GrapheneOS

Open source privacy and security focused mobile OS with Android app compatibility.

Website: https://grapheneos.org/
Forum: https://discuss.grapheneos.org/
X: https://x.com/GrapheneOS
GitHub: https://github.com/GrapheneOS

Public Key

npub1kwarc5z9lwhen05uknd2nuwhhthd4ws0cku3t9j3rchm0fcd6luslse0nj

NIP-05 Address

grapheneos_at_grapheneos.social@momostr.pink

Profile Code

nprofile1qqst8w3u2pzlhtueh6wtfk4f78tm4mk6hg8utwg4jeg3utah5uxa07gpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dslp5jg4

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1kwarc5z9lwhen05uknd2nuwhhthd4ws0cku3t9j3rchm0fcd6luslse0nj

Show more details

Last Notes

2026-08-29 15:14:50 UTC

- reply

Compared to the Pixel 11, a Snapdragon 8 Elite Gen 5 has ~40% higher single threaded CPU performance, ~80% higher multi threaded performance, over 100% higher GPU performance and a far better cellular radio. It also finally has MTE. The next gen is what will be in the first Motorola with GrapheneOS.

2026-08-29 15:08:17 UTC

- reply

Pixel 11 series is a lot more expensive for an incremental improvement to the CPU, the same underpowered GPU and reduced RAM for the Pro base models. They finally caught up to the last generation of Qualcomm cellular radio. It's overpriced, the upgrades aren't impressive and losing MTE is appalling.

2026-08-29 14:56:38 UTC

- reply

Pixel 11 does have security improvements including moving to post-quantum secure verified boot (ML-DSA) and replacing Samsung Shannon IMS with AOSP IMS. Titan M3 should significantly improve protection against data extraction in Before First Unlock state. It's too bad they ruined it by cutting MTE.

2026-08-29 14:51:27 UTC

- reply

Neither iOS or Android encourage app developers to opt into MTE and other more aggressive security features used in the base OS. Apple's docs warn developers of performance and stability issues. Even Signal doesn't opt-in. Our approach enables forcing using MTE in the standard allocators regardless.

2026-08-29 14:46:56 UTC

- reply

Apple's MIE and Android 16+ AAPM don't use MTE for user installed apps unless those explicitly opt in. GrapheneOS enables it for more apps automatically and has a toggle for users to opt-in for every user installed app. There's a per-app toggle to opt-out for incompatible apps which is uncommon.

2026-08-29 14:40:34 UTC

- reply

Apple's Memory Integrity Enforcement (MIE) is an always enabled feature on the iPhone 17. It's simply a high quality implementation of MTE using the latest standard extensions. It uses MTE in the most secure mode in the kernel and a large portion of userbase. They did a very good job integrating it.

2026-08-29 14:36:10 UTC

- reply

Pixel 8 launched with hardware MTE support in October 2023. We integrated it into our hardened_malloc project and began using it across the OS later that month. Android and the Pixel OS never started using it by default. Android Advanced Protection Mode in Android 16 enables it for a few processes.

2026-08-29 14:29:34 UTC

- reply

ARM hardware memory tagging (MTE) is used by GrapheneOS across the entire base OS including the kernel and every standard base OS process. It's only temporarily disabled for a few device-specific processes. It greatly improves protection against nearly all remote exploits and many local exploits.

2026-08-29 14:19:30 UTC

We have a partial port of GrapheneOS to the Pixel 11 series after a week of work on it. We're unable to complete the port due to lack of support for ARM hardware memory tagging in software, firmware and near certainly hardware. It appears Google cut an important security feature to save money.

2026-08-11 23:03:38 UTC

- reply

GrapheneOS blocks new USB connections while locked by default at both a software and hardware level. It can be enabled while unlocked too. It can even be set to fully disable USB while booted including USB-PD and other charging functionality. More info:
https://grapheneos.org/features#usb-c-port-and-pogo-pins-control

2026-08-11 22:59:50 UTC

- reply

Standard Android USB charging-only mode does not block new USB connections. It only means the device Android is running on isn't acting as a USB peripheral such as a webcam, MTP or MIDI device itself. USB debugging is another of those gadget modes which can be on simultaneously.

