the improvements over the previous release.
Forum discussion thread:
https://discuss.grapheneos.org/d/13655-grapheneos-version-2024062000-released
#GrapheneOS #privacy #security

2024-06-15 18:49:54

- reply

This is closely related to publishing the rest of the Trusty code used for Pixels, since they implement communication using authenticated encryption between the SoC secure core and the standalone secure element. Non-Pixel Android ecosystem could benefit a lot from all this code.

2024-06-15 18:48:20

- reply

Upstream OpenTitan project is currently focused on implementing the TPM specification for desktop/server use. TPM is a horrible secure element API. It isn't what's used on Pixels where they got to design APIs for usage by the Android Open Source Project based on what it needs.

2024-06-15 18:45:36

- reply

OpenTitan was created to replace their secure elements based on ARM secure cores with a custom RISC-V design across their servers, Chromebooks and Pixel phones/tablets. Pixel 6 and later have a RISC-V secure element (Titan M2), but they still need to publish Pixel specific code.

2024-06-15 18:40:35

- reply

Not everything is published, particularly Tensor specific portions. It'd be helpful to publish the rest to make it easier to audit and propose improvements.
They still need to publish the Titan M2 fork of OpenTitan too, which they committed to eventually doing several years ago.

2024-06-15 18:34:56

Pixel 6 and later use the open source Trusty OS for the Trusted Execution Environment (TrustZone) and secure core firmware.
Starting with this month's quarterly release (Android 14 QPR3), Trusty sources and baseline applets are part of the Android Open Source Project in trusty/.

2024-06-15 02:46:42

GrapheneOS version 2024061400 released:
https://grapheneos.org/releases#2024061400
See the linked release notes for a summary of the improvements over the previous release.
Forum discussion thread:
https://discuss.grapheneos.org/d/13536-grapheneos-version-2024061400-released
#GrapheneOS #privacy #security

2024-06-14 14:29:18

- reply

If you don't depend on Bluetooth, you might as well update to the current OS release in the Beta channel and then switch back to Stable. Only reason it's not in the Stable channel yet is these 2 issues. There's another minor upstream Settings UI style issue which doesn't matter.

2024-06-14 14:23:45

- reply

Today, we plan to do a release fixing this serious issue and the AOSP Bluetooth module regression breaking pairing with the Galaxy Watch6 device we purchased for testing due to previous Bluetooth regressions in Android 14 QPR2 breaking it. Today's release should reach Stable.

2024-06-14 14:23:37

We've found a serious bug in Android 14 QPR3 which can lead to devices getting stuck in a crash loop on boot after adding a device association such as a WearOS pairing. This impacts both stock Pixel OS and AOSP. Google is aware and reverted the broken change in Android 15 Beta 2.

2024-06-14 13:42:28

- reply

@npub1f3f…d2gu Vanadium should already be asking you for permission to download files. Check settings and enable ask where to save files if it isn't enabled. It's enabled by default in Vanadium, unlike Chromium.

2024-06-14 13:41:31

- reply

@npub1f3f…d2gu We plan to add a request for user consent when opening a URL in the browser from an app without Network but we didn't plan to add more than that.

2024-06-14 13:40:22

Vanadium version 126.0.6478.71.0 released:
https://github.com/GrapheneOS/Vanadium/releases/tag/126.0.6478.71.0
See the linked release notes for a summary of the improvements over the previous release and a link to the full changelog.
Forum discussion thread:
https://discuss.grapheneos.org/d/13529-vanadium-version-12606478710-released
#GrapheneOS #privacy #security #browser

2024-06-13 22:19:54

GrapheneOS version 2024061300 released:
https://grapheneos.org/releases#2024061300
See the linked release notes for a summary of the improvements over the previous release.
Forum discussion thread:
https://discuss.grapheneos.org/d/13509-grapheneos-version-2024061300-released
#GrapheneOS #privacy #security

2024-06-13 21:15:04

- reply

@npub1e5x…38k5 Unclear what the history of the naming is. https://source.android.com/docs/core/ota/apex claims it stands for Android Pony EXpress.

