‹ BackHN Continuity

Thread

GrapheneOS has fixed the Android 17 QPR1 kernel performance regression

142 points · 102 comments · Cider9986

Loading the complete thread in the background. This saved snapshot is available now. Refresh

  1. LoganDark · · focus · HN ↗
    > We have rapidly growing resources and we'll handle it.

    This is such a rarity to see in today's world. I'm glad GrapheneOS is getting the support it needs. I wish that happened more often.

    1. [deleted] · · focus · HN ↗

      [deleted]

  2. 0fflineuser · · focus · HN ↗
    I was wondering what was wrong with my phone, i thought a reboot would fix it and forget to do it everytime.

    The lags are actually quite unpleasant and noticable, i wonder how it wasn't caught before the release.

    1. ncr100 · · focus · HN ↗
      [delayed]
      1. microtonal · · focus · HN ↗
        The linked post seems to say that Pixel 11 hasn’t received QPR1 so far and might not have this bug?

        Pixel 11 series received a bug fix release near the start of September 2026 with the 2026-09-01 patch level. That update wasn't Android 17 QPR1 and also doesn't include the September 2026 Pixel firmware/driver security patches. Perhaps they noticed this issue and cancelled it.

      2. pjjpo · · focus · HN ↗
        I had assumed this was just Google effectively "ending support" for my 9a by forcing some AI thing into my lowish RAM. I can't believe even the latest Pixel users are having this problem since I thought they actually QA those.

        Sorry but at this point, for me it is shame on every Googler for continuing at a company that has absolutely no interest in user experience anymore. It's on you, directly or indirectly.

        1. grapheneos · · focus · HN ↗
          It impacts the Pixel 6 through Pixel 10a. It will potentially never get fixed for the Pixel 6 and Pixel 6 Pro on the stock OS due to those now being past their guaranteed update periods. It's fixed in the latest release of GrapheneOS for the Pixel 6 through Pixel 10a and that's now available in our Stable channel.

          Early in the month, the Pixel 11 series received a partial September 2026 security update release. Those didn't receive Android 17 QPR1 on September 15th. Pixel 11 series users aren't on the latest major release of Android so they don't have the latest and greatest features. It's likely it was cancelled for the Pixel 11 series due to regressions but they still released it for the older generations of Pixels.

          1. pjjpo · · focus · HN ↗
            Thanks for the explanation! Wow releasing regressions only for older devices, that's something.

            GrapheneOS looks really good thanks for working on it. Unfortunately Google Pay is critical for me and it's unfortunate Google is gatekeeping that, but I will look on jealously.

  3. d2kx · · focus · HN ↗
    Usually I am the one making fun of people who have been claiming that "the new update made everything buggy and slow and reduced battery life" with every update for the past 15 years, but this time this one's actually real and hitting my base Pixel 8 hard. Hopefully the October update fixes it.
    1. garbagewoman · · focus · HN ↗
      Based on the timeframes in the linked post, it likely won’t
    2. grapheneos · · focus · HN ↗
      GrapheneOS users can update to the latest OS release to resolve it. It's now available in our Stable channel after making it through public Alpha and Beta channel testing.
  4. williamtell · · focus · HN ↗
    I'll be interested to see if downstreams of AOSP ultimately weaponize updates against Google. For the kernel that's a minefield but Google made plenty of stuff Apache/MIT to keep its options open..
    1. 306bobby · · focus · HN ↗
      As a custom ROM maintainer in that position, it's unlikely to cause a difference since Google has effectively monopolized their Play Integrity API for attestation. Even Graphene itself runs into this roadblock, and why in the current day it's still a minority user group using it or other ROMs
      1. notpushkin · · focus · HN ↗
        I’ve had some trouble with apps refusing to work because of Play Integrity, but it’s not ubiquitous yet. We can still fight it.
        1. 306bobby · · focus · HN ↗
          Normie apps simply don't anymore. WhatsApp will refuse to log you in if it feels your device is modified and then fails a verdict. Google Wallet won't let you tap to pay. Most banks in the EU and basically all virtual ID systems require it

          That's a big pain point for the average user

          1. subscribed · · focus · HN ↗
            I'm using WhatsApp on my GrapheneOS handset without issues.
            1. notpushkin · · focus · HN ↗
              I’ve been using WhatsApp on LineageOS with microG and it worked just fine for me too. Even with Magisk (had to do some integrity trickery for another app, which didn’t work out ultimately but eh).
          2. RandomGerm4n · · focus · HN ↗
            Both WhatsApp and banking apps (Santander/Openbank) work perfectly for me. You really shouldn't use Google Wallet because of privacy concerns. But if you absolutely want to, there are other equally questionable alternatives, such as PayPal, that work just fine on GrapheneOS.
            1. 306bobby · · focus · HN ↗
              They work fine for me too personally, but not for everyone. Banks are ofc by institution, but with whatsapp there's some flag that can be put on an account which makes them get an "unofficial app" warning and not log in. Which gets cleared by using a stock device or something passing integrity. Definitely a weird situation, but there's plenty of proof out there that they're doing something strange
            2. 306bobby · · focus · HN ↗
              And you can't tap to pay with PayPal, at least not in my region. Tap to Pay is the big thing
              1. grapheneos · · focus · HN ↗
                PayPal only supports tap-to-pay in Germany. Curve Pay supports tap-to-pay on GrapheneOS in the UK and the whole European Economic Area. Many European banks have working tap-to-pay too, and the trend of those replacing their independent system with Google Pay has subsided. It's mostly a non-issue in Europe but there aren't similar alternatives for most of the world. Japan does have their own alternative which works on GrapheneOS with Japanese models of Pixels.
                1. Andromxda · · focus · HN ↗
                  [delayed]
            3. snaker · · focus · HN ↗

              [dead]

          3. notpushkin · · focus · HN ↗
            Google Wallet is the one I miss the most.

            EU banks are hit and miss, but e.g. LHV and Wise both work fine. (Wise might limit some functions if it detects root, but custom ROMs seem to be okay. It also has most of the functions available in the web version anyway.) N26 is flaky (sometimes it just works for me, sometimes refuses to even log in; no idea what’s wrong). Revolut has lost me as a user.

            Smart-ID (used in Estonia) has been working fine for me, but they seem to limit biometric signup on custom ROMs. But you can sign up using ID card and a USB reader, so it’s only mildly inconvenient.

            Now, of course, YMMV in other countries, but I think my final point still stands: we can fight it.

            1. 306bobby · · focus · HN ↗
              I do hope we can, I continue to work on custom ROMs after all :)

              I just also like to be a realist, and right now things look a bit grim

      2. surajrmal · · focus · HN ↗
        I'm not sure that's the reason a minority user group is using alternative ROMs. They have always been niche, even before the play integrity API took off.
  5. infogulch · · focus · HN ↗
    I'm so glad GrapheneOS is willing and able to pick up the pieces and polish Android into a usable product as Google continues to drive its clunker into the ground. The only question is if GOS can rescue Android before Google sends it off a cliff.
    1. grapheneos · · focus · HN ↗
      GrapheneOS users can update to the latest OS release to resolve it. It's now available in our Stable channel after making it through public Alpha and Beta channel testing.
      1. infogulch · · focus · HN ↗
        I updated about an hour ago. Thank you for your work! :)
  6. bitpush · · focus · HN ↗
    Why wont GOS contribute this to upstream?
    1. BlackRabbit1 · · focus · HN ↗
      Because Google is already picking patches from GOS ;-)
      1. bitpush · · focus · HN ↗
        I'm confused, so if open source is working as expected then what's the point of the blogpost?
        1. Dylan16807 · · focus · HN ↗
          It's a post about google screwing up their process and also pushing a bad update to a ton of people, and other people cleaning up their mess. I'm glad "open source is working" but that's a small part of the picture and I don't see why that would remove the point of the blog post.
          1. bitpush · · focus · HN ↗
            Software bugs happen. That's a given. If GOS thinks they are above bugs, they are a) either not doing anything significant b) lying.

            Am I surprised that a bug happened in Pixel? Sure. Is there a cause to call for better processes? Yes. But saying "well well well, I fixed the bug" just comes across very amateur.

            1. Dylan16807 · · focus · HN ↗
              Major performance bugs don't sneak themselves into releases and then prevent followup fixes from being promptly released.

              The point of the post is not that grapheneos made the fix, it's that they had to.

      2. HybridStatAnim8 · · focus · HN ↗
        [delayed]
        1. Andromxda · · focus · HN ↗
          [delayed]
    2. stkdump · · focus · HN ↗
      If you look at the patch, it is just disabling a (presumably new and buggy) feature.
    3. HybridStatAnim8 · · focus · HN ↗
      [delayed]
    4. [deleted] · · focus · HN ↗

      [deleted]

    5. grapheneos · · focus · HN ↗
      There's no way to contribute this upstream. Google removed support for Pixels from the Android Open Source Project with the release of Android 16. We obtain the kernel driver sources through tarballs without commit history by making GPLv2 source requests. This is one of many ways Google has become increasingly hostile towards Android-based projects not certified by Google.