2026-08-11 22:59:39 UTC

- reply

Android 16 added Android Advanced Protection Mode which can be used to toggle on multiple extra security features. It blocks new USB connections at a kernel level while the device is locked. Our approach also blocks new USB connections at a hardware level and disables USB data.

2026-08-11 22:59:33 UTC

- reply

They have their tool pretend to be a certain USB peripheral to target specific Linux USB drivers. These exploits are widely used including against journalists and political activists. Here's a technical article about a specific case of this in Serbia:
https://securitylab.amnesty.org/latest/2025/02/cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist/

2026-08-11 22:59:15 UTC

- reply

Exploiting Linux kernel USB vulnerabilities is how exploit tools from Cellebrite and other companies extract data from Android devices in practice. They also exploit firmware bugs in other boot modes but we convinced Google to eliminate most of that attack surface for Pixels.

2026-08-11 22:59:07 UTC

- reply

Android's standard USB menu being set to charging-only means the device has MTP enabled with file transfer disabled. It always has USB data and USB peripherals enabled. GrapheneOS USB-C port charging-only means USB data is disabled in hardware and kernel USB drivers are disabled.

2026-08-11 22:58:50 UTC

Android has USB data and a large number of USB drivers available including while locked. Plug in a mouse, keyboard, external drive or other USB accessory and you'll see that's the case. When Android says charging-only, it means not allowing file transfer.

2026-08-07 20:47:29 UTC

- reply

In addition to one of the authors being a Senior Research Scientist at Google, it credits 4 people at Google for review including people in management. Google being so heavily involved in this extraordinarily inaccurate slop functioning as a hit piece on GrapheneOS is appalling.

2026-08-07 16:29:59 UTC

This paper is inaccurate slop. It makes a large number of clearly inaccurate claims about GrapheneOS and presents results which are verifiably false. It's filled with nonsense which appears AI generated.
> The Clone Strikes Back: Efficient Vulnerable Code Detection in Custom Android-based Systems

2026-07-31 00:04:11 UTC

- reply

Control over the frame rate is a planned feature in the near term. This release is a maintenance release to catch up on many dependency updates and fix many known issues.
Our Camera app is going to receive a complete user interface overhaul and major new features over the coming months. Our current focus is on a near complete overhaul of the Messaging app and a new Gallery app for GrapheneOS forked from an open source project. Keyboard is also a priority and we'll overhaul the rest too.

2026-07-30 23:46:24 UTC

GrapheneOS Camera app version 91 released:
https://github.com/GrapheneOS/Camera/releases/tag/91
See the linked release notes for a summary of the improvements over the previous release and a link to the full changelog.
Forum discussion thread:
https://discuss.grapheneos.org/d/40836-grapheneos-camera-app-version-91-released
#GrapheneOS #privacy #security #camera #android

2026-07-26 13:44:41 UTC

- reply

An edit has been made to the post to add the following information:
> The duress PIN will also wipe the device when entered as a 2nd factor PIN for fingerprint unlock, but not a SIM PIN.

2026-07-26 04:17:48 UTC

We've published an overview of how we protect against data extraction from locked devices with the recently improved secure element rate limiting, locked device auto-reboot, strong passphrases, 2nd factor fingerprint PIN, stronger exploit protections and more:
https://discuss.grapheneos.org/d/40700-grapheneos-protections-against-data-extraction-from-locked-devices

2026-07-25 01:34:16 UTC

- reply

The Motorola devices will be more internationally available especially once there are lower priced ones providing official GrapheneOS support. It 's starting with the flagships because Qualcomm rolls out security features to those first and it will likely be a while before even the high end non-flagship ones have what we need.

2026-07-24 23:11:55 UTC

- reply

Android also works fine with a mainline kernel.

2026-07-24 23:09:23 UTC

- reply

Desktop Linux doesn't follow the don't break userspace rule. It's a kernel rule not followed in userspace by those.
Android keeps ancient apps working. It uses store policies to force updating to new API levels with major backwards incompatible improvements. That includes yearly backwards incompatible privacy and security changes. Desktop Linux can't force similar app ecosystem improvements AND lacks the backwards compatibility.

2026-07-24 22:58:34 UTC

- reply

It's completely arbitrary. You want to claim Android isn't Linux and are working backwards from it making standards which you don't apply consistently elsewhere. Ubuntu does not have a small amount of patches but rather entirely maintains their own LTS kernels with whatever they want to backport including arbitrary features. Android is closer to using a standard LTS in production than Ubuntu, so is Ubuntu not Linux?