2024-06-13 18:01:39

- reply

@npub1tk9…g5ax We do plan to move that to the main screen in Auditor but it hasn't happened yet.

2024-06-13 17:10:36

- reply

There are a lot of people helping with testing the OS releases in the Alpha and Beta channels, but very few people helping with the apps. We expect most people aren't aware there are Alpha and Beta channels for the app repository too, since it's tucked away in the Apps menu.

2024-06-13 17:09:14

- reply

If you decide to help with testing for our apps or the OS, please join our Alpha/Beta testing chat room and report regressions there right away. See https://grapheneos.org/contact#community-chat for details. Can use Matrix, Discord, Telegram or even IRC (libera.chat) since it's bridged.

2024-06-13 17:03:46

- reply

We'd greatly appreciate if more GrapheneOS users helped with the Alpha/Beta testing of Vanadium releases. Can enable the Alpha/Beta channel by selecting Vanadium in the app repository client (Apps) and changing release channel with the menu. We might need to make it more visible.

2024-06-13 17:00:57

Chromium v126 broke support for the built-in password manager on Android. We've fixed it in Vanadium 126.0.6478.50.1:
https://grapheneos.social/@GrapheneOS/112609618525601248
We'll be filing a Chromium issue. We've had success reporting similar regressions for Android operating systems without Google Play.

2024-06-13 16:59:54

2024-06-13 13:46:55

Vanadium version 126.0.6478.50.1 released:
https://github.com/GrapheneOS/Vanadium/releases/tag/126.0.6478.50.1
See the linked release notes for a summary of the improvements over the previous release and a link to the full changelog.
Forum discussion thread:
https://discuss.grapheneos.org/d/13493-vanadium-version-12606478501-released
#GrapheneOS #privacy #security #browser

2024-06-13 12:17:22

- reply

We have a thread about forensic company capabilities at https://grapheneos.social/@GrapheneOS/112462756293586146 based on leaked Cellebrite documentation. Shows GrapheneOS does a much better job than iOS/Android blocking exploits and only Pixel 6 and later or iPhone 12 and later successfully stop brute forcing.

2024-06-13 12:11:39

- reply

Most devices only ship the backported patches to older Android releases (12, 13 and 14). Pixels ship the monthly, quarterly and yearly releases. Other devices will mostly get the 2nd vulnerability fix when they update to Android 15. They'll have to fix the 1st issue on their own.

2024-06-13 12:11:32

- reply

Each month, Android has a new version released. These are the monthly, quarterly (QPR) and yearly releases. The baseline monthly security patches are NOT the monthly releases of Android. They're backports of a SUBSET of the patches with High/Critical severity, not all patches.

2024-06-13 12:11:25

- reply

There were 2 main issues:
1) memory not wiped when booting firmware-based fastboot mode, allowing exploiting it to get previous OS memory
2) AOSP device admin API depends on reboot-to-recovery to wipe before Android 14 QPR3
Neither is issue is being fixed outside Pixels yet.

2024-06-13 12:11:15

- reply

Our 2024052100 release backported the upstream wipe-without-reboot feature being shipped in the June 2024 release of Android (Android 14 QPR3): https://grapheneos.org/releases#2024052100.
We extended it to make it more robust via extra redundancy in our 2024060400 release: https://grapheneos.org/releases#2024060400.

2024-06-13 12:11:07

- reply

We explained this in our previous thread:
https://grapheneos.social/@GrapheneOS/112204437363495338
CVE-2024-29748 was a mitigation for the issue implemented in the Pixel bootloader. Full solution is implementing wipe-without-reboot, which is now a standard feature in Android 14 QPR3 released as part of AOSP.

2024-06-13 12:10:53

- reply

This is being widely incorrectly reported in tech news coverage. Pixel Update Bulletins are almost entirely patches for vulnerabilities which apply to other devices too. Android Security Bulletins are the list of what other OEMs are required to fix, not the full list of patches.

