Google switched to a performative Android Security Bulletin system with vulnerabilities listed 2-4 months after they're shipped. They're pretending as if not open sourcing patches protects people from OEMs not patching them. Our community has people successfully reverse engineering binary patches.
Google needs to start open sourcing QPR1 and QPR3 releases again along with open sourcing security preview patches shortly after disclosure to OEMs. Otherwise, we'll just hire people to start doing reverse engineering work in an official capacity to start publishing the changes as open source early.
@GrapheneOS You guys should just deviate from depending on Google & go standalone.
@mortal_engine @GrapheneOS that's nonsensical (without imagining structural changes at large scale)
Google's investment in Android and Pixel is pivotal to Graphene's value proposition. Another way is possible but it'll be terribly expensive and risky.
I would wager nearly everyone using GrapheneOS is running play services sandboxed at least part of the time.
@brett @mortal_engine @GrapheneOS
so what?
slightly less shit is still better.
@jvnebnunny @brett @mortal_engine @GrapheneOS With all due respect, are these your last words before you download something sus from the Internet?
@dasmatus @brett @mortal_engine @GrapheneOS
graphene is fully audited. the idea that it sus is bullshit
@jvnebnunny @brett @mortal_engine @GrapheneOS I meant a random APK
@dasmatus @jvnebnunny @brett @mortal_engine @GrapheneOS unlike desktop OSs, Android and iOS have a robust security model which mean that it is in fact safe to download random apps.
On Windows, Linux or macOS, if an app does malware-y stuff like encrypting your files, stealing passwords, or listening through the microphone in the background, that's your fault for installing an untrusted app. On Android and iOS it would be a security vulnerability in the OS itself.
@anselmschueler @dasmatus @jvnebnunny @mortal_engine @GrapheneOS
We all know that historically there’s never been any flaws in mobile OSes. 🙄
@brett @mortal_engine @GrapheneOS Or in another profile.
@brett @mortal_engine That's definitely not the case. GrapheneOS didn't have the sandboxed Google Play compatibility layer until mid-2021 and was started in 2014. Many of our users still avoid using it. Many people only use it sparingly in a secondary profile, often even a whole secondary user rather than an easier to use nested profile (work profile or Private Space). It's likely around 70% of GrapheneOS users are using sandboxed Google Play in some form but many of those in dedicated profiles.
@GrapheneOS yes please!! Google is just ruining android