2026-07-24 22:51:35 UTC

- reply

If only the kernel.org releases with no out-of-tree drivers are Linux then it's not an OS with any significant usage in practice. Every mainstream distribution has various downstream patches to the kernel and many have out-of-tree drivers available. Most common laptop, desktop and server hardware can at least be partially used with in-tree drivers but that doesn't mean everything is often fully functional or working properly.

2026-07-15 19:55:18 UTC

- reply

No, since that's using the Play Integrity API.

2026-07-15 18:54:05 UTC

- reply

We've resolved the new compatibility issues with anti-tampering code in banking apps. We're in the process of making a new release with the workarounds. We posted a new thread about it:
https://grapheneos.social/@GrapheneOS/116925427491681935
#note17f0…yd8y

2026-07-15 18:51:13 UTC

- reply

You can see the relevant changes here:
https://github.com/GrapheneOS/platform_frameworks_base/pull/410
https://github.com/GrapheneOS/platform_system_core/pull/43

2026-07-15 18:50:18 UTC

- reply

Our new secure spawning improved overall app compatibility despite these 2 anti-tampering SDKs causing new issues with it. We've solved the regressiond and are currently building a new release with the improvements. It will be available in around 12 hours. App compatibility will be better than ever.

2026-07-15 18:46:12 UTC

- reply

Our new secure spawning implementation has better app compatibility. This made it possible for the V-KEY V-OS Mobile App Protection anti-tampering SDK to run instead of crashing and it began blocking GrapheneOS. We've solved this problem by simply blocking their code from running for the time being.

2026-07-15 18:43:10 UTC

- reply

Our new secure spawning also added a per-app toggle. Alongside this, we made is possible to disable secure spawning and hardened_malloc at the same time. This requires an extra zygote with hardened_malloc disabled which we spawned on-demand. It has to be spawned at boot instead for low mount IDs.

2026-07-15 18:39:42 UTC

- reply

Our new secure spawning implementations runs the same code run by the Zygote after exec to improve compatibility. Many apps which didn't work before are now compatible. However, that tripped this mount ID check by recreating a mount namespace. It doesn't need that part so we've simply removed it.

2026-07-15 18:33:54 UTC

We solved the recent regression in compatibility with a small subset of banking apps. It was caused by a Zimperium anti-tampering SDK checking the Linux kernel mount ID for /system/framework/framework.jar and banning it being above 900. Our new secure spawning was tripping it.

2026-07-15 14:55:50 UTC

- reply

Motorola flagships with GrapheneOS support will likely be available in 2027, hopefully within 12 months. It will take longer for lower end devices to be supported. The initial devices will be more expensive than most Pixels but it will end up supporting devices in a similar price range as Pixels including the 'a' series devices over time.

2026-07-15 13:36:36 UTC

- reply

That may require an OS change if it's based on it being the system gallery app.

2026-07-15 13:35:07 UTC

- reply

Revolut should currently work fine on GrapheneOS but they may ban it in the future with the Play Integrity API. We'll have to do a pressure campaign to get them to unban it if that happens. We suspect it will happen because we had to work around an SDK in the Revolut app which was explicitly banning using GrapheneOS. It was even detecting the string "grapheneos" as the build user for the OS which we had set for reproducible builds. We had to change that and other things it checked.

2026-07-15 00:42:41 UTC

- reply

We're going to be completely replacing the legacy AOSP Gallery with a much more modern app in the near future. Our Camera app will also get a major overhaul with many new features and a new user interface. The current Gallery isn't our own app but rather a legacy AOSP sample app and is awful but it's going to be gone soon.

2026-07-14 19:01:24 UTC

- reply

We found one anti-tampering SDK was crashing due to being incompatible with secure (exec-based) spawning and therefore permitting having any OS. By fixing compatibility with it, we enabled it to detect and ban GrapheneOS. We'll fix that too. Banking app code is ultra low quality.

2026-07-14 18:59:05 UTC

- reply

In some cases, we've found the issue is that the anti-tampering code was previously crashing due to being incompatible with the previous secure spawning implementation so it wasn't banning GrapheneOS. By improving compatibility with it, we enabled it to ban GrapheneOS. We'll fix that problem too.