      Android 17 QPR1 is also a Pixel OS exclusive release of Android not available to ship by other OEMs and not released as part of the Android Open Source Project. We have Android 17 QPR1 firmware, drivers and HALs since we can obtain all of the kernel sources and we largely switched to using the Pixel OS builds of the userspace code for Android 16 and later. It's one of the problems which will be solved through our partnership with Motorola where they're not only going to be providing everything we need but also helping us port and maintain GrapheneOS for their devices. This is quite the contrast with Google making it increasingly hard to support Pixels.

      Prior to Android 16, each monthly and quarterly release of Android used to be pushed to AOSP. Those are now Pixel OS exclusive and there are only 2 releases per year for both Google's OEM partners and AOSP-based projects to use. Google also ended the AOSP main branch where large portions of Android were developed in public. This all makes it far more difficult to contribute anything upstream. It also makes it quite clear that those contributions are unwelcome.

      Android's security preview system for security patches where patches are shared with OEMs and allowed to be shipped without sources months in advance is another way things have become more hostile. We have access to the security preview patches and are the only OS fully shipping the patches in advance. GrapheneOS gets most of the Android Security Bulletin patches months before the Pixel OS or other OEMs. Samsung is also shipping a subset of these patches early. Neither Google or Motorola are the ones providing the patches to us, but we're still required to follow the rules by not releasing the sources early so we have 2 separate variants of each GrapheneOS release with and without the patches. We used to have security partner access from Google granted by the head of the Android security team at the time, but Android's business team found out and had it revoked. We stopped reporting as many vulnerabilities upstream after this happened. Why should we share what we discover with them when they don't share it with us even when they do with other OEMs?

      Play Integrity API device and strong integrity levels combined with heavily pushing adopting it in Android Studio and the Play Console is the elephant in the room. It bans using GrapheneOS despite it being far more secure than any of what it permits using. Google has made it clear they wouldn't allow us to get certified even if we were willing to follow all of their highly anti-competitive and anti-privacy restrictions in the Compatibility Definition Document. Google also has the Play Integrity API integrated as an opt-in store listing filter for Play Store apps which developers are encouraged to adopt.

      Google also appears to have explicitly asked their engineers to stop communicating much with open source projects based on AOSP and others. There was a regular meeting set up between open source projects based on AOSP and Google engineers which was cancelled and the person who set it up then left the company. Nowadays, we can contact people there as we used to and get little in the way of a response. We contact them about actual issues all the time and are met with radio silence. We can use their regular issue tracker where they'll close most of what we report as WONTFIX without even trying to understand what we're talking about.

      Google also funded and participated in publishing AI slop paper with blatant misinformation about GrapheneOS falsely claiming it has missed security patches it hasn't. The first security patch on their list of hallucinated missed patches was literally reported by us to Android in one of the first Android security bulletins. Google has yet to acknowledge our valid complaints about the paper. Someone working at a company we're working with filed a formal complaint with the IEEE.

      GrapheneOS was not created as an anti-Google project and we made substantial contributions upstream for years. We were on good terms with their security team including leadership and many of their engineers for many years. Google has changed and so has Android. It's only reluctantly kept as an open source project, likely because they realize there would be major regulatory and legal action against them for not following their word and doing a rug pull. They did do that rug pull for Pixels despite selling the Pixel 9a and earlier as Android Open Source Project reference devices and committing to 7 years of updates for the last 2 generations sold as AOSP reference devices (9th/8th gen) and 5 years for the prior 2 generations (7th/6th gen).

      Google has become a very poor steward of Android. Many of Google's Android OEM partners are increasingly unhappy with the overall direction of Android towards more control and restrictions from Google. Samsung has been given special rules without the same anti-competitive restrictions imposed on other Android OEMs due to their outsized market share and court victories in South Korea. For example, non-Samsung Android OEMs aren't allowed to directly sell devices with GrapheneOS and Google will only permit it within a quota. It can and is being worked around and there will be devices sold with GrapheneOS as the stock OS without Google restricting how many can be sold.

      1. drewfax · · focus · HN ↗
        > For example, non-Samsung Android OEMs aren't allowed to directly sell devices with GrapheneOS and Google will only permit it within a quota.

        Wow, that is so cheap of Google. That company has lost all it's values and deserves to die.

        They built their empire with open source projects including Debian, KDE's KHTML (Webkit predecessor), Linux kernel, MySQL etc. But now, these leeches won't even allow OEMs to use different flavor of Android.

  7. gib444 · · focus · HN ↗
    [delayed]
  8. spottedmarley · · focus · HN ↗
    I love you, GrapheneOS. XOXOX
  9. Itoldmyselfso · · focus · HN ↗
    In the meanwhile you can try this temporary fix: Go to Developer Options->Apps>Background Process Limit and change the limit from Standard to "at most 4processes" [1]

    1: <a href="https:&#x2F;&#x2F;redlib.catsarch.com&#x2F;r&#x2F;GooglePixel&#x2F;comments&#x2F;1wr1767&#x2F;comment&#x2F;pd2l9vb&#x2F;" rel="nofollow">https:&#x2F;&#x2F;redlib.catsarch.com&#x2F;r&#x2F;GooglePixel&#x2F;comments&#x2F;1wr1767&#x2F;c...

    1. grapheneos · · focus · HN ↗
      GrapheneOS users can update to the latest OS release to resolve it. It&#x27;s now available in our Stable channel after making it through public Alpha and Beta channel testing.

      Android is supposed to have memory pressure during regular use on devices without a lightweight setup which it&#x27;s supposed to quickly handle by killing frozen cached app processes, trimming unused memory across cached&#x2F;background apps and much more. Many users have tons of apps installed so they depend on this more. Some users have multiple profiles (Private Space, work profile, secondary users) and other setups increasing memory usage.

      Reducing the background process limit has a high cost to usability and won&#x27;t solve the issue. It will reduce memory usage and therefore reduce how much memory pressure needs to be handled. There are better ways to reduce memory usage including disabling AI Core to free around 3GB of memory which isn&#x27;t applicable to GrapheneOS.

      In general, we recommend not having developer options enabled in production due to the issues created by many of the options which appear benign. Using ADB also heavily reduces security by placing massive trust in another computer. GrapheneOS adds a user-facing log viewer outside of developer options in the Settings app because we don&#x27;t want people to need developer options and have more similar improvements planned.

  10. mmooss · · focus · HN ↗
    I want GOS to succeed; I&#x27;m afraid their exceptional technical and developmental skills could be made mostly ineffective by their foot-gun conduct. Fanboys urging them on or defending everything they do are driving them toward a cliff.

    GOS can just talk about the upside, their solution to this problem. That&#x27;s great work. But they often choose to denigrate others, which is destructive, damages relationships (the most essential assets - especially when you have no money to offer!), and is myopic: GOS&#x27;s sh-t stinks too; they f- things up too. Forgive us our trespasses as we forgive those who tresspass against us.

    It seems especially dangerous being entirely dependant on Google&#x27;s goodwill; Google has zero need for GOS. I&#x27;d think Motorola, who now has money and reputation depending on GOS&#x27;s success, would tell GOS to zip it. If I were in that industry and looking to partner, I might love GOS&#x27;s technology but their behavior would be hard to overcome. For example, I love OpenBSD, but who partners with them? And OpenBSD isn&#x27;t dependant on someone else.

    Just zip it, be professional, focus on what you are doing and not on others. Great job on this fix!

    1. Dezvous · · focus · HN ↗
      &gt;Just zip it, be professional, focus on what you are doing and not on others.

      How do you propose they &quot;focus on what [they&#x27;re] doing and not on others&quot; when their entire project is dependent on other&#x27;s (Google&#x27;s) work that directly impacts their own users? There&#x27;s nothing about this blog post that is unprofessional. GrapheneOS released a patch for a rather severe performance bug, which is outside the scope of their normal work, so they provided context into why they made the decision to do so.

      1. andrewaylett · · focus · HN ↗
        Look to &quot;HugOps&quot; as inspiration: when someone else is having a bad day, offer them a hug rather than running them down.

        The article uses phrases like &quot;completely broken&quot;, &quot;awful&quot;, and &quot;&lt;delay&gt; wouldn&#x27;t be a surprise&quot;. Which might be true but it&#x27;s not helping.

        1. Dezvous · · focus · HN ↗
          Those phrases are true and they helped by making a patch, which Google will most likely end up merging. So what&#x27;s your point? Should GrapheneOS blogs treat Google as if they&#x27;re an individual with feelings having a bad day? The same Google that routinely and deliberately hampers the development of GrapheneOS and other similar projects?

