News for hackers. Stuff that matters.
Re:Motorola GrapheneOS devices will be bootloader unlockable... by galangalalgol on Wednesday March 04, 2026 @08:27AM (#47247103)
What should that support look like? Maybe have a userdebug build already built and available? I don't include a root account on hardened container images for some of the same reasons they cite. So including it for everyone and creating a way to activate it is suboptimal for people who don't want that trade off. A parallel build pipeline seems the most reasonable to me?
Re:Motorola GrapheneOS devices will be bootloader unlockable... by kevincox on Wednesday March 04, 2026 @08:34AM (#47247188)
Yeah, I would be fine with a different build stream. I do think it could be sufficiently secure in a single stream but it will always be increased attack surface so the safest option is to do separate builds.

I also don't include a root account in my container images, but you probably have a root account on the sever that runs them in case you need to debug something. But you can probably also build and deploy a new container. At the end of the day you almost always want some last-resort way to access the data stored in case something goes very wrong. Whether that is for backups, "hostile" data export or for other reasons it is important to me.

Re:Motorola GrapheneOS devices will be bootloader unlockable... by galangalalgol on Wednesday March 04, 2026 @09:09AM (#47247564)
I don't actually. Devs don't get root at my employer. Even on a vm. I have rootless podman, and can be root in a container. Even our gitlab instances don't have any privileged runners. So kaneko etc.