Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

GrapheneOS isn't made by volunteers. They have a team of around 10 paid developers. They are a nonprofit foundation that receives donations and uses those to pay developers, infrastructure etc.

Ars Technica has update its article to rectify that mistake. It doesn't mention that anymore.

It’s still a valid question. We have this huge corporation that’s doing so many things, constantly lobbying for policy, obscene revenue all while people are exploiting the apk out of their OS.

In fact, looking at the news this week, the same question applies to Microsoft and Apple as well. Are they too big and distracted to care about security?

Are you affiliated with the project? I see all your posts are about Graphene OS. On HN it is customary to state it: you often see "author here" in discussions where the author joins. If you are part of the team I would suggest against using the third person ("they have a team...").

I know strcat is the lead Graphene OS developer, and it seems you and Andromxda are very knowledgeable about the project and very active on this thread.

it might be that guy who uses different accounts for different topics

No, it's just that the user will not put up with a system like GrapheneOS.

> In fact, looking at the news this week, the same question applies to Microsoft and Apple as well. Are they too big and distracted to care about security?

Yes, of course they are, but its more rational than just being distracted. If not caring does does not lose you a significant amount of revenue why should you care? The same applies to big players in the industry with regard to security and quality in general.

In this case they have something to gain by keeping phones open to software used by government agencies.

GrapheneOS is literally an OS made specifically with security in mind. They have countless contributions that were later merged into upstream improving the security of all the Android OSs, including hardened malloc and similar.

For many experienced software engineers Microsoft has had a reputation for poor software engineering when it comes to security, reliability, stability, scalability for 30 years.

Google generally has the reputation of doing much better in those areas.

Not sure what would be objective measures to compare.

Google has many, many government contracts.

I believe that they would face enormous scrutiny in multiple contexts if they adopted Graphene as the next version of Android.

Google also wants Play and GMS to have complete control of the device for their own selfish reasons. I do not see them willingly sandboxing their own control.

So I can think of a few reasons.

> If not caring does does not lose you a significant amount of revenue why should you care?

Sounds like it's time for heavy regulation. These corps are not "normal" businesses anymore, I think special (and stricter) rules should apply to them.

How so? Graphene is perfectly useable for a non-technical user. And once you install Play Store, it's almost indistinguishable UX-wise from any other Android phone.

I don't think you can rule out international government pressures to keep these OSes vulnerable.

I agree that not caring happens a lot in the industry. Plenty of places where you'd think security was a high priority shockingly it isn't. Instead, C-levels will dedicate just enough resources to pass security audits clients demand and not a a penny more.

It's literally ONE click away from the GrapheneOS main page, lol, the literacy levels gone through the floor.

https://grapheneos.org/history/

> GrapheneOS now has multiple full-time and part-time developers supported by donations and multiple companies collaborating with the project.

This is beyond being just shockingly, willingly ignorant and this is out there re on the open, so in the spirit of your own response, I would suggest you admit your comment is a hit piece from their infamous competition.

Of your favourite search engine is broken too, here's the link anyone can read: https://grapheneos.org/history/

They are hard to regulate and I really doubt governments have either the willingness or the competence to do so effectively. The businesses are very heavily motivated to find ways around regulations, or manipulate them to to their advantage.

Regulation is a very poor substitute for competition, and for well informed customers.

Some of what I said in this comment is relevant: https://news.ycombinator.com/item?id=45780529

I am not debating what tranq_cassowary and the other two users are writing: it seems all correct (from what I can verify) and useful. I am just suggesting that they disclose their affiliation, if there is any, as a good transparency practice.

I myself am not affiliated in any way with their "infamous competition", not even as a user of their software, so I have nothing to disclose. (Actually, I am a Graphene OS user.)

Don't you remember when Satya Nadella was called in front of a congressional hearing to explain their numerous security breaches? So yeah..

Apple is a different story, but they are not invulnerable to cellebrite either

Yes because government regulation when ur comes to technology never makes the situation worse. What are the chances that the government is going to pass laws to increase user privacy and security?

Especially with the current administration that is all about grift and publicly accepting bribes - see Paramount, Disney, Google, Meta, Apple. Twitter

Put up what exactly? You think privacy and security is readily available to everyone who just desires so? If by "put up", you mean not even putting normal efforts, then sure. That user, along with you, fully deserves to get tracked, profiled and fingerprinted to the maximum extent of mass surveillance

He's a fucking ignorant normie. He has never even tried to install GOS because if he did, he would know how almost identical the experience is with Android and there are no privileged google processes running on your phone which not only hog the resources but sends every single bit of information about your whole life

Not sure if any big conspiracy is needed.

Financial pressures cause this to happen well enough on its own.

The marginal gain from making a really secure phone is outweighed by the engineering cost and degraded user experience. (General public would rather the phone support every streaming video and graphics format under the sun than just a few securely implemented ones).

When was the last time you saw a FIPS mode option on a home WiFi router? Or even just the ability to turn off internal services? Oddly, just a single option to disable all management would often by useful and fairly trivial but never exists…

> Regulation is a very poor substitute for competition

I've been following tech for my entire adult life. For more than 30 years now, competition or waiting for customers to become informed has never worked.

The only tools we have against mega corps are the ones the EU is currently applying via DMA and similar. But it will take a global effort in order to permanently shift priorities towards "earning money while doing the right thing" (as opposed to "earning money" state of today).

Corps like Google, Apple and friends are more similar to countries than businesses. The only problem is, international law and political pressure doesn't work on them as they're similar to countries governed by cartels.

“Install an OS on your phone” is nonsensical to 99.99% of users. You’re in a tech bubble.

I'm not talking about installation. I'm talking about using the OS once it's installed.

It’s a distinction without a difference when Graphene is installed by zero OEMs.