          Google pushed out bugged code ostensibly breaking millions of phones, mine included. They have the means to fix it in a short amount of time like GrapheneOS devs did, but they won&#x27;t do it, so GrapheneOS took the initiative.

          1. andrewaylett · · focus · HN ↗
            No, we shouldn&#x27;t treat Google like an individual, because it&#x27;s not. But we can (and should) be mindful of the individuals who make up the various teams within Google.

            That&#x27;s part of the motivation behind HugOps: the people working on fixing a thing are only rarely the people who are responsible for the system that caused the breakage.

            1. grapheneos · · focus · HN ↗
              Individuals at Google working on Android are responsible for their years of attempts to harm projects based on the Android Open Source Project. That includes Google coercing their OEM partners to sign illegal anti-competitive agreements, pushing the illegal anti-competitive Play Integrity API and breaking many public commitments to open source along with the promises they made to sell Pixel phones.

              South Korea and multiple other countries have already found the Google Mobile Services licensing agreements to be illegal, so it&#x27;s an objectively true statement to call it illegal. Samsung has been largely freed from the restrictions due to the court decisions in South Korea combined with their market share, which is good, but also incredibly unfair to other Android OEMs.

              1. andrewaylett · · focus · HN ↗
                Right. But riffing off a response that&#x27;s a cousin of this one — what are you actually trying to achieve with your writing? And I should also note that I agree with you, in substance if not in style.

                I&#x27;d suggest that Google aren&#x27;t your primary audience for this kind of post: it&#x27;s folk like me, who are quite keen on the idea of GrapheneOS but don&#x27;t actually use it yet (I actually bought a second-hand spare phone last week with the ulterior motive of trying GrapheneOS on it, we&#x27;ll see...). What do you want your average reader to think about you, from reading what you&#x27;ve written?

                I should add that this post (that I&#x27;m directly replying to) comes across to me as very much more appropriate than the original blog post, even as it&#x27;s in many ways a lot harsher. It&#x27;s putting Google&#x27;s behaviour in context, rather than drawing comparisons between your own abilities and their poor performance.

                You don&#x27;t need to drag Google down in order to look good; there are many reasons why what Google (and especially their management) have done is bad for society (and not just for you) and also many reasons why what you&#x27;re doing is excellent on its own merits, not merely compared to Google.

                1. grapheneos · · focus · HN ↗
                  It was an announcement on our forum for our userbase to explain why the last update introduced major issues with lag, how that happened, that it wasn&#x27;t specific to GrapheneOS and that we were highly prioritizing working on it. Our release fixing it was pushed out to our Alpha channel yesterday, reached Beta early today and is now in Stable. We had to make an announcement about this because it was heavily impacting perhaps 1&#x2F;5 people and was noticeable by many more people once they were made aware of it even though they weren&#x27;t heavily impacted. Many users were complaining about this after there had been several days for memory pressure to start getting triggered for a much higher proportion of users.

                  There were a small number of complaints prior to us moving the release introducing the issue to Stable. There were very important security updates in the updated firmware&#x2F;driver code and we decided we needed to release it despite that. It took several days for most people&#x27;s setups to build up enough memory usage to start triggering it. It started impacting a lot more people after a while and we realized it was a severe issue we had to address ourselves instead of waiting for Google to do it.

                  Google likely had the same reasoning for pushing it out to people to get many other issues including security bugs fixed despite a major known regression. We did not have time to avoid the situation in advance. We had to either delay driver&#x2F;firmware security updates or ship it and then fix this afterwards. The problem is that it typically takes them at least around 4 to 6 weeks to ship a fix for even a critical issue. They&#x27;ve sometimes managed to do it in 3 weeks in extremely critical cases. It&#x27;s unusual for them to move that quickly and it takes them longer to do kernel changes userspace ones. Once we figured out the issue was, it was quickly fixed and we started builds for a release in the same day.

                  It takes a long time for us to build a release for 21 different devices despite having build machines for it due to each having a specialized build with only what they used and their CPU architecture, etc. and we actually need 42 builds due to security preview releases. We plan to make incremental builds reliable enough to use those for production but it requires great care and potentially ongoing CI testing of reproducible builds to make sure incremental builds haven&#x27;t regressed. If memory wasn&#x27;t so expensive, we could buy a bunch of hardware to upgrade or replace our existing 4 local build machines for official releases.

                  1. mmooss · · focus · HN ↗
                    &gt; It was an announcement on our forum for our userbase to explain why the last update introduced major issues with lag, how that happened, that it wasn&#x27;t specific to GrapheneOS and that we were highly prioritizing working on it.

                    Whatever your &#x27;reasons&#x27;, the consequences are the same. Of course you know that &quot;announcement on our forum for our userbase&quot; can spread much more widely than that.

                    To lead successfully, we can&#x27;t just do what we want and ignore the consequences. A leader&#x27;s job is to get the best consequences.

        2. notpushkin · · focus · HN ↗
          “HugOps” is great (I’ll be stealing this term :-), but Google has been downright hostile to custom ROM maintainers lately. They deserve no hugs here.
        3. microtonal · · focus · HN ↗
          We can hug the engineers that have to fix this while at the same time criticizing the process that led to this.

          Google has betas for QPRs and yet this was not caught. It makes you wonder if Google is dogfooding the devices themselves or at least the devices that are not the latest gen and have 16GB memory.

          The other issue is that it often takes weeks or months to fix show-stopping issues. Compare to e.g. Apple who rolled out a fix for Apple Watch 12&#x2F;Ultra reboots or the iPhone 18 Pro Face ID issues within a week.

          There are seriously things wrong in their process if they don’t catch these bugs and&#x2F;or fix them quickly. (Or the other possibility is that they are understaffed.)

          1. grapheneos · · focus · HN ↗
            Google caused many of these problems with mass layoffs, buyouts and ending remote work which drove away many of their best engineers. The hostility of Google&#x27;s business side towards projects based on AOSP has also led to many additional issues for the Pixel OS which could have been avoided. If they hadn&#x27;t made it nearly impossible to contribute and been so hostile towards many projects including GrapheneOS then they could have a lot of help with these issues and could get them fixed far easier. The Beta releases aren&#x27;t released as open source and there&#x27;s no way to contribute.
        4. grapheneos · · focus · HN ↗
          Google has been increasingly hostile towards GrapheneOS over the past several years despite our substantial contributions upstream. We&#x27;ve spent years helping Google with vulnerability reports, improvements submitted upstream and multiple proposals for security protections which were implemented for both Android and Pixels. We&#x27;ve been treated incredibly poorly by Google.

          They&#x27;re trying to limit how many devices can be sold with GrapheneOS by Android OEMs, reduced the number of AOSP releases from 12 to 2 per year with 10 of those now being Pixel exclusive, removed Pixel support from AOSP, unsuccessfully tried to cut us off from early access to security patches which are now allowed to be shipped early by OEMs while under embargo (which we do), are trying to convince app developers to ban using GrapheneOS via the Play Integrity API and even recently funded an AI slop paper with misinformation about GrapheneOS falsely claiming it missed security patches that it did not based on an entirely false premise that it has diverged from AOSP in a way that it hasn&#x27;t and has to port patches to a diverged fork of the OS which isn&#x27;t how it works. More info at <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;edit?id=49946698">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;edit?id=49946698.

          Many of the things Google has done to hinder open source projects based on Android are illegal and they continue doubling down on it despite a lot of regulatory and legal actions already taken against them.

          1. mmooss · · focus · HN ↗
            You&#x27;re missing an essential point, it seems, about public communication (and behavior): It doesn&#x27;t matter what the other guy does. Google&#x27;s conduct is irrelevant here. I care about GOS, not Google. The question is, what is best for GrapheneOS? GOS may be competely justified in their criticisms of Google, but that doesn&#x27;t matter at all:

            * If GOS is justified in their criticisms and tone, and expresses them, and it harms GOS&#x27;s relationship with Google (problematic as it is), then it causes GOS harm.

            * If GOS is not justified in their criticisms and tone, and expresses them, and it harms GOS&#x27;s relationship with Google (problematic as it is), then it causes GOS the exact same harm.

            So if you&#x27;re thinking about justification, you are distracted - it doesn&#x27;t matter. &#x27;What is best for GOS&#x27; is the only question, and what is best is very likely to not antagonize the company and its employees when GOS is at their mercy entirely. What is best is to find a way to work with them and form as solid a bond as possible (and have a plan B if they screw you).

            We all have to work with people we don&#x27;t like and who treat us poorly; that&#x27;s life when you have higher priorities.

