Andromxda
Joined 1 year ago
Joined 1 year ago
I get the point you're trying to make, but in reality, it wouldn't be very useful. Many security features of GrapheneOS could easily be bypassed, due to flaws in LineageOS, such as the fact that they ship userdebug instead of production builds, don't really allow for bootloader relocking, etc. High-level improvements like the GrapheneOS hardened memory allocator, Auditor app (hardware-based remote attestation/device integrity monitoring), etc. are pretty useless, when the entire system has an unlocked bootloader and thus no verified boot, weakend SELinux policies due to the use of userdebug builds, etc. GrapheneOS also purposely narrows the list of supported devices for security reasons. They mandate a high-quality secure element, hardware memory tagging, etc. whereas LineageOS tries to support as many devices as possible. Those two very different philosophies simply aren't compatible.
> GrapheneOS is permissively licensed and is usable for building devices with an immutable root of trust. GPLv3 is deliberately incompatible with these kinds of locked down devices, unlike GPLv2 code such as the Linux kernel. This means GrapheneOS can't include GPLv3 code without forbidding use cases we want to support. GPLv3 is no problem for our own usage, but we don't want to forbid using GrapheneOS as a replacement for the Android Open Source Project in locked down devices.
They're not against GPLv3 and, but they explain why it's not suited for a project like GrapheneOS.
[1] https://grapheneos.org/faq#:~:text=In%20some%20cases,locked%...
Leaked documents from mobile forensics companies, such as Cellebrite or XRY confirm this. It's impossible to crack a Pixel with GrapheneOS in BFU state. See https://grapheneos.social/@GrapheneOS/112462758257739953 and https://grapheneos.social/@GrapheneOS/112826067364945164
Uh, no? How are you getting this idea?
This is the manifest file for GrapheneOS: https://github.com/GrapheneOS/platform_manifest/blob/17/defa...
It literally contains links to all the AOSP repos or GrapheneOS forks of them. You can clone these exact repos and build the OS from source. GrapheneOS provides instructions for it: https://grapheneos.org/build
> Micay is somewhat Russian-sounding too
Sorry what?
2) The point still stands, desktop operating systems like Windows and desktop Linux distributions are much less secure than Android or iOS. Read https://privsec.dev/posts/linux/linux-insecurities/