More like the coordinates of a home were burned to protect its occupants. It was a practical choice, not an ideological one.

If you own something you can do what you want with it including rendering it useless

If you own all of it, yes. If you only own most of it, the minority owners do have some rights -- just fewer than you do.

Micay owns the whole project. Ownership of the project was not exchanged or divided, part of the explicit terms of the agreement were that Micay would hold the keys and ownership of the project just as they always have.

Sure!

Thats a characteristic all modern OSs and modern apps have. You need to trust the key holders, always. Some people make their own builds for this reason. Depends on tge threat model.

> Immature maybe

Yeah, that’s the issue. I don’t want people who behave immaturely, impulsively, or vindictively, having a key role in something as important as my phone os. I want stability, maturity, and thoughtfulness.

That is what CopperheadOS, and now GrapheneOS, provides. Its a level of "battle tested" that most OS and app devs never have the opportunity to have. Deleting the signing keys during a hostile takeover attempt rather than submitting to pressure or greed is an amazing quality that is rare to find. Nobody behaved or is behaving immaturely, impulsively, or vindictively.

Understandable wishes, but you might have to put something from yourself into it if this is a pressing concern. Or you will be left to your own corporate devices.

What exactly are you suggesting? If i go help out at the graphene os project, that won’t change their leadership. Should I make my own fork?

The GOS (GrapheneOS) lead had responded to criticisms like yours that he gladly retreats inside his tech role if others would take it upon them to refute the claims from rivals. So if you are that balanced, normal person, you could take that work out of his hands. Or help fund a full time PR person.

«In 2018, matters between Micay and Donaldson came to a head over Donaldson’s desire to pursue business deals with criminal organizations, and his attempts to compromise the security of CopperheadOS, including by proposing license enforcement and remote updating systems that would allow third-parties to have access to users’ phones. As part of this process, Donaldson began to demand that Micay provide Donaldson with the “signing keys” - i.e. the credentials required to verify the authenticity of releases of CopperheadOS. Donaldson advised that, in order to secure certain new business, potential customers required access to the Keys.»

Micay is rightfully paranoia, just having a GOS phone makes some government agencies quite mad. There are many ways a project like GOS could die, disinformation could certainly kill it. Other projects don't help the case if they throw mud at it. Rather, they should focus on their real technical shortcomings, but such articles aren't written somehow. https://eylenburg.github.io/android_comparison.htm

EDIT

  > Should I make my own fork?

You could contact him to offer your help where he falls short.

Micay is not paranoid. Paranoia implies unsubstantiated fear. But they acted responsibly under pressure and the project is upfront with what happened to the public and to journalists alike.

Ah yes, i’ll definitely be volunteering my time to help with something i have no experience or qualifications about. Great idea.

The leadership is great. Persistent, patient and friendly.

They were able to improve. I don't think many of the often negative and ad-hominem critics would be able to endure such a pressure as they had in the past.

Then avoid GrapheneOS

Mental health and wellness issues in high tech research and development are everywhere. I would suggest that you focus on the product and what it can/cannot do for you.

Suggest away. It’s still a factor in my decision making, because if I can’t trust the developers to behave well, i can’t trust the product to continue to do what it says it can do for me.

They have proven to "behave well" for years. Destroying the signing keys in the midst of a hostile takeover is the responsible thing to do. Its for the safety of their users. Thats a commendable trait to have.

What does it means to "behave well" for you in this case ?

Same, which is why I'm glad he deleted the signing key in this case. It was the only right play given the situation. I'd have done the same and I'd expect anyone with integrity to do likewise.

> if I can’t trust the developers to behave well, i can’t trust the product to continue to do what it says it can do for me.

So you'd be willing to give up Linux because Linus cannot stop verbally abusing people to this day? Because that's what I did. I decided that any project where the main dev(s) openly abuse people in public, is the line I draw.

I know that is an extremely controversial choice that many people will disagree with, but it's my choice to make and I don't regret it.

None of the GrapheneOS development team is mentally ill or unwell.

When you have to trust the OS images generated by the authors it becomes a massive issue.

You always trust the developers of software. The only way to stop that is to not use the software.

I trust you didn't mean it that way, but it's totally improper to go to speculations about mental health in response to discussions about communication styles and maturity.

While I appreciate the second line and think it's generally the right answer with FOSS projects, your speculation poisons the well.

> > Daniel Micay has a history of absolutely unhinged behavior online

That quotation is from another comment in this discussion. Sadly, it is the sort of personal attack on his mental state that has been commonplace here at HN and elsewhere for a long time. I caution all to avoid such commentary. My long experience in tech r&d has firmly convinced me that mental health and wellness challenges are widespread, and should not be weaponized. I hope that clarifies my comment for you.

It does, thank you.

The path to maturity requires immaturity.

So what exactly would you have done? Risk the key being taken over by a shady entity? Does the alternative really scream "mature, stable, and thoughtful" to you?

It looks like a very mature action to me: It certainly avoided the compromission of an OS that aims to be secure after all. It is not some windows OS with encryption keys sent to the cloud, so if security is compromised I fully expect targeted devices to break.

Things aren't only bad if they're illegal. There's plenty of bad things one can do that are perfectly legal, and plenty of good things one can do that are totally illegal.

And there are legal remedies to create deterrents without a court. Boycotts, journalism or new competition.

It's not clear to me that causing "financial damages" to the person described is even a bad thing.

If you prevent your grandparent from getting scammed, you've caused financial damages to the scammer.

Deleting the signing keys for the sake of protecting ones users is the mature and responsible thing to do.