            1. grapheneos · · focus · HN ↗
              We no longer have any ongoing collaboration or communication with Google due to their hostility towards open source projects based on Android. We aren&#x27;t completely at their mercy. Google are facing major regulatory and legal action around the world. The future of Android is as an independent company forcefully split away from Google. Once Google has to compete in the market on fair terms rather than exerting coercive control over Android OEMs through multiple monopolies, they&#x27;ll want all of their apps and services to run on GrapheneOS. We look forward to once again working with the upstream Android engineers once they&#x27;re no longer held hostage by bean counters laying off their coworkers and ruining the project they work on. Their engineers barely even seem allowed to talk to us anymore, so what relationship is there to preserve?
              1. mmooss · · focus · HN ↗
                &gt; We no longer have any ongoing collaboration or communication with Google due to their hostility towards open source projects based on Android.

                Maybe that&#x27;s partly due to GOS&#x27;s behavior toward Google and its engineers. For example, maybe there would be more workarounds and back channels otherwise.

                &gt; The future of Android is as an independent company forcefully split away from Google.

                You are putting a lot of eggs in that quite uncertain and unlikely basket (given how impossible it is to predict the future and also the very wide range of possibilities). Splitting Google hasn&#x27;t happened yet, anywhere, despite many attempts.

                If they do split, there&#x27;s no reason to think Android will be independent: It could be part of a larger subset of Google, even &#x27;old&#x27; Google. It could be sold to another large company - many would love to control half the world&#x27;s phones, if only to guarantee their applications are easiest to use and competitors can be disrupted (e.g., Meta or Microsoft could benefit enormously - and Microsoft could finally extend its OS business to phones).

                Even if independent, why would Android act the way you hope? Who will run it - who will its shareholders and managers be? Likely current many Google shareholders and managers would be part of the spin-off. There&#x27;s no reason to think they - or even completely new people - will be more supportive of FOSS; they could go the other way.

                GOS is amazing. I don&#x27;t know you so likely this is off-target to some degree - my apologies: Many engineers have learned, through defeat or success, that they need more than great engineering to get their passion into people&#x27;s hands and change the world. Just as essential - more essential (lots of poor engineering is widely used!) - are great business skills. There&#x27;s no shame in it: very few people can do it all (who is both a great engineer and great business manager?), and none have time to do both.

                I hope someday the world knows &#x27;Graphene&#x27; and a billion use it. It&#x27;s one of the most important projects around - how else can typical end users have a chance at privacy? Good luck!

    2. bitpush · · focus · HN ↗
      wow, well said. This explains why I always felt a bit off about GOS. I&#x27;m reminded of Igalia, who does a ton of work on Safari but always comes across as professional and dependent.

      There&#x27;s a certain humility in how Igalia conducts business, and they contribute sooo much to the web ecosystem.

    3. williamtell · · focus · HN ↗
      There are plenty of messages on this site where the GOS lead assumed the best while Google tightened the rope.. Google was never the right choice for a partner when being able to choose only one hardware vendor. Google made changes to AOSP that are basically infringement of GPL using the usual embargo security theater. GOS making some noise is good for their business since if they don&#x27;t even their existing user base will assume they will be squashed like a bug.
    4. palata · · focus · HN ↗
      &gt; But they often choose to denigrate others, which is destructive, damages relationships

      It used to be like that (and to be fair, all the similar communities were contributing to the drama, not just GOS), I agree, but I genuinely feel like it has become a lot more professional lately. Like I haven&#x27;t seen drama in... at least 6 months?

      Now I almost exclusively see them explain their technical decisions, which is very interesting.

      1. mmooss · · focus · HN ↗
        The OP denigrates Google.
        1. olyjohn · · focus · HN ↗
          [delayed]
        2. palata · · focus · HN ↗
          Oh sorry, I thought you were talking about something else. Well... yeah IMO Google deserves it as it (as a company) is predatory.

          Don&#x27;t get me wrong, there are brilliant engineers at Google and I&#x27;m glad they are paid to contribute to open source projects like Android. But it doesn&#x27;t make Google less evil.

          And criticising a company is very different from &quot;denigrating people&quot;. I don&#x27;t think that the Google entity has feelings, does it?

          1. mmooss · · focus · HN ↗
            If you have a relationship with a business, try publicly denigrating them and see what the response is. Google the entity has a reputation, and that affects their revenue and reflects strongly on the people who work there - &#x27;Google&#x27; means something on a resume.
            1. palata · · focus · HN ↗
              What relationship does GrapheneOS have with Google? My understanding is that they fork the open source stuff made by Google, and as a response Google (the entity) does everything they can to screw GrapheneOS.

              &gt; Google the entity has a reputation

              Yep: &quot;EvilCorp&quot;

            2. microtonal · · focus · HN ↗
              Google’s relation with GrapheneOS is: make their lives harder by moving kernel trees from Git to Google Drive with a form that sometimes doesn’t get processed in weeks; block tap-to-pay and a bunch of apps with Play Integrity; closing the AOSP trees and only do major release and QPR2 drops; remove Pixel device trees etc. from AOSP even though they were sold as reference devices.
            3. HybridStatAnim8 · · focus · HN ↗
              [delayed]
            4. grapheneos · · focus · HN ↗
              Google has been increasingly hostile towards GrapheneOS over the past several years despite our substantial contributions upstream. We&#x27;ve spent years helping Google with vulnerability reports, improvements submitted upstream and multiple proposals for security protections which were implemented for both Android and Pixels. We&#x27;ve been treated incredibly poorly by Google.

              They&#x27;re trying to limit how many devices can be sold with GrapheneOS by Android OEMs, reduced the number of AOSP releases from 12 to 2 per year with 10 of those now being Pixel exclusive, removed Pixel support from AOSP, unsuccessfully tried to cut us off from early access to security patches which are now allowed to be shipped early by OEMs while under embargo (which we do), are trying to convince app developers to ban using GrapheneOS via the Play Integrity API and even recently funded an AI slop paper with misinformation about GrapheneOS falsely claiming it missed security patches that it did not based on an entirely false premise that it has diverged from AOSP in a way that it hasn&#x27;t and has to port patches to a diverged fork of the OS which isn&#x27;t how it works. More info at <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;edit?id=49946698">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;edit?id=49946698.

              Many of the things Google has done to hinder open source projects based on Android are illegal and they continue doubling down on it despite a lot of regulatory and legal actions already taken against them.

        3. antonvs · · focus · HN ↗
          “Denigrate” implies unfair criticism. Whether the OP is doing that is a matter of opinion, but it’s certainly possible to read it as straight criticism, i.e. not unfair and not denigrating.
        4. grapheneos · · focus · HN ↗
          Google has been increasingly hostile towards GrapheneOS over the past several years despite our substantial contributions upstream. We&#x27;ve spent years helping Google with vulnerability reports, improvements submitted upstream and multiple proposals for security protections which were implemented for both Android and Pixels. We&#x27;ve been treated incredibly poorly by Google despite our contributions.

          They&#x27;re trying to limit how many devices can be sold with GrapheneOS by Android OEMs, reduced the number of AOSP releases from 12 to 2 per year with 10 of those now being Pixel exclusive, removed Pixel support from AOSP, unsuccessfully tried to cut us off from early access to security patches which are now allowed to be shipped early by OEMs while under embargo (which we do), are trying to convince app developers to ban using GrapheneOS via the Play Integrity API and even recently funded an AI slop paper with misinformation about GrapheneOS falsely claiming it missed security patches that it did not based on an entirely false premise that it has diverged from AOSP in a way that it hasn&#x27;t and has to port patches to a diverged fork of the OS which isn&#x27;t how it works.

          Many of the things Google has done to hinder open source projects based on Android are illegal and they continue doubling down on it despite a lot of regulatory and legal actions already taken against them.

          More info at <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;edit?id=49946698">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;edit?id=49946698.

      2. fsflover · · focus · HN ↗
        &gt; Like I haven&#x27;t seen drama in... at least 6 months?

        <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=49600114">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=49600114

        <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=49600021">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=49600021

        1. subscribed · · focus · HN ↗
          Why do you even call the detailed, verifiable claims about a product a &quot;drama&quot;?

          So it&#x27;s impossible now to list the bad features or shortcomings without come one calling drama?

          Why do you call it drama?

          1. fsflover · · focus · HN ↗
            One thing is to present the advantages of your system. Entirely different thing is to enter every discussion of alternative systems saying they have &quot;atrocious&quot; security. Also, the second link is an empty accusation, as it has no proofs.
            1. subscribed · · focus · HN ↗
              They have listed a very long, concrete list of issues with Fairphone in the (sub)thread about Fairphone.

              A very long list of severe issues. This is not presenting the advantages, it&#x27;s listing of the problems.

              When did that become a &quot;drama&quot;, and not a fact-based criticism?

              Re: second link - I don&#x27;t have time to waste on digging through the code, I&#x27;d rather count pebbles in my garden, but I&#x27;m happy to bet £100 that it&#x27;s fully facts based. I didn&#x27;t even comment on the second link previously, BTW.