2024-06-13 12:10:46

- reply

CVE-2024-32896 and CVE-2024-29748 refer to the same vulnerability of interrupting reboot for wipes via the device admin API, which applies to all devices.
https://source.android.com/docs/security/overview/acknowledgements
CVE-2024-32896 is a full fix in AOSP as part of Android 14 QPR3. It's not at all Pixel specific.

2024-06-13 12:10:36

CVE-2024-32896 which is marked as being actively exploited in the wild in the June 2024 Pixel Update Bulletin is the 2nd part of the fix for CVE-2024-29748 vulnerability we described here:
https://grapheneos.social/@GrapheneOS/112204428984003954
As we explained there, none of this is actually Pixel specific.

2024-06-12 23:18:34

GrapheneOS version 2024061200 released:
https://grapheneos.org/releases#2024061200
See the linked release notes for a summary of the improvements over the previous release.
Forum discussion thread:
https://discuss.grapheneos.org/d/13477-grapheneos-version-2024061200-released
#GrapheneOS #privacy #security

2024-06-06 02:31:24

GrapheneOS version 2024060500 released:
https://grapheneos.org/releases#2024060500
See the linked release notes for a summary of the improvements over the previous release.
Forum discussion thread:
https://discuss.grapheneos.org/d/13294-grapheneos-version-2024060500-released
#GrapheneOS #privacy #security

2024-06-05 19:17:55

GmsCompatConfig (sandboxed Google Play compatibility layer configuration) version 116 released:
https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-116
See the linked release notes for a summary of the improvements over the previous release and a link to the full changelog.
Forum discussion thread:
https://discuss.grapheneos.org/d/13281-gmscompatconfig-version-116-released
#GrapheneOS #privacy #security #gmscompat

2024-06-05 03:53:10

Vanadium version 125.0.6422.165.0 released:
https://github.com/GrapheneOS/Vanadium/releases/tag/125.0.6422.165.0
See the linked release notes for a summary of the improvements over the previous release and a link to the full changelog.
Forum discussion thread:
https://discuss.grapheneos.org/d/13256-vanadium-version-125064221650-released
#GrapheneOS #privacy #security #browser

2024-06-04 20:53:43

GrapheneOS version 2024060400 released:
https://grapheneos.org/releases#2024060400
See the linked release notes for a summary of the improvements over the previous release.
Forum discussion thread:
https://discuss.grapheneos.org/d/13244-grapheneos-version-2024060400-released
#GrapheneOS #privacy #security

2024-06-03 20:33:32

- reply

@npub12lx…jvjy Unfortunately, many of the replies you're receiving are from people involved in targeting our developers with fabricated stories and harassment. Those are the people motivated to respond here...

2024-06-03 17:03:11

- reply

Search "DFIR" via Discord discover, preview server without joining and search for GrapheneOS if you want to quickly debunk that fabrication.
https://grapheneos.social/@GrapheneOS/112553695966336807 is the thread we're supposedly marketing GrapheneOS as making people "untouchable" (no) by "law enforcement" (no).

2024-06-03 16:46:28

- reply

These are the same false narratives used by authoritarians trying to outlaw end-to-end encryption cannot be trusted to lead a project supposedly helping people maintain their privacy. These false narratives shouldn't be coming from the leader of a project called "Privacy Guides".

2024-06-03 16:46:10

- reply

Tools from Cellebrite and NSO are also heavily used to go after journalists, political opponents, activists, etc. It is true that these tools are almost entirely used by states. It's completely untrue that they're only used by law enforcement let alone only against criminals.

2024-06-03 16:46:02

- reply

One of the primary uses for Cellebrite's tools is violating the rights of people travelling by plane or crossing borders. It's clearly violating legally enshrined rights in many of the countries it's done, so in fact Cellebrite sells their product to people breaking the law...

2024-06-03 16:45:55

- reply

GrapheneOS focusing on protecting users from forensic data extraction and remote compromise with tools from companies like Cellebrite and NSO absolutely doesn't mean we're trying to protect criminals. Jonah claiming these tools are only used by law enforcement is 100% nonsense.