2026-07-14 18:45:19 UTC

- reply

Our per-app compatibility mode and the finer-grained toggles it uses can be used to work around most broken anti-tampering code. Our new per-app secure spawning toggle made it better. We need to fix the new compatibility issue with another flawed anti-tampering SDK though.

2026-07-14 18:38:10 UTC

- reply

These apps have poor security and instead deploy half-baked anti-tampering mechanisms with memory corruption bugs and many dependencies on implementation details changing between Android releases. It's why these apps usually break on new major Android versions until they upgrade.

2026-07-14 18:36:55 UTC

- reply

The new secure spawning implementation uncovered some more of these strange cases of apps banning GrapheneOS for obscure reasons. Since multiple users are reporting using a VPN set to another country works around it for Chase, that's worth trying as a workaround for others too.

2026-07-14 18:35:48 UTC

- reply

Our new secure spawning implementation improved overall app compatibility but there are still apps detecting differences from the stock OS and banning GrapheneOS. One cause we've discovered are apps counting the number of memory pages considered shared and banning having too few.

2026-07-14 18:34:39 UTC

Our users are reporting the Chase banking app is banning using GrapheneOS but permits it when a VPN is enabled and set to another country:
https://discuss.grapheneos.org/d/40289-chase-app-error-on-latest-graphene-version
We're aware of this compatibility issue with several apps and are actively working on improvements to resolve it.

2026-07-14 03:02:58 UTC

- reply

Google needs to start open sourcing QPR1 and QPR3 releases again along with open sourcing security preview patches shortly after disclosure to OEMs. Otherwise, we'll just hire people to start doing reverse engineering work in an official capacity to start publishing the changes as open source early.

2026-07-14 02:56:37 UTC

- reply

Google switched to a performative Android Security Bulletin system with vulnerabilities listed 2-4 months after they're shipped. They're pretending as if not open sourcing patches protects people from OEMs not patching them. Our community has people successfully reverse engineering binary patches.

2026-07-14 02:50:52 UTC

- reply

We're going to need to do a lot of work with Motorola and Qualcomm to provide serious patches for GrapheneOS devices. We're going to need more developers. After the launch of the new devices with GrapheneOS support, we want to repeatedly port to the latest Linux LTS branch among other major changes.

2026-07-14 02:47:07 UTC

- reply

Vast majority of Linux kernel vulnerabilities aren't covered by Android Security Bulletins, externally disclosed patches are backported very slowly and Android Security Bulletins come 2-4 months later than when Android patches can be shipped. If you want bare minimum patches, use iOS or GrapheneOS.

2026-07-14 02:44:43 UTC

- reply

Android 17 is the only Android release with the current set of disclosed Moderate and Low severity patches. Android 16, 16 QPR2 and 17 will soon be the only releases with the current set of disclosed Critical and High severity patches too. Once Android 18 is released, it will be the only one.

2026-07-14 02:43:34 UTC

- reply

Bare minimum Android security patches now require being on Android 16, 16 QPR2 or 17 and quickly moving to Android 18 when it's released. Once Android 18 is released, it will be the only release with current High and Critical severity patches. Serious support for older Android releases has ended.

2026-07-14 02:41:43 UTC

- reply

The vast majority of vulnerabilities are now being discovered internally by Google for Android and Chrome. These are largely being discovered with AI. The subset deemed Critical severity and an imminent risk will be backported to 16 and 17. Bare minimum security support for older releases is over.

2026-07-14 02:26:39 UTC

Android's security policy for the past several years has been to backport patches for Critical and High severity Android vulnerabilities to the past 3 major yearly releases. Moderate and Low severity patches including most fixes for privacy weaknesses have required upgrading to the latest releases.

2026-07-12 01:41:22 UTC

GrapheneOS version 2026071100 released:
https://grapheneos.org/releases#2026071100
See the linked release notes for a summary of the improvements over the previous release.
Forum discussion thread:
https://discuss.grapheneos.org/d/39301-grapheneos-version-2026071100-released
#GrapheneOS #privacy #security

2026-07-10 14:23:30 UTC

- reply

No, it works in every user and can be enabled by secondary users now instead of only the main user. Android 17 moved to per-user Wi-Fi settings. Wi-Fi hotspot quick tile isn't supported in secondary users yet but it can be enabled in the Settings app. We plan to make the Wi-Fi quick tile usable in secondary users as a GrapheneOS enhancement prior to it being done upstream.