              1. fsflover · · focus · HN ↗
                Imagine that I would enter every conversation about GrapheneOS saying how atrocious their freedom is, including (1) reliance on bunch of non-auditable, proprietary drivers and firmware; (2) full dependence on Google&#x27;s direction of Android development and how fast Google shares the source code with others, as well as reliance on remote attestation [0]; (3) their disregard of GPLv3 that protects the user more [1]; (4) intentional lack of support for root for whitelisted apps; (5) lack of full user control over the running apps [2,3].

                - would you call the above &quot;a very long, concrete list of issues&quot; or &quot;attack and drama&quot;?

                [0] <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=45232164">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=45232164

                [1] <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=49594324">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=49594324

                [2] <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=49543420">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=49543420,

                [3] <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=48767841">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=48767841

                1. subscribed · · focus · HN ↗
                  LOL?

                  I don&#x27;t see how the evidence of the project unwilling to keep up with the mainstream security or a statement that their hardware doesn&#x27;t come close to the top would be relevant to this:

                  (1) and how do you imagine releasing the OS for the hardware not owned by the project? Does your Fairphone release source code of all the firmware? Do you have source code of the BIOS, firmware and microcode of your chosen Qubes OS pc? :D

                  (2) LOL, Google pretty much owns AOSP, how do you imagine GOS project takes the helm? Please explain. I read these as the strategic decision of GrapheneOS project, or unwillingness to take action. Please explain.

                  [0] what are you even on with remote attestation? This is an optional feature for the OS provider to prove the whole chain of custody hasn&#x27;t been broken. Can you explain how the GOS project providing an option for the software developers to check that the OS hasn&#x27;t been tampered with is a downside.

                  Of course in the light of the Fairphone unable to do as much as peivide timely patches or the OS available for over 6 months now.

                  (3) they explained they &quot;want GrapheneOS to have no additional restrictions beyond AOSP. AOSP uses GPLv2 but not GPLv3&quot;. I don&#x27;t understand what the charge is? How does GPLv3 benefit end user more? Why aren&#x27;t you complaining to Google?

                  (And why are we even talking about that? Are you trying to stoke some drama, LOL?)

                  (4) lack of support for root becomes what, a proof they&#x27;re stoking drama?! what are you even on? They prove source code, build instructions and more details, you&#x27;re free to build your own images with root, it&#x27;s actually super simple - the only things you lose is their signature and remote attestation you hate anyway.

                  Why do you expect a project focused on the reasonable security of all the reasonably safe handsets to bow to you exactly?

                  Because frankly it looks like you&#x27;re trying to cause some drama. None of your &quot;charges&quot; carry any weight. Quoting the team explaining why they chose GPLv2 over v3 as the &quot;evidence&quot; of drama?

                  What&#x27;s your angle? What i#&#x2F;your post really about? Yeah, I see you see all the above as a serious charges against the project, and you&#x27;re free to throw these every time.

                  But.... Do you really think they&#x27;re approximately the same weight?

                  1. fsflover · · focus · HN ↗
                    &gt; mainstream security

                    How is this mainstream security, if GrapheneOS are the only ones offering it? Cutting edge, maybe. Except Qubes OS of course.

                    &gt; or a statement that their hardware doesn&#x27;t come close to the top

                    I specifically mentioned that the GOS crowd comments on every single topic of other projects, which to me is just attacking them. They have different tradeoffs, just like GOS itself. This is why I chose to word it that this is akin to me attacking every GOS post with their own flaws, which are the result of the chosen (mostly fair but real) tradeoffs. I do not want to attack every GOS discussion. I want to demonstrate how ridiculous their actions are, dividing projects that in the end have the same goals: to fight with megacorps and reclaim user freedom and security.

                    (1) I do not. And I do not have a Fairphone. I just hate drama and fight against it. I have a Librem 5 though. All its drivers are free and all its firmware sits on external, removable devices. If (when) a certain vendor starts to misbehave and use their power against the user, we can replace the device.

                    (2) I do not believe that AOSP developed by Google will provide the necessary freedom in the future, at all. Google have shown again and again how they use their power against the users and against GrapheneOS. If you can&#x27;t develop it independently, just don&#x27;t. I use Librem 5, because I do not believe in the future of AOSP. Linux though doesn&#x27;t obey a single megacorp: Its development is distributed over many organizations, greatly reducing the danger of misbehavior against users. Librem 5 is less secure than a GrapheneOS phone today, but nothing prevents the community to change that.

                    [0] GrapheneOS supports the option of using the phone against its users with DRM. People who value freedom are not okay with that.

                    &gt; Of course in the light of the Fairphone unable to do as much as peivide timely patches or the OS available for over 6 months now.

                    AFAIK they follow the upstream patches, i.e., just like GOS, they are at the mercy of the corporations with their security. This is not exactly their fault, as they chose different main goals, which are important, too. Attacking them does not help anyone except the megacorps.

                    &gt; Why aren&#x27;t you complaining to Google?

                    Google do not promise privacy or control to their users. But they should definitely be fought against.

                    &gt; How does GPLv3 benefit end user more?

                    You can read all the reasoning at gnu.org.

                    &gt; (And why are we even talking about that? Are you trying to stoke some drama, LOL?)

                    I am trying to stop some drama by explaining why the GOS crowd should not do as they do.

                    (4) You completely missed my point. Read the above.

                    &gt; you&#x27;re free to build your own images

                    &gt; Why do you expect a project focused on the reasonable security of all the reasonably safe handsets to bow to you exactly?

                    I did not demand that GOS does this.

                    &gt; None of your &quot;charges&quot; carry any weight.

                    I did not suggest changes. I do understand the GOS choices. I demand that they, too, understand the choices of others.

                    &gt; Quoting the team explaining why they chose GPLv2 over v3 as the &quot;evidence&quot; of drama?

                    The choices have nothing to do with drama. The inability of GOS to understand the choices of others and attacking these choices every single time something is posted is drama.

                    Thanks for the genuinely trying to understand me.

                    1. subscribed · · focus · HN ↗
                      &gt; How is this mainstream security, if GrapheneOS are the only ones offering it?

                      Not their fault. I should probably say &quot;reasonable security&quot;. Settling for anything less is folly, seeing how malvertising isn&#x27;t the only danger to the normal users. Broad availability of the powerful LLMs increases the amount of the vulnerabilities found and exploited in the wild.

                      Anything can carry an RCE now, web font, image, background audio on the cute website, attachment in the MMS or WhatsApp message.

                      I guess all those with &quot;nothing to hide&quot; (except their text messages, financial data, money on their bank accounts) are happy to have their lives sold in the open on more and more darknet marketplaces, their devices to mine some obscure crypto and serve as proxy for some nefarious actors.

                      You&#x27;re using Qubes, I guess not because you like slower and less streamlined experience, but because you want security.

                      &gt; My Qubes laptop runs coreboot with Heads with disabled and neutralized Intel ME.

                      Congrats, then, really.

                      Oh, wait, Qubes openly supports &quot;CPU-vendor-provided blobs for silicon and memory initialization as well as other internal operations&quot; -- which means you either strike &quot;reliance on numerous non-auditable, proprietary drivers and firmware&quot; from GOS (which runs it on the hardware that guarantees the separation), or raise the same for Qubes OS.

                      And actually, while we&#x27;re at it, does your phone OS rely on the &quot;numerous non-auditable, proprietary drivers and firmware&quot; or not? Because if yes, why would you even complain that a very secure platform does that too?

                      Re: Coreboot: for me it would mean that I cannot use Qubes OS with hardware I want, because mean someone doesn&#x27;t provide coreboot fw for my laptop, and even worse still, Qubes doesn&#x27;t support my laptop.

                      I guess it&#x27;s their fault then, seeing as some people throw a hissy fit that GrapheneOS doesn&#x27;t want to officially support a phone they want to be supported :)

                      &gt; I specifically mentioned that the GOS crowd comments on every single topic of other projects,

                      Will all due respect, this is just raging BS requiring extraordinary evidence.

                      &gt; This is why I chose to word it that this is akin to me attacking every GOS post with their own flaws, which are the result of the chosen (mostly fair but real) tradeoffs

                      But you didn&#x27;t list even one actual, objective flaw.

                      Not releasing firmware patches impacts everyone is objective, clearly negative. Not allowing to use custom keys is objective flaw. Not allowing to relock the bootloader is a flaw. Not having a secure element that processes PIN is a flaw.

                      Running privileged Google services isn&#x27;t an objective flaw, if it&#x27;s openly disclosed and benefits some users (so their handset can pass Play Integrity). No, GOS don&#x27;t do it, for me it&#x27;s an example what is and what isn&#x27;t objective.