2024-06-03 16:45:51

- reply

Jonah Aragon and Henry Fisher are directly responsible for the 3 swatting attacks by one of their supporters aimed at killing a GrapheneOS project member. Despite that, they're both still trying to direct harassment towards them and further escalating their fabrications/bullying.

2024-06-03 16:45:42

- reply

Multiple members of the Privacy Guides project quit due to Jonah's corruption and extensive involvement in attacks on the GrapheneOS project. For some context, Jonah is one of the core Techlore project members and has been heavily involved in their harassment for multiple years.

2024-06-03 16:45:36

- reply

We've removed our previous thread only because Jonah edited the linked comment to direct harassment towards a specific GrapheneOS project member he has a long history of targeting with fabricated stories as part of bullying. That's why we've posted a new thread as a replacement.

2024-06-03 16:45:30

- reply

A mod banned us from the server with the justification that we were making forensics harder and claimed the server exists to help law enforcement and forensic data extraction. The chat history is still there for anyone who wants to proof Jonah Aragon is once again lying about us.

2024-06-03 16:45:22

- reply

GrapheneOS had been repeatedly mentioned in their channel on mobile devices forensics. We posted a link to https://discuss.grapheneos.org/d/11860-vulnerabilities-exploited-in-the-wild-fixed-based-on-grapheneos-reports which is on-topic for the channel, useful and relates to past discussions. We also provided some corrections for past discussions about GrapheneOS.

2024-06-03 16:45:11

- reply

Jonah Aragon followed up by pushing a fabricated story claiming we joined a private Discord server used by law enforcement to antagonize them.
The reality is we joined the public Digital Forensics and Incident Response server to participate in discussion about GrapheneOS there.

2024-06-03 16:45:04

Yesterday, we made a post linking to the leader of Privacy Guides (Jonah Aragon) repeatedly pushing the false claim GrapheneOS is marketing itself as making people untouchable by law enforcement and trying to appeal to criminals. It's a thoroughly dishonest attempt to harm us.

2024-06-02 15:46:27

- reply

Our upcoming 2-factor fingerprint unlock will make using a strong passphrase as primary unlock method practical via fingerprint+PIN secondary unlock instead of fingerprint-only. Great for people who want to avoid relying on secure element throttling but don't want fp-only unlock.

2024-06-02 14:41:12

- reply

Default is "Charging-only when locked, except before first unlock" to avoid locking users out of devices with a broken touchscreen. The main threat model for this is defending the device until the auto-reboot timer started when the screen is locked gets user data back at rest.

2024-06-02 14:29:51

- reply

We've also finally added documentation on our USB-C port control to our features page:
https://grapheneos.org/features#usb-c-port-control
Most users can set this to "Charging-only when locked" without a loss of functionality or even "Charging-only" if you don't use USB accessories, DisplayPort or MTP.

2024-06-02 14:28:05

Latest release of GrapheneOS finally shipped the long awaited duress PIN/password implementation. If you have a spare device, we recommend trying it out.
We've added initial documentation to the features page:
https://grapheneos.org/features#duress
It near instantly wipes and shuts down.

2024-06-02 13:00:34

Leader of the Privacy Guides project is now pushing the narrative privacy/security are only for criminals:
https://discuss.privacyguides.net/t/claims-made-by-forensics-companies-their-capabilities-and-how-grapheneos-fares/18445/7
Everyone with integrity already left the Privacy Guides project a while ago due to their heavy involvement in harassing GrapheneOS project members.

2024-06-01 07:22:17

GrapheneOS version 2024053100 released:
https://grapheneos.org/releases#2024053100
See the linked release notes for a summary of the improvements over the previous release.
Forum discussion thread:
https://discuss.grapheneos.org/d/13155-grapheneos-version-2024053100-released
#GrapheneOS #privacy #security

2024-06-01 04:04:00

- reply

So far, only EU banks appear to be doing this which is convenient since we already have contact with the EU Commission with a focus on the anti-competitive Play Integrity API many banks have adopted. They're not going to be impressed by banks banning open source screen readers...