2026-07-08 18:03:25 UTC

Secure PDF Viewer app version 32 released:
https://github.com/GrapheneOS/PdfViewer/releases/tag/32
See the linked release notes for a summary of the improvements over the previous release and a link to the full changelog.
Forum discussion thread:
https://discuss.grapheneos.org/d/37983-secure-pdf-viewer-app-version-32-released
#GrapheneOS #privacy #security #pdf #android

2026-07-04 20:08:37 UTC

- reply

We strongly recommend a Pixel 8 or later due to the 7 years of support from launch and major security improvements. 7th gen Pixels had 5 years of support from launch and a lot of that is used up. We recommend against buying those anymore.
A used Pixel 8a is generally the cheapest option that's recommended since the 'a' series devices are the budget ones:
https://grapheneos.org/faq#recommended-devices
There aren't other devices combining reasonable security with proper alternate OS support.

2026-07-04 12:08:22 UTC

- reply

There are a bunch of companies selling phones with GrapheneOS preinstalled includiinng NitroKey. It's very easy for people to install it themselves without being technical via https://grapheneos.org/install/web. That's what we recommend since it saves people a lot of money and they don't need to rely on someone else doing it.

2026-07-03 08:59:33 UTC

- reply

> Is it possible to take away from all apps by default?
That could be added as an option.
> Also now enabling local network requires granting nearby devices which would allow bluetooth beacons too right?
Yes, when the app asks for it from the OS. We would have implemented it as a separate toggle but they prefer minimizing the number of toggles over providing these kinds of useful distinctions. We could split it out later or add another way to do it.

2026-07-01 22:54:40 UTC

- reply

If you're not on Android 17 then every app with network access has local network access.
If you're on Android 17 then apps targeting Android 17 lack access to local networks by default. Apps not yet targeting Android 17 can now have it taken away after installation.
GrapheneOS can eventually remove the backwards compatibility mode in a couple years. It doesn't make sense to immediately drop it and break compatibility with apps which aren't behind on target API level.

2026-07-01 22:51:43 UTC

- reply

Android 17 disallowed apps without the Nearby Devices permission group from accessing the local network. For backwards compatibility, apps not yet targeting Android 17 are allowed to access the local network by default. No additional access is granted to apps compared to before. Targeting Android 17 eliminates the compatibility mode. Apps on the Play Store will be required to target Android 17 in around a year. This is how Android does backwards incompatible improvements.

2026-06-29 18:10:42 UTC

- reply

We said GrapheneOS is anti-authoritarian, not apolitical. We oppose authoritarianism and ethnonationalism. You're misrepresenting and twisting what we said to an extreme degree. We strongly oppose fascists and we also oppose tankies too. What is the problem you have with that?

2026-06-27 23:47:11 UTC

- reply

We don't usually allow much political discussion in our community unless it's directly related to GrapheneOS. Today has been a very good demonstration of why that's the case. Many people are unable to tolerate even a minor disagreement on semantics without being absolutely enraged about it.

2026-06-27 23:37:46 UTC

- reply

Our beliefs are not defined by what people who use GrapheneOS or donate to it believe. We decide what's acceptable within our community and we do a lot of moderation. We don't police what's done fully outside it. We clearly won't only have users, donors and supporters with beliefs aligned with ours.

2026-06-27 22:11:40 UTC

GrapheneOS opposes authoritarianism. It's a core part of why we're building privacy technology as part of a non-profit open source project. We're opposed to it regardless of whether it comes from left, center or right. The flood of people lying about what we believe and have said won't change this.

2026-06-27 20:50:34 UTC

- reply

We did say we opposed the donation to this party and what they stand for but we clarified they don't seem far right but rather an ethnonationalist leftist party. Someone here is saying they're phony but they were in left parties for years prior and still support most of it.
catraxx has repeatedly blatantly misrepresented and outright lied about what we said with the clear goal of causing harm to GrapheneOS. He has been doing it from before here. He's also actively promoting /e/ with it.