                      Supporting only one family of the phones is not an objective flaw if that&#x27;s the only hardware platform that can back the security posture. And with the upcoming Motorola handsets support it&#x27;s proved beyond doubt it&#x27;s a flaw of the hardware manufacturers, not of the project trying to provide a secure platform for the increasingly dangerous Internet.

                      Maybe you remember how the freshly installed Windows XP without firewall couldn&#x27;t get connected to the internet or it&#x27;d get immediately infected. Maybe you&#x27;ve seen logs from the Linux servers showing endless attempts to break in.

                      We&#x27;re approaching the same for mobile devices, just worse, because most of these devices are grossly insecure, and the LLMs will be able to prepare custom exploits for all the common ones en masse.

                      &gt; I do not want to attack every GOS discussion.

                      You do you. If you have actual flaws, by all mean, you&#x27;re good.

                      But you didn&#x27;t show a single one yet. You shared your opinion on how you believe that not supporting root is somewhat bad, or complained that GOS does something ALL the other vendors do (like reliance on AOSP, not changing licensing, or using fw blobs (at least in their case - securely))

                      &gt; I want to demonstrate how ridiculous their actions are, dividing projects that in the end have the same goals: to fight with megacorps and reclaim user freedom and security.

                      I think it&#x27;s a mistake to project your own position or understanding on all the projects.

                      Like, LineageOS supports a very broad range of hardware increasing security for many of these abandoned by their vendors (f*k Sony, for example, for releasing security patches for barely year-and-a-half for so-called flagship).

                      GOS has different goals. They result in the similar gains (i.e. ensuring security benefits privacy), but it&#x27;s a result, not goal per se.

                      &gt; Librem 5

                      So you don&#x27;t have source code of the firmware for your chosen phone but you&#x27;re attacking GOS for using firmware they don&#x27;t have source of? I&#x27;m confused.

                      &gt; (2) I do not believe that AOSP developed by Google will provide the necessary freedom in the future

                      Wait, wait, but you said &quot;full dependence on Google&#x27;s direction of Android development and how fast Google shares the source code with others&quot; as presumably an evidence&#x2F;example of specifically GrapheneOS flaw.

                      You &quot;accused&quot; AOSP-based operating systems team of being fully dependent on the AOSP.

                      And now you&#x27;re saying it was about your *feelings*?

                      Do you attack projects stating your feelings as an &quot;evidence&quot; of the project&#x27;s shortcomings?

                      Can you see how it&#x27;s hard to have a fact-based, neutral discussion with that? It&#x27;s broadly pointless because you either confuse facts and evidence with feelings or you equate these two.

                      &gt; Librem 5 is less secure than a GrapheneOS phone today, but nothing prevents the community to change that

                      If the hardware is secure, sure. You can even backport a lot of GOS improvements back to Linux.

                      But if the hardware is not secure, then no, community cannot make it as secure as GOS phone today.

                      &gt; GrapheneOS supports the option of using the phone against its users with DRM

                      I&#x27;m confused, first I don&#x27;t know what specifically you&#x27;re talking about (not saying it&#x27;s untrue but throwing &quot;DRM&quot; randomly doesn&#x27;t help much), and is it something unique to GrapheneOS that is NOT shared by other projects? Because, seriously, you&#x27;re singling out the safest, most private and most secure project listing things that are probably done by everyone else but its somehow only GOS issue?

                      (Also, is it a safety issue or only privacy? GOS never promised a focus on privacy)

                      &gt; [Fairphone] AFAIK they follow the upstream patches, i.e., just like GOS, they are at the mercy of the corporations with their security.

                      They&#x27;re always late by many months. Months. They&#x27;re free to do what GrapheneOS do, to keep requesting these patches.

                      But what are we talking about, they didn&#x27;t even do as much as move to Android 17, which in itself is the evidence they don&#x27;t follow upstream, because most patches are not backported by Google. Raising that is not &quot;attacking&quot; any more than listing unsafe features of a a specific car.

                      &gt;&gt; [about not supporting root] Why do you expect a project focused on the reasonable security of all the reasonably safe handsets to bow to you exactly?

                      &gt; I did not demand that GOS does this.

                      But you specifically complained: &quot;(4) complete lack of flexibility concerning the user&#x27;s threat model, e.g., intentional lack of support for root for whitelisted apps&quot;

                      They openly support users building their own images (with root. It&#x27;s trivial to build the image with root enabled), and you actually complain they do not support root. They do not in their official images.

                      So you are now saying that by complaining that GrapheneOS do not support root in the official image, which you provided as (presumably) objective flaw of the OS, isn&#x27;t in fact you demanding they support it officially and build it in, thus bowing to the request?

                      I&#x27;m utterly confused here.

                      About as much as when you send me to FSF website to read about some licence when I ask you how the project&#x27;s decision to stick to the parent licence in order to not impose limitations on the users is imposing the limitations on the users.

              2. fsflover · · focus · HN ↗
                &gt; I&#x27;m happy to bet £100 that it&#x27;s fully facts based

                Quote:

                    *a random identifier, generated on your device the first time it boots (a random UUID prefixed with anon), used to pick the wave.*
                About this identifier:

                    *it is random: it is not computed from the IMEI, the serial number, the MAC address, an account or any other data of your device or of you;
    it is not linked to any account: you do not need an account to use &#x2F;e&#x2F;OS and the Updater does not know about it;
    it is reset by a factory reset: after one, your device gets a new identifier and is considered a new device;
    it is used to pick the wave.*
                <a href="https:&#x2F;&#x2F;doc.e.foundation&#x2F;os&#x2F;learn&#x2F;staged-rollout&#x2F;" rel="nofollow">https:&#x2F;&#x2F;doc.e.foundation&#x2F;os&#x2F;learn&#x2F;staged-rollout&#x2F;

                No evidence that it is used or can be used for tracking. The accusation is strongly overstated. (You can keep your £100 though.)

                1. subscribed · · focus · HN ↗
                  GOS&gt;&gt; &#x2F;e&#x2F; does have services collecting data on their users which isn&#x27;t disclosed including user tracking via unique identifiers in the update client.

                  &gt; a random identifier, generated on your device the first time it boots

                  So it&#x27;s a persistent, unique identifier, is it?

                  &gt; No evidence that it is used or can be used for tracking.

                  It&#x27;s even worse than Google&#x27;s Advertising ID that at least can be easily reset.

                  &gt; The accusation is strongly overstated

                  &gt; (You can keep your £100 though.)

                  I don&#x27;t think how you disproved anything. You even confirmed the phone ID is immutable until factory reset.

                  I was talking about all four claims.

                  GOS&gt;&gt; They also spent years sending user speech data to OpenAI without informing users beyond fine print in the terms of use.

                  Here&#x27;s the discovery by the user and confirmation from the owner of the project: <a href="https:&#x2F;&#x2F;community.e.foundation&#x2F;t&#x2F;voice-to-text-feature-using-open-ai&#x2F;70509&#x2F;10" rel="nofollow">https:&#x2F;&#x2F;community.e.foundation&#x2F;t&#x2F;voice-to-text-feature-using...

                  (This is sharing users&#x27; biometric data with third party without express consent, then shared further with unspecified )

                  GOS&gt;&gt; It&#x27;s presented as not using Google services but has a whole bunch of Google services with privileged access enabled by default.

                  <a href="https:&#x2F;&#x2F;eylenburg.github.io&#x2F;android_comparison.htm" rel="nofollow">https:&#x2F;&#x2F;eylenburg.github.io&#x2F;android_comparison.htm

                  GOS&gt;&gt; It even downloads and runs Google Play executables such as droidguard by default with privileged access far beyond the regular app sandbox.

                  <a href="https:&#x2F;&#x2F;doc.e.foundation&#x2F;os&#x2F;learn&#x2F;calls-to-google-servers&#x2F;" rel="nofollow">https:&#x2F;&#x2F;doc.e.foundation&#x2F;os&#x2F;learn&#x2F;calls-to-google-servers&#x2F;

                  I believe it also enables Safetynet checks by default which downloads and executes proprietary code straight from Google.

                  So you didn&#x27;t disprove the first one and you didn&#x27;t touch remaining three.

                  I&#x27;ll keep my £100 indeed.

        2. palata · · focus · HN ↗
          This is not drama, this is a technical opinion about their competitors. Happy to have Fairphone and &#x2F;e&#x2F;OS do it constructively as well. And I mean constructively. When the founder of &#x2F;e&#x2F;OS says &quot;we are not one of those hardened systems for pedophiles&quot;, it is not constructive. If they said (I&#x27;m inventing here, not sure if they did): &quot;The problem of GrapheneOS is that they only run on Pixels. We try to run on more phones in a best-effort basis&quot;, that would be valid.
          1. fsflover · · focus · HN ↗
            I agree that e&#x2F;OS&#x2F; weren&#x27;t constructive. However see this: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=49947080">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=49947080

            P.S. Flagging my comments, as the GrapheneOS fans do, is also far from constructive.