2024-06-01 03:57:48

- reply

We've been working on an App Communication Scopes feature for disallowing apps from seeing or communicating with apps in the same profile with toggles to allow specific cases. We have some of the infrastructure in the OS already for specific cases and can start using it for this.

2024-06-01 03:57:44

- reply

Our users have determined that this is easy to work around by disabling the app rather than the accessibility service not being activated. It's possible for those apps to see that it's not activated and they can see it's a first party OS component so it makes very little sense.

2024-06-01 03:57:36

- reply

Unfortunately, some banks are trying to make life harder for blind people and others reliant on accessibility services. A few have started banning using their app if a non-Google accessibility service app is installed, even if it's not activated (TalkBack is off by default).

2024-06-01 03:57:30

GrapheneOS has been working towards providing accessibility for blind users so we include our own build of TalkBack. We plan to include a text-to-speech (TTS) app and Setup Wizard integration to make it usable out-of-the-box. We can't do much to make installing more accessible.

2024-05-31 19:34:06

GmsCompatConfig (sandboxed Google Play compatibility layer configuration) version 115 released:
https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-115
See the linked release notes for a summary of the improvements over the previous release and a link to the full changelog.
Forum discussion thread:
https://discuss.grapheneos.org/d/13147-gmscompatconfig-version-115-released
#GrapheneOS #privacy #security #gmscompat

2024-05-30 23:18:55

Vanadium version 125.0.6422.147.0 released:
https://github.com/GrapheneOS/Vanadium/releases/tag/125.0.6422.147.0
See the linked release notes for a summary of the improvements over the previous release and a link to the full changelog.
Forum discussion thread:
https://discuss.grapheneos.org/d/13130-vanadium-version-125064221470-released
#GrapheneOS #privacy #security #browser

2024-05-28 05:52:03

GmsCompatConfig (sandboxed Google Play compatibility layer configuration) version 114 released:
https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-114
See the linked release notes for a summary of the improvements over the previous release and a link to the full changelog.
Forum discussion thread:
https://discuss.grapheneos.org/d/13073-gmscompatconfig-version-114-released
#GrapheneOS #privacy #security #gmscompat

2024-05-23 23:55:07

Vanadium version 125.0.6422.113.0 released:
https://github.com/GrapheneOS/Vanadium/releases/tag/125.0.6422.113.0
See the linked release notes for a summary of the improvements over the previous release and a link to the full changelog.
Forum discussion thread:
https://discuss.grapheneos.org/d/12994-vanadium-version-125064221130-released
#GrapheneOS #privacy #security #browser

2024-05-23 19:29:00

GmsCompatConfig (sandboxed Google Play compatibility layer configuration) version 113 released:
https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-113
See the linked release notes for a summary of the improvements over the previous release and a link to the full changelog.
Forum discussion thread:
https://discuss.grapheneos.org/d/12987-gmscompatconfig-version-113-released
#GrapheneOS #privacy #security #gmscompat

2024-05-23 01:40:02

- reply

We're unconvinced that the Linux kernel is headed in the right direction. It's not truly getting more robust or secure. The accelerating complexity and churn is opposed to both, as are the culture and tools. We're hitting more issues including on our workstations and servers.

2024-05-23 01:39:58

- reply

They've made the usual mistake of burning resources on branches by having 2 variants of each LTS branch (Android 12/13 variants of 5.10, Android 13/14 variants of 5.15, Android 14/15 variants of 6.1, etc.) and then making many overlapping branches from those to stabilize them.

2024-05-23 01:39:54

- reply

Generic Kernel Images have directly interfered with both hardening and performance due to the impact of vendor hooks working around not being able to change core kernel code. We don't want dynamic kernel modules but we're essentially forced into using them to avoid init bugs.

