Thread

1. wps · 1789760710 · focus · HN ↗

   The amount of roadblocks Google is putting up for GrapheneOS is just ridiculous. None of their decisions make any sense, from the delayed source patches upstream, to the embargos, attestation issues, etc. Google simply regrets android being open source.

   1. Retr0id · 1789761534 · focus · HN ↗

      Google is also seriously dropping the ball in terms of security. The CVE-2026-43499 root LPE (aka ghostlock) is still unpatched across all Pixel devices, on the latest """security""" update, despite weaponized exploits being public for months.

      1. grapheneos · 1789763587 · focus · HN ↗

         Pixels used to have far better updates than any other Android devices but they stopped improving it years ago. It should have kept improving because it's not at all adequate. They need to be able to release OS updates more than once per month and it shouldn't take months for patches to make it into the OS. It currently takes them at least around 2 months to get even the most urgent patches into the OS. They could fix emergency calls being broken if the patch was made around 3 weeks before an OS release, but that's about as quick as they can go. It's not at all adequate for security and is a complete joke compared to Chromium's release cycle. They can get an emergency Chrome update released within a couple days. They should at least be able to do it for the Pixel OS in a week.

         GrapheneOS is often around 4 to 6 months ahead on merging Linux kernel LTS releases. We used to handle this ourselves but switched to the Android GKI LTS branch maintained by Greg KH. Unfortunately, it was often struggling to keep up even before the absolutely massive increase in Linux kernel security patches this year. AI models have rapidly accelerated vulnerability discovery and it's an ongoing crisis for the Linux kernel. We want to be on the latest LTS revision within days and want to be using the latest LTS branch within months of it being released. We're not at all happy with how Android is handling things and plan to fix that ourselves. We'll get things back to how they should be.

         We also ship all the AOSP userspace patches months before Pixels due to shipping all of the security preview patches as soon as possible. There are sometimes minor regressions but we find and fix them ourselves downstream. The security preview system has a terrible design especially considering that frontier AI models can reverse engineer the patches. There should at least only be a source embargo for around 24 to 72 hours rather than pretending as if it can work with the patches available 2 to 6 months in advance.

         1. cyberax · 1789766073 · focus · HN ↗

            I'd love to use GrapheneOS on less secure devices, just for the sake of Google autonomy rather than privacy.

            1. mitxela · 1789779609 · focus · HN ↗

               You can dot his but it won't be Graphene but something else, like LineageOS. As long as Graphene's selling point is extreme privacy and not just more privacy, it will be this way.

               1. drnick1 · 1789798542 · focus · HN ↗

                  There is no such thing as extreme privacy; it isn't something any phone can provide, especially if you are going to rely on third party software and services like email and instant messengers where the likes of Google and Facebook are dominant players. Even behind a VPN, Vanadium is fingerprintable by commercial trackers like fingerprint.com. Short of disabling Javascript, browsers leak enough information to basically follow anyone around the internet.

                  1. mitxela · 1789822477 · focus · HN ↗

                     How much do you know about Graphene? It literally disables JavaScript JIT for security.

                     1. drnick1 · 1789926659 · focus · HN ↗

                        > How much do you know about Graphene?

                        Enough to know that it is just as fingerprintable as any other phone. Disabling Javascript JIT will not change that.

Unofficial Hacker News client; not affiliated with Y Combinator.