Why do you think you can trust Graphene OS devs?

GrapheneOS is a project rather than just a few devs. They have exhibited very high focus on security and peer review before commits. The code is FOSS and heavily audited by the most paranoid people like me. It is one of many AOSP projects with a relatively small user base. Therefore it is not a valuable target for compromise or coercion from threat actors.

Apple on the other hand is the biggest corporation in the world beholden to governments, closed source, and with a massive user base.

If you enable automatic updates, you still have to trust that the GrapheneOS devs won’t push a malicious update to your phone, or sell that ability to someone else.

Yes some trust of the project is required. Consider what would motivate them to do something malicious. They do not know who is using the OS since these phones are anonymous and the user base is relatively small. Neither targeted surveillance nor bulk collection is really possible because of this.

The code is completely open source. With the most paranoid of us using and reviewing the code, any malicious code inserted would immediately kill the entire project. We can install and switch to another OS anytime we need to.

Why do you think you can trust the hardware? What about E911, etc.?

Yes we are using the same closed source hardware as 99% of people. Open source HW is ideal, but the options are currently very limited. I use rotating burner SIMs on occasions when I need cellular and never make calls with the SIM. The OS provides other SW mitigations for the HW such as no SW access to the device ID's, fine grained app firewall, and ability to turn off all cellular but enable WIFI.

Can you set my mom up with a Graphene phone? And deal with the inevitable support?

I think I’ll keep recommending Apple to 99% of people.

I think the better argument is the sibling question about why would you believe you can trust the Graphene developers more than you can trust Apple. Certainly Apple has far more to lose by being shady.

Apple also has infinitely more eyes looking at it.

Nobody is going to get a huge PR boost by finding a major security flaw in Graphene OS. But if you find a remote zero day from iOS, you're going to be rich and/or famous instantly.

> Nobody is going to get a huge PR boost by finding a major security flaw in Graphene OS

Among the public, no. Among the security community, yes.

That’s fair.

I also know which of the two could resist the FBI more than the other.

Can you not do it, why do you need some random person on HN to do it?

It was a rethorical question on their part. But they missed the point of a use case for one person doesn't mean a use case for everyone (his Mother). They were saying they want a plug and play option for family members cause they're the tech person in their lives it seems.

GrapheneOS has like step-by-step instructions that are pretty easy for almost anyone with maybe like a 6th grade comprehension to follow.

You expect the same people who don't even read the error popups they get to follow step-by-step instructions to install an alternative OS on their phone?

I love your optimism :)

You mean a person with early onset Alzheimer's? Yeah, even with an iPhone they are going to get scammed by robocallers, family, and friends.

Can you describe your phone and software setup? I’ve installed lineage before but lately have been a little stuck deciding on my next open phone. I’d like to be able to install microg. I don’t plan on necessarily using this as a daily phone all phone but have some medical automations that rely on Bluetooth and in a perfect world could have some water resistance or waterproofing.

I use grapheneos.org on a Pixel phone. I have tried many AOSP variants. Graphene is hands down the most secure, private, and functional. Couple this with Nextcloud and you have a superior setup.

I like grapheneOS and it's streets ahead from any other effort in the area. The problem i have with it is that it's hard/impossible for your average joe to install it. A small thing but big when it comes to privacy in general

Compared to installing the other AOSP versions, I find Graphene install the easiest. Yes it does require following the instructions and setting some things right. If anyone is hesitant about doing that themselves, they could buy one preinstalled on Ebay or from nitrophone.

Do you know whether it’s compatible with microg? If so, what version of pixel are you running.

I’m familiar with adb.

I am not sure it is, but Graphene has an optional sandboxed Google Play Services that does not require signature spoofing and does not require a Google account. I have it installed on a work profile for some proprietary work apps that require it. My main profile contains all FOSS apps that use web sockets or Unified Push(Nextpush on Nextcloud) to deliver notifications.

There is the Google Play compatibility layer on Graphene, so you probably don't need microg - https://grapheneos.org/features#sandboxed-google-play

Yeah. The point is that you're a somewhat technical person to manage to do that.

Yes you need to know how to open a web browser and place an order online. ;) The self install is really slick. You basically set the phone into developer mode, connect it via USB to your laptop or another phone, and just follow the web installer steps.

I daily drive /e/ OS, I'm happy about it.

Very interesting!

They needed to release pro-privacy news to balance out the bad press re: AirDrop in China.

I'd love if there was someplace we could go to test this assertion instead of relying on unbacked statements.

I'm not saying it's untrue, but there is a lot of ambiguity in this claim as things stand. Are you referring to abuse of their monopoly power to censor speech? Abuse of same to compromise human rights? Nefarious trickery to subvert their own security model? Use of forced labor to assemble devices? Each is its own form of evil; the evidence for each ranges from beyond doubt to (afaik) non-existent; typing them out every time one wishes to discuss apple is daunting.

I'm as cynical as the next person - probably even more so. But, I have come to recognize that there is value in "pretending". It establishes what our societal values are, even if we don't live up to them. This allows us to critique the failures, and work towards a better world with fewer failings.

So, is Apple actually going to back down from this and respect that computing devices should fully serve the interests of the owner? Perhaps not, and likely not to the point of allowing end user customization, software modification, etc. But I'd much rather live in the world where we say that Apple should do so, and they nominally agree. Where we keep holding their feet to the fire, by pointing to the hypocrisy when they reference lofty values. The alternative is to continue down the path where we just accept Surveillance Valley's expedient panopticons, and they move on to destroying the next societal value they find inconvenient.