2026-06-27 20:47:17 UTC

- reply

CalyxOS lags far behind standard AOSP on updates and privacy protections. They bundle a bunch of problematic apps/services reducing privacy. It has never been a privacy or security hardened OS. It heavily has recently moved more towards being a branded fork of LineageOS with a bunch of bundled apps/services including granting problematic privileged access to many of those those. An AOSP or especially LineageOS fork marketed as private that's less private than AOSP isn't privacy hardened.

2026-06-27 19:35:23 UTC

- reply

/e/, Murena and their supporters have spent years misleading people about the GrapheneOS project for profit. Their business is based around misleading people and steering people away from GrapheneOS is part of it.
The false attacks you're spreading on us are an example of a company and their supporters attacking us, not the other way around. You're spreading libelous claims from people who are supporting these efforts to marginalize us:
https://grapheneos.social/@GrapheneOS/116353973732143171
#note1r96…za7j

2026-06-27 19:28:26 UTC

- reply

Mullvad sponsors other open source projects including with large donations. The sponsorship of GrapheneOS is paying for 2 servers from DataPacket for us.
Someone left a reply to our thread about Android 17 being rolled out to Stable attacking us for Mullvad sponsoring us. We tried to have a discussion about it similaly to what we're doing here, but he was focused on attacking us and kept misrepresenting our statements. He then turned it into a public attack on us.

2026-06-27 19:22:16 UTC

- reply

Mullvad is the main VPN we've directed people towards using on technical grounds and they reported Android VPN leaks to us which we fixed. Mullvad is one of 5 companies currently providing sponsored dedicated servers for GrapheneOS. More companies have offered so that will grow.
Mullvad's co-founder made a donation to a fringe highly anti-immigrant party which was founded by people who split away from the Swedish Left Party. We don't support their political views.

2026-06-27 16:52:28 UTC

- reply

Contrary to the impression the person who made this thread is trying to give, we definitely don't support the party one of the Mullvad founders donated to and he's misrepresenting what we said. We assumed it was in good faith and responded as such but it quite clearly wasn't.
CalyxOS has never been in the same space as GrapheneOS. It wasn't a privacy or security hardened OS.
https://eylenburg.github.io/android_comparison.htm
It's now more heavily based on LineageOS and further from a hardened OS than it ever was.

2026-06-27 13:30:23 UTC

- reply

You very blatantly lied about what we said in a manipulative attack on us and refuse to retract it.
> instead you here you are, defending Mullvad
That's not whwt we did. We corrected the claim that they're a far right party.
> you also seem to think they're tankies
We think the party which others have said one of the Mullvad founders donated to is a racist, anti-immigrant and tankie adjacent party. We're strongly opposed to that and we haven't posted anything defending that party.

2026-06-27 13:22:07 UTC

- reply

Meanwhile leftists are largely fine with mass ethnic cleansing as long as it's Russia, China, etc. doing it. Did the USSR not exist in your version of history?

2026-06-27 13:15:06 UTC

- reply

They're an anti-immigrant and racist leftist party. We looked into what we were told about and found that they're a very local (7th largest city) racist socialist party combining Marxism with Swedish nationalism. If what we were told is that it's a racist anti-immigrant party then we'd agree with that from what we've read about them. That isn't what we were told, you linked a post saying they're far right and we found something quite different when we spent an hour looking into it.

2026-06-27 13:12:27 UTC

- reply

They're leftists with very clearly left wing domestic policy. They have traditional leftist foreign policy including being anti-Ukraine, anti-NATO, supporting the Cuban government and more. The foreign policy of far left and far right in Europe has a lot of similarities but there are some stark differences.
We read some of what they say about the political classes, office workers, etc. being parasites and also immigrants who they claim are brought in by those people to support them.

2026-06-27 13:05:12 UTC

- reply

A party heavily based around Marxism with left wing domestic policy and tankie adjacent foreign policy is not a right wing party just because they're racist. If you can't be honest about what they are or what we've said then there's little point in bringing this up. We did look into this and an found anti-immigrant socialist party espousing Marxist views combined with nationalism. Leftists can be anti-immigrant and racist. Claiming they're far right is just lazy and inaccurate.

2026-06-27 12:46:28 UTC

- reply

We never said anything of the kind. This is what we said:
> The light amount of foreign policy from this party strongly indicataes they're actual leftists [...]
Either you don't know what foreign policy means or are deliberately being dishonest about what we said. Based on your other response, you know what foreign policy means and are being dishonest.
We looked into this and contrary to what was linked found it was a leftist party split from a socialist party.

