I agree that this is an issue, but it is impossible to prove a negative. The same could be said for Apple's or other manufacturer's signing keys. Who guarantees that the US government hasn't required access to the iOS signing keys? Or China in exchange for access to the Chinese market? They probably wouldn't even want to reveal that the signing keys were leaked if they were allowed to, since it would undermine their security story.

With a non-profit project of highly principled security experts, there is at least a high probability that they'd rather blow up the project than compromise. People elsewhere in the thread criticize Micay because he deleted the CopperheadOS keys, but to me it increases trust in the GrapheneOS project, since he clearly puts the security of his users over money, fear, and whatnot.

In the end trust arises from running a project or company long-term without evidence that you somehow compromised security.

I wonder in general how this situation could be improved. Second or third independent reproducible build + confirmation signing?

All of the defensiveness is warranted. They speak neutrally and objectively.

The project is not going to relinquish control to any 3rd party. Not even the Motorola partnership is given control over the GOS project. The hypothetical you describe is not possible by design.

The GOS project takes no issue with critical thinking, and encourages it. But that is often used as an excuse to handwave attacks. There is a very big difference between criticism/critical thinking and attacking them.

Note that there are more individuals in the project than Micay. Multiple people handle multiple responsibilities, its not one person.

> The GOS project takes no issue with critical thinking, and encourages it. But that is often used as an excuse to handwave attacks. There is a very big difference between criticism/critical thinking and attacking them.

Responding to attacks so defensively is almost alway a bad look for organizations. They could really use a PR person with a more measured voice that corrects facts and projects confidence, and does not convey victimhood, insecurity or defensiveness. Take a look at the tone of press releases issued by companies when some tech press bozo writes a hit piece on them, for good examples of dealing with people attacking you.

I would not use those words to describe the approach they take. They make the effort to speak neutrally and objectively, but the issues they are making light of are often exactly as extreme and common as they describe. Many people have voiced appreciation that they decide against a "corporate-speak" approach. The GrapheneOS accounts are meant to be accounts that let project members speak to users, rather than take on a corporate appearance.

I'm sure you realize that confident assurances of a random new pseudonymous account on a Web site isn't sufficient for anything of importance.

Is there an authoritative source of information about how a takeover like that isn't possible by design, which people can verify, analyze, hold parties accountable for the pieces that require it, etc.?

I am a GrapheneOS user and community member, and I am active in the chat rooms. I made this account to assist with misinformation.

As for how such a thing would not be possible;

-GrapheneOS updates do not trust the network, so any compromise of update servers for OS and app updates would not be able to push malicious updates. Only those who hold the signing keys are capable of pushing updates that will be accepted.

-Multiple people review the code that gets included in the OS. There is not one point of failure when it comes to social engineering.

-GOS supports reproducible builds, so the code that is published can be verified to be the code that is built for the official builds.

So in other words, you would need to convince multiple people who are consciously protecting against this, and who have a proven track record of burning the keys if the privacy and security of their users are in jeopardy. On top of that, you need to conceal this from every developer, moderator, and community member who would raise the alarm at the slightest indication of compromise.

They are not neutral and objective, they're extremely hostile, especially (and ironically) to other projects that share similar goals. Key developers quit CalyxOS after harassment from GrapheneOS/McCay.

https://recapio.com/digest/grapheneos-documenting-numerous-a...

Calyx Institute and GrapheneOS are both really great projects. I support them both. I rely on products from both.

You're not doing either project any favors by pretending that hastily generalizing nerd dramas and autism over-corrections is somehow a broad statement on the neutrality and objectivity of GrapheneOS's team or the high-quality product it produces.

This kind of bad faith posting is bad for the whole FOSS/libre community, and it's both dumb and rude, in contradiction of HN's site guidelines.

The author of that blog got mad we didn't want to implement a feature they wished for. Their duplicate issue was closed and later deleted and they made a public drama out of it for... what reason?

Let me tell you something. I personally reached out to them just a few weeks ago. I didn't argue, I didn't blame them. That was not my intention and I communicated that clearly. Those were not empty words, I went into it with a genuine open mind and with the goal of finding a solution. After all they consider themselves an open source enthusiast.

It didn't go anywhere. They did not seem willing to discuss anything at all really. You see, even if we assume they are 100% in the right, i.e. they did nothing wrong, why would they oppose our attempt at resolving the conflict? I've come to the conclusion there is no good faith argument to be made here. They spread their post all over the internet, heck they even linked it on Facebook.

Not a sock, just finally annoyed enough to actually login and say something.

I can see you can't engage about this without hurling wild accusations, so peace out.