2024-05-23 01:39:49

- reply

Unlike the stock Pixel OS, we've avoided shipping common f2fs corruption bugs in production by being way ahead on LTS adoption while narrowing avoiding shipping new serious issues. Has been way too close for comfort and we have low confidence in any LTS release with f2fs changes.

2024-05-23 01:39:42

- reply

We're increasingly scared of updating LTS revisions and it does not help that the GKI LTS branch is lagging a bit behind since it's not lagging behind due to any further stabilization but rather lack of resources to keep up. Any LTS revision with f2fs changes is terrifying now.

2024-05-23 01:39:38

- reply

5.10 kernel drivers for Pixel 6 were ported to 5.15, 6.1 and 6.6. They simply haven't decided to move to a newer branch yet. The kernel for Pixel 8 doesn't bother having a device kernel tree anyway but rather uses generic sources for GKI and all the drivers, so what's the point?

2024-05-23 01:39:26

- reply

Android reached the point where mainline kernels were usable beyond needing out-of-tree drivers for hardware and the Tensor Pixel drivers are way less invasive and easier to port to new releases. GKI has made a mess of it, and it doesn't even make it easier for Pixels but harder.

2024-05-23 01:39:21

- reply

GKI LTS branch reverting a bunch of commits changing the ABI, working around the changed ABI in other cases and lagging behind is making it harder for us to deal with these issues. It'd be smoother upgrading the kernel and fixing API/ABI conflicts. ABI isn't fully stable anyway.

2024-05-23 01:39:16

- reply

Barely any resources are dedicated to stable Linux kernel releases. There's very little testing and review. There have been multiple filesystem corruption bugs backported to ext4 and f2fs recently. Some didn't exist in mainline but rather are from missing interdependent changes.

2024-05-23 01:39:11

- reply

CVE system did not work for the Linux kernel either way, but it's certainly not fixed through making nearly every backport into a CVE and ignoring anything not backported. We don't particularly care about it but rather our concern wasting scarce resources on something useless.

2024-05-23 01:39:07

- reply

The stability of the ABI isn't perfect and many changes get reverted due to breaking the ABI. It also leads to even the GKI LTS branch with the latest merges of LTS releases to lag behind, particularly recently. We attribute some of that to the resources wasted on their CNA work.

2024-05-23 01:39:04

- reply

We've had around 2.5 years to evaluate impact of Generic Kernel Images. Our conclusion is that this caused more harm than good to GrapheneOS.
Generic Kernel Images are supposed to make kernel updates easier via a stable ABI, but Pixels update all drivers for GKI updates anyway.

2024-05-23 01:38:57

Linux kernel becoming their own CVE Numbering Authority (CNA) is wasting resources they'd have previously put towards higher quantity and quality backporting. We've noticed a drop in both for the stable/longterm branches and particularly Android Generic Kernel Image LTS branches.

2024-05-22 23:00:44

Vanadium version 125.0.6422.72.1 released:
https://github.com/GrapheneOS/Vanadium/releases/tag/125.0.6422.72.1
See the linked release notes for a summary of the improvements over the previous release and a link to the full changelog.
Forum discussion thread:
https://discuss.grapheneos.org/d/12961-vanadium-version-12506422721-released
#GrapheneOS #privacy #security #browser

2024-05-22 22:59:03

2024-05-22 20:03:46

GmsCompatConfig (sandboxed Google Play compatibility layer configuration) version 112 released:
https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-112
See the linked release notes for a summary of the improvements over the previous release and a link to the full changelog.
Forum discussion thread:
https://discuss.grapheneos.org/d/12958-gmscompatconfig-version-112-released
#GrapheneOS #privacy #security #gmscompat

2024-05-22 02:16:10

Vanadium version 125.0.6422.72.0 released:
https://github.com/GrapheneOS/Vanadium/releases/tag/125.0.6422.72.0
See the linked release notes for a summary of the improvements over the previous release and a link to the full changelog.
Forum discussion thread:
https://discuss.grapheneos.org/d/12933-vanadium-version-12506422720-released
#GrapheneOS #privacy #security #browser