      3. subscribed · · focus · HN ↗
        Agreed, I feel like the most abrasive, arrogant responses in normal interactions are near nonexistent but still happen (I&#x27;ve received a pretty aggressive takedown from the official account for a pretty innocent question, so I simply won&#x27;t interact or try to contribute).

        In the past it was really commonplace, so it cooled my curiosity about the project for a couple of years.

        Still, they hand the interactions to people with people skills.

      4. grapheneos · · focus · HN ↗
        We&#x27;ve been defending ourselves from intense attacks aimed at destroying GrapheneOS and personally harming our team members since 2018. We now have a lot more project members, community members, money, legal representation and other resources to protect ourselves. We don&#x27;t feel the need to defend ourselves nearly as much from non-technical attacks since even many people who don&#x27;t use GrapheneOS are defending us. No need for us to directly address it if others have already done it. We&#x27;ll still directly defend ourselves in cases where other people aren&#x27;t aware or aren&#x27;t doing it.
        1. warrantisall · · focus · HN ↗
          Now that you have &quot;money, legal representation and other resources to protect ourselves&quot;, will you take legal action against Google&#x27;s anti-competitive practices?
    5. armadyl · · focus · HN ↗
      &gt; GOS can just talk about the upside, their solution to this problem. That&#x27;s great work. But they often choose to denigrate others, which is destructive, damages relationships…

      Sorry, but no. This sentiment isn’t too different from politics in the US right now where the politicians that “call it like it is” are significantly more popular than the “traditional take the high road speech” candidates. It’s a lame thought process.

      I appreciate GrapheneOS telling it like it is, and their language highlights the failings of Google. It’s unacceptable that the maintainer of Android&#x2F;AOSP is performing like this.

      &gt; I&#x27;d think Motorola, who now has money and reputation depending on GOS&#x27;s success, would tell GOS to zip it. If I were in that industry and looking to partner, I might love GOS&#x27;s technology but their behavior would be hard to overcome.

      This has little to no effect on Motorola. They didn’t even promote their partnership with GOS and mostly only GOS users and tech enthusiasts are even aware of this partnership. People who need &#x2F; want GOS don’t care about the attitude of the developers as long as they deliver beneficial things and don’t go off the fascist&#x2F;racist&#x2F;socially unacceptable deep end (and even that is debatable just look at Omarchy and it’s sponsors as well as Brave). The average consumer could not care less and will continue to be unaware of GOS at best, and at worst view it as negatively as the press tries to portray it when the government tries to attack someone’s digital civil liberties.

      1. mmooss · · focus · HN ↗
        &gt; This sentiment isn’t too different from politics in the US right now

        That&#x27;s a pretty big stretch; the stakes and actors differ vastly.

        &gt; I appreciate GrapheneOS telling it like it is,

        You may like it but it may hurt GOS&#x27;s prospects. It deters others from working with GOS (I expect, based on common sense of the professional world), and Google has tremendous power over GOS.

        Is the trade-off worth it? Is hearing what you want worth risking GOS&#x27;s future, and possibly reducing its resources, distribution, and reputation?

        The scrappy newcomer can say what they want - indeed, it gets attention. But once you have something worth protecting - a product and a reputation - you have competing interests: say what you want or further your product and name?

        1. HybridStatAnim8 · · focus · HN ↗
          [delayed]
        2. grapheneos · · focus · HN ↗
          Google has been increasingly hostile towards GrapheneOS over the past several years despite our substantial contributions upstream. We&#x27;ve spent years helping Google with vulnerability reports, improvements submitted upstream and multiple proposals for security protections which were implemented for both Android and Pixels. We&#x27;ve been treated incredibly poorly by Google.

          They&#x27;re trying to limit how many devices can be sold with GrapheneOS by Android OEMs, reduced the number of AOSP releases from 12 to 2 per year with 10 of those now being Pixel exclusive, removed Pixel support from AOSP, unsuccessfully tried to cut us off from early access to security patches which are now allowed to be shipped early by OEMs while under embargo (which we do), are trying to convince app developers to ban using GrapheneOS via the Play Integrity API and even recently funded an AI slop paper with misinformation about GrapheneOS falsely claiming it missed security patches that it did not based on an entirely false premise that it has diverged from AOSP in a way that it hasn&#x27;t and has to port patches to a diverged fork of the OS which isn&#x27;t how it works. More info at <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;edit?id=49946698">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;edit?id=49946698.

          Many of the things Google has done to hinder open source projects based on Android are illegal and they continue doubling down on it despite a lot of regulatory and legal actions already taken against them.

    6. csdreamer7 · · focus · HN ↗
      &gt; It seems especially dangerous being entirely dependant on Google&#x27;s goodwill; Google has zero need for GOS.

      Google&#x27;s justification for Android over Apple is it being open source and attracting this crowd and people they recommend it to. They have a very strong need for it or they would have stopped contributing years ago.

      &gt; GOS can just talk about the upside, their solution to this problem. That&#x27;s great work. But they often choose to denigrate others, which is destructive, damages relationships (the most essential assets - especially when you have no money to offer!), and is myopic: GOS&#x27;s sh-t stinks too; they f- things up too.

      Look up false equivalence.

      GOS isn&#x27;t a trillion dollar company with a massive possible budget for quality control. Google can do better and they should do better.

      If Google&#x27;s internal issues (or deliberate withholding of source code) is causing a small group to surpass them in product quality then that is something to talk about. Especially without the ad tracking and data collecting money Google brings in.

      If it gets Google to improve AOSP then all the better.

      &gt; would tell GOS to zip it. &gt; Just zip it, be professional,

      This is very rude-esp for a group trying to make Android better. I downvoted you.

      1. mmooss · · focus · HN ↗
        All the justification in the world won&#x27;t help GOS. Do they want to be justified or do they want GOS to succeed?

        At work you can say things and say them in a manner that you think is justified, or you can behave in ways that let you keep your job. I want GOS to succeed.

        1. csdreamer7 · · focus · HN ↗
          &gt; At work you can say things and say them in a manner that you think is justified, or you can behave in ways that let you keep your job.

          I saw nothing in the post that is even close to that.

          &gt; I want GOS to succeed.

          By making poor arguments on HN and being rude to them? Sounds productive.

          You think you can do better? Contribute to another&#x2F;Make your own fork of Android and help the community reduce it&#x27;s dependence on Google.

      2. grapheneos · · focus · HN ↗
        Google has been increasingly hostile towards GrapheneOS over the past several years despite our substantial contributions upstream. We&#x27;ve spent years helping Google with vulnerability reports, improvements submitted upstream and multiple proposals for security protections which were implemented for both Android and Pixels. We&#x27;ve been treated incredibly poorly by Google despite our contributions. They&#x27;re trying to limit how many devices can be sold with GrapheneOS by Android OEMs, reduced the number of AOSP releases from 12 to 2 per year with 10 of those now being Pixel exclusive, removed Pixel support from AOSP, unsuccessfully tried to cut us off from early access to security patches which are now allowed to be shipped early by OEMs while under embargo (which we do), are trying to convince app developers to ban using GrapheneOS via the Play Integrity API and even recently funded an AI slop paper with misinformation about GrapheneOS falsely claiming it missed security patches that it did not based on an entirely false premise that it has diverged from AOSP in a way that it hasn&#x27;t and has to port patches to a diverged fork of the OS which isn&#x27;t how it works.

        Many of the things Google has done to hinder open source projects based on Android are illegal and they continue doubling down on it despite a lot of regulatory and legal actions already taken against them.

        More info at <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;edit?id=49946698">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;edit?id=49946698.

    7. phasephantasm · · focus · HN ↗
      Ironic, you are being an example of what you project. People come out of the woodwork to say what you do, then respond to comments like mine with &quot;maybe there is a reason for it&quot;... but if you&#x27;re gonna leave it to &quot;maybe&quot;, you should just zip it yourself really.
  11. aboringusername · · focus · HN ↗
    It&#x27;s concerning to hear about the disarray within the internal workings of Android, they&#x27;ve spoken quite a lot about this recently such as getting access to the code and having to make manual requests.

    I&#x27;m curious if there&#x27;s any back up plan to an operating system used by billions. One would think, and hope, the EU would have an alternative ready to go at a moment&#x27;s notice. Android is literally too big to fail, but I doubt the EU would be ready even though you could consider the failing of Android a national security emergency.

    I would like to know more about what&#x27;s going on at Google that are causing these issues.

    1. palata · · focus · HN ↗
      I read a lot of comments like this, saying &quot;we should have an alternative&quot;. And I agree that it would be really cool, BUT:

      AOSP and the Android SDK are open source. GrapheneOS is exactly an alternative to Google Android. Sure, Google could shut down the Play Store (but alternative stores exist), or destroy the Play Services (but even then, there is microG).