2026-06-27 11:51:07 UTC

- reply

Leftists can absolutely be racist and anti-immigrant. That isn't a right wing concept at all. The light amount of foreign policy from this party strongly indicataes they're actual leftists and not right wing people taking on left wing positions as part of populism. The USSR absolutely committed a bunch of population transfers, genocides, etc. and what this party is advocating fits right in with it. It's not something owned by the right wing.

2026-06-26 23:08:32 UTC

- reply

We did look into it and quickly determined that it's a very local left wing party which split from the socialist Left Party. It's a municipal party in the 7th largest city right now. They're combining Marxism with anti-immigration nationalism. It's definitely not a far right party. Their views on nearly all domestic policy are leftist. Their foreign policy matches the European far left more than the European far right, although those are similar in a lot of ways.

2026-06-26 19:46:51 UTC

- reply

The 2 sponsored servers we have from Mullvad are with DataPacket. Our DataPacket account for this is a sub-account of Mullvad's account. They have around a 30% discount on the hardware and traffic but DataPacket is very premium so it's still fairly expensive. DataPacket has fantastic transit and private peering including having DTAG peering which is very beneficial to our German users. No more slow downloads due to DTAG's congested links with transit providers.

2026-06-26 00:23:51 UTC

- reply

We run our own CDN for privacy and availability reasons. Our main services have fantastic uptime.
The 2 DataPacket servers sponsored by Mullvad bill 95th percentile bandwidth usage. We have 3Gbps commit for Frankfurt and will likely need more this month but it can be paid as one-time fee for this month instead of raising the commit. The rest of the servers are sponsored by server providers and our traffic spikes aren't a big deal for them especially since it's spread throughout a day.

2026-06-26 00:10:31 UTC

- reply

Our update servers are sponsored by Mullvad, ReliableSite, Cherry Servers, Zare and Xenyth. You can see those here:
https://grapheneos.org/articles/grapheneos-servers#releases.grapheneos.org
The screenshot shows bandwidth usage for Frankfurt with staggered rollout to 10th gen, then 9th, then 8th and finally 7th+6th together.
https://grapheneos.social/system/media_attachments/files/116/813/503/997/088/027/original/1099199c1eddb307.png

2026-06-25 22:55:36 UTC

- reply

2026062300 is now available in Stable for all of the supported devices. Bandwidth usage in Frankfurt is now at 20Gbps and the other locations have also increased a similar proportion. We'll need more update servers within a year or two but we have enough to avoid staggering the largest updates.

2026-06-25 22:44:52 UTC

- reply

It will stop enforcing certificate transparency after the log lists are outdated by more than 70 days resulting in reduced security for HTTPS and other TLS connections made by apps using enforced certificate transparency. Close to nothing used it in Android 16 but it's enforced by default for targeting Android 17 or later.
Why are you concerned about downloading these static files in the first place? The only thing us hosting it achieves is making people feel better anyway.

2026-06-25 19:48:57 UTC

GrapheneOS update downloads are usually around 20MB to 80MB when updating from a recent release. The download for updating from our final Android 16 QPR2 release to Android 17 ranges from 620MB to 760MB depending on device model. We're in the process of rolling it out to the Stable channel now.

2026-06-25 17:23:27 UTC

- reply

Some users have reported seeing a connection to www.gstatic.com when the device starts charging which is due to certificate transparency logs being fetched. We've been planning to review certificate transparency log updates for a while but hadn't gotten to it yet. We'll have our own approach soon.

2026-06-25 15:57:51 UTC

Download Manager is an Android component handling long-term HTTP(S) downloads for apps in the background. Apps with the INTERNET permission (GrapheneOS Network toggle) can offload their downloads to it. Download Manager doesn't trigger any connections itself.
https://developer.android.com/reference/android/app/DownloadManager

2026-06-24 18:11:19 UTC

- reply

A bunch of apps have added explicit support for GrapheneOS due to pressure from our users. Our userbase is rapidly growing and we'll gain the ability to apply massive pressure to companies doing this. We plan to ship a feature for our Info app for people to opt-in to getting asked for their help.

