For years, Gaël Duval has spearheaded a campaign to misrepresent GrapheneOS as not being usable, not compatible with apps and only useful to a tiny minority of people. He has repeatedly claimed GrapheneOS is for pedophiles, criminals and spies while claiming /e/ is for everyone.
It's hardly only GrapheneOS focusing on protecting users against exploits. Apple and Google have put a ton of work into it. Apple heavily focuses on privacy and security. That includes protecting against remote exploits, local exploits from compromised apps and data extraction.
GrapheneOS and iOS are both heavily focused on privacy and security. Both are gradually adding much stronger protections against apps/sites scraping data, coercion users into giving data via alternatives with case-by-case consent and increasingly strong exploit protections.
/e/ is far weaker in all of these areas compared to the standard Android Open Source Project on secure hardware. It doesn't keep up with standards updates and protections. It adds tons of low security attack surface and privacy invasive services. It's not in the same space as us.
/e/ and Murena devices are far worse for privacy and security than an iPhone. It's trivial to break into their devices remotely or extract data from them compared to an iPhone. They have weaker privacy protections from apps too. Their main approach to privacy is a DNS blocklist.
Their DNS blocklist can only block domains not used for useful functionality to avoid ruining usability. Meanwhile, the most privacy invasive behavior by apps is rarely ever split out into separate domains. Even for those, apps and websites can trivially evade DNS blocklists.
It's common for apps and websites to do everything through their own servers. That's best practice to avoid leaking API keys. It's increasingly common for invasive libraries to use hard-wired IPs and/or DNS-over-HTTPS to evade blocking. DNS filtering is increasingly less useful.
Murena is a for-profit company owned by shareholders including Gaël Duval. /e/ has a non-profit organization which is also led by Gaël Duval. /e/ includes paid services from Murena. /e/ very clearly exists to build products for Murena to sell in order to enrich the shareholders.
Despite being done for profit, /e/ receives millions of euros in funding from the EU on an ongoing basis. /e/ and Murena use extraordinarily inaccurate marketing to not only promote their products/services but also to mislead people about GrapheneOS and scare them away from it.
Recently, France's national law enforcement began fearmongering about GrapheneOS and smearing it with inaccurate claims. France's corporate and state media heavily participated. Many articles and also radio/television coverage misrepresented GrapheneOS as being for criminals.
Across French corporate and state media covering it, inaccurate claims by the state about features, distribution and marketing of GrapheneOS were wrongly presented as fact. Most of them didn't contact us and we weren't shown what was being claimed so we could properly respond.
Here are several particularly egregious examples:
Gaël Duval and Murena participated in these attacks. They even spread harassment content towards our team and shared it with sites attacking us.
/e/ and Murena are based in France. They've been pushing false narratives about GrapheneOS falsely claiming it isn't usable by regular people and doesn't benefit them for years. Duval has been making the ludicrous claim GrapheneOS is only useful to criminals and spies for years.
/e/ and Murena aren't on the same side as GrapheneOS. They're charlatans selling devices with poor privacy and atrocious security to earn money. They've spent years trying to undermine a legitimate privacy project and heavily use the same talking points as police state advocates.
Their marketing heavily focuses on avoiding Google and gives the impression they believe privacy means avoiding one company. Meanwhile, they add a bunch of Google services not present in the Android Open Source Project and give extensive privileged access to Google apps/services.
/e/ and Murena have their own privacy invasive behavior in their apps and services. One particularly egregious example is their supposedly private speech-to-text service sending user data to OpenAI without consent instead of doing most locally like Apple:
https://community.e.foundation/t/voice-to-text-feature-using-open-ai/70509
/e/ and Murena have repeatedly claimed GrapheneOS is for drug dealers, pedophiles, terrorists and spies. /e/ and Murena are anti-privacy. They're heavily profiting from marketing products as private but don't believe in it. /e/ is an authoritarian-aligned fake privacy project.
France is the most anti-encryption, anti-privacy and anti-security country in the EU. They've been doing a gradual crackdown on open source privacy projects including GrapheneOS and Signal with escalating smears and threats. /e/ and Murena are on the side of the police state.
That interview is not Gaël Duval misspeaking but rather he's expressing views we've seen him communicate in written form many times before. He has repeatedly misled people about what GrapheneOS provides and claimed it's only useful to criminals. He supported those media attacks.
Gaël Duval has repeatedly spread harassment content