      I am happy that Google is still contributing to Android because they have a ton of money and many brilliant engineers, even though as a company it seems like it&#x27;s somehow trying to burn it to the ground. But I am optimistic: it would be possible to build on top of the open source parts of Android if needed.

      1. 0xcde4c3db · · focus · HN ↗
        AOSP is open-source, but unlike Linux distros, AOSP per se doesn&#x27;t really support any platform other than the Android emulator. To support real devices you need devicetree&#x2F;firmware&#x2F;drivers from a vendor. So it&#x27;s concerning to see this move from Google, which is also the device vendor for all currently supported GrapheneOS devices.
        1. palata · · focus · HN ↗
          Well to support real devices you need the device manufacturer to not prevent you from supporting it. Samsung can totally make a smartphone that does not support Android today. But I&#x27;m not sure what you are trying to say with that...

          &gt; So it&#x27;s concerning to see this move from Google, which is also the device vendor for all currently supported GrapheneOS devices.

          It is, and the solution to that is the partnership with Motorola.

        2. microtonal · · focus · HN ↗
          Linux also doesn’t have device trees and firmware for most phones. E.g. many Ubuntu Touch ports just use the device tree, firmware, and kernel tree provided by the manufacturer for Android.

          So from that perspective there is not really a difference between AOSP and Linux, you need support from the device vendor. But AOSP is many times more secure than the traditional Linux desktop and has many times more apps available (most of which do not require Play Integrity).

        3. HybridStatAnim8 · · focus · HN ↗
          AOSP and its derivatives are linux distros.
    2. EmbarrassedHelp · · focus · HN ↗
      The EU Commission at least seems comfortable with requiring that everyone uses Google approved versions of Android, because it makes their authoritarian push for mandatory age verification easier to enforce.

      Most national governments in the EU are probably too authoritarian technology-wise to recognize the importance of supporting a project like GrapheneOS as well.

    3. surajrmal · · focus · HN ↗
      The model for Android is that the OS is provided by the OEM. They work in partnership with Google. GrapheneOS tries to work against this model by not partnering with the OEM on supporting their hardware with its OS. Ultimately that&#x27;s not sustainable given the dynamics of the ecosystem. This is why they are moving to a model where they do work with an OEM directly. These sorts of problems will subside once that happens.

      You could argue that the current ecosystem dynamic is not great for the longer term, but it will require a change from the OEMs to enable something different as they are the ones actually in control of the situation.

  12. AzzyHN · · focus · HN ↗
    I knew something was up!
  13. joemazerino · · focus · HN ↗
    Is this in stock Android? If so that is crazy.
    1. grapheneos · · focus · HN ↗
      It definitely impacts the stock Pixel OS and many users are complaining about it. Here are a bunch of user reports:

      <a href="https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;GooglePixel&#x2F;comments&#x2F;1wvnj9c&#x2F;lags_on_google_pixel_8&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;GooglePixel&#x2F;comments&#x2F;1wvnj9c&#x2F;lags_o...

      <a href="https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;GooglePixel&#x2F;comments&#x2F;1wtxm0m&#x2F;pixel_8_slowed_down&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;GooglePixel&#x2F;comments&#x2F;1wtxm0m&#x2F;pixel_...

      <a href="https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;GooglePixel&#x2F;comments&#x2F;1wu9j93&#x2F;is_there_any_chance_google_will_address&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;GooglePixel&#x2F;comments&#x2F;1wu9j93&#x2F;is_the...

      <a href="https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;GooglePixel&#x2F;comments&#x2F;1wt0od2&#x2F;new_update_is_really_slowing_my_9a_down_anyone&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;GooglePixel&#x2F;comments&#x2F;1wt0od2&#x2F;new_up...

      <a href="https:&#x2F;&#x2F;support.google.com&#x2F;pixelphone&#x2F;thread&#x2F;470741051&#x2F;september-update-android-17-made-my-pixel-laggy-and-notifications-won-t-show-in-the-shade?hl=en" rel="nofollow">https:&#x2F;&#x2F;support.google.com&#x2F;pixelphone&#x2F;thread&#x2F;470741051&#x2F;septe...

      <a href="https:&#x2F;&#x2F;support.google.com&#x2F;pixelphone&#x2F;thread&#x2F;470915661&#x2F;phone-running-slowly-after-the-september-update?hl=en" rel="nofollow">https:&#x2F;&#x2F;support.google.com&#x2F;pixelphone&#x2F;thread&#x2F;470915661&#x2F;phone...

      <a href="https:&#x2F;&#x2F;support.google.com&#x2F;pixelphone&#x2F;thread&#x2F;470545577&#x2F;major-pixel-9-pro-issues-starting-9-23?hl=en" rel="nofollow">https:&#x2F;&#x2F;support.google.com&#x2F;pixelphone&#x2F;thread&#x2F;470545577&#x2F;major...

      <a href="https:&#x2F;&#x2F;support.google.com&#x2F;pixelphone&#x2F;thread&#x2F;470645986&#x2F;laggy-and-frozen-after-september-update?hl=en" rel="nofollow">https:&#x2F;&#x2F;support.google.com&#x2F;pixelphone&#x2F;thread&#x2F;470645986&#x2F;laggy...

      <a href="https:&#x2F;&#x2F;support.google.com&#x2F;pixelphone&#x2F;thread&#x2F;470478102&#x2F;phone-became-noticeably-laggy-after-the-september?hl=en" rel="nofollow">https:&#x2F;&#x2F;support.google.com&#x2F;pixelphone&#x2F;thread&#x2F;470478102&#x2F;phone...

      <a href="https:&#x2F;&#x2F;support.google.com&#x2F;pixelphone&#x2F;thread&#x2F;470472092&#x2F;pixel-6a-lagging-after-september-2026-update?hl=en" rel="nofollow">https:&#x2F;&#x2F;support.google.com&#x2F;pixelphone&#x2F;thread&#x2F;470472092&#x2F;pixel...

      Here are some news articles which are primarily about this issue:

      <a href="https:&#x2F;&#x2F;www.droid-life.com&#x2F;2026&#x2F;09&#x2F;22&#x2F;latest-pixel-update-either-greatest-ever-or-buggiest-ever&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.droid-life.com&#x2F;2026&#x2F;09&#x2F;22&#x2F;latest-pixel-update-ei...

      <a href="https:&#x2F;&#x2F;www.androidpolice.com&#x2F;google-pixel-september-update-issues&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.androidpolice.com&#x2F;google-pixel-september-update-...

      <a href="https:&#x2F;&#x2F;www.androidauthority.com&#x2F;android-17-qpr1-issues-survey-3717366&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.androidauthority.com&#x2F;android-17-qpr1-issues-surv...

      There are also new Wi-Fi compatibility issues covered in those news articles. However, it&#x27;s fairly likely that&#x27;s caused by fixing security vulnerabilities which caused routers with a buggy implementation of the protocols to become incompatible. It&#x27;s something we&#x27;ve seen happening regularly with Wi-Fi and especially Bluetooth. Older Bluetooth devices not receiving updates are increasingly becoming incompatible with smartphones receiving proper security updates. Android only lists a tiny portion of driver and firmware patches in the Android Security Bulletins so OEMs aren&#x27;t obligated to ship the patches and non-Pixel devices largely aren&#x27;t shipping most of it so they don&#x27;t experience as many incompatibilities. Pixels get more Wi-Fi and Bluetooth incompatibilities due to actually getting the security updates for those. Other devices may eventually get it many months or even over a year later after many routers get updated and sometimes workarounds are implemented on the client side.

      We&#x27;re not going to complain about Google fixing security vulnerabilities requiring a break in compatibility, but they announced that&#x27;s what they&#x27;re doing if it&#x27;s the cause and provided a per-network toggle to work around it. Wi-Fi authenticated encryption often isn&#x27;t particularly important since nearly everything has authenticated transport encryption and people can also use a VPN to avoid revealing their connections to local networks. A compatibility toggle with a security warning would make sense. The same applies to a lesser extent to Bluetooth.

      It&#x27;s also worth noting there are a bunch of unpatched upstream kernel vulnerabilities in the Pixel OS with publicly available exploits on GitHub and elsewhere. A bunch of companies selling exploit tools are actively using those vulnerabilities to exploit Pixels. Google isn&#x27;t doing much about it since their release engineering process is so slow combined with the Generic Kernel Image (GKI) system entirely collapsing under the weight of AI accelerated vulnerability discovery. We&#x27;re having to pick up the pieces from the mess created by GKI by doing painful merges of the upstream updates for the short term and then outright replacing it with directly using the upstream kernels for the long term. Android works with the upstream kernel releases but the drivers for devices are written against the GKI interface. We need to port a minimal GKI interface to the upstream kernels and update the drivers to handle dropping the ABI stability it provides.

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.