2026-06-24 17:53:36 UTC

Hyundai and Kia added official GrapheneOS support to their apps months before Volkswagen banned GrapheneOS:
https://discuss.grapheneos.org/d/31697-myhyundai-app-has-official-grapheneos-support
Pressure from Volkswagen customers on them can achieve the same thing. There's no legitimate reason to ban GrapheneOS so they'll undo it with pressure.

2026-06-23 15:55:37 UTC

Google shipped an out-of-band update to droidguard breaking using RCS with sandboxed Google Play. We've already fixed it and it will be included in the OS release we're making later today (2026062300). That will likely be our first Android 17 to reach our Stable channel.
https://github.com/GrapheneOS/platform_frameworks_base/pull/385

2026-06-23 15:45:35 UTC

- reply

Pixel 6a is still fully supported and the latest release of GrapheneOS was moved to the Alpha channel in the past hour. See here:
https://grapheneos.org/releases#devices
The initial 2 releases didn't make it out of the special Experimental channel we created for the initial Android 17 release. We didn't want to release it to the Alpha channel available via the standard System Updater user interface until after we resolved the most worst regressions to avoid complaints from people using Alpha.

2026-06-19 16:46:36 UTC

- reply

Your statement about protecting devices from data extraction is incorrect. They're not going to bypass data encryption. The way they get people's data is exploiting the device in After First Unlock state or by brute forcing the PIN/password. GrapheneOS heavily protects against exploit protections leveraging hardware security features. It also automatically gets back to Before First Unlock state via a locked device auto-reboot timer and memory wiping.

2026-06-18 14:38:16 UTC

We built an initial release of GrapheneOS based on Android 17 (2026061700) but aren't going to release it through our Alpha channel due to discovering a serious upstream bug. Android 17 broke support for sideloading updates via recovery unless the OS images are large enough to exhaust COW space.

2026-06-18 12:04:42 UTC

- reply

Vanadium doesn't tie WebAssembly being available to the JIT being enabled. The JIT toggle is a performance (enabled) vs. security (disabled) toggle for reducing attack surface. Toggling WebAssembly, WebRTC, WebGL, WebGPU, etc. are going to be separate toggles. Vanadium uses the DrumBrake WebAssembly interpreter when WebAssembly is enabled but JIT is disabled so everything works, just slowly. WebAssembly will be another toggle because it has a lot of attack surface..

2026-06-15 00:22:13 UTC

GrapheneOS Speech Services version 3 released:
https://github.com/GrapheneOS/SpeechServices/releases/tag/3
See the linked release notes for a summary of the improvements over the previous release and a link to the full changelog.
Forum discussion thread:
https://discuss.grapheneos.org/d/36408-grapheneos-speech-services-version-3-released
#GrapheneOS #privacy #security #android

2026-06-08 04:30:21 UTC

- reply

Why use LineageOS forks with worse privacy and security than LineageOS? That's not to say that using LineageOS is a reasonable choice for someone who cares about privacy, but it's a better choice than these LineageOS forks in many ways. These forks being marketing as privacy products doesn't mean they're more private than the LineageOS project they're forking and it's generally the opposite in a bunch of ways. It also doesn't mean they provide reasonable privacy.

2026-06-06 16:57:38 UTC

- reply

We believe their intent is helping people improve their privacy but they're poorly informed and are largely doing the opposite. Companies claiming their products are private and secure doesn't make that true. It's usually not true.
Every person who follows their advice to buy one of those products is going to have far worse privacy and security than an iPhone user. Their data will be far more easily obtained through privacy and security weaknesses. That's not progress.

2026-06-06 15:45:11 UTC

- reply

We're informing you the article you linked is highly inaccurate. It contains many verifiably inaccurate statements. It's promoting using a bunch of products missing bare minimum privacy and security based on the marketing materials of the companies. Nearly everything it's promoting people use is drastically less private and secure than an iPhone. Products missing very basic privacy and security patches/protections are not a good choice for privacy.

2026-06-05 14:51:15 UTC

- reply

There's no other alternative OS available for Android devices keeping up with standard privacy/security patches and protections. There's certainly none greatly improving privacy and security with major enhancements as GrapheneOS does.
Privacy and security is getting much worse. Vulnerabilities are dense and becoming much easier to find and exploit. There are many alternatives to mainstream operating systems but not ones with reasonable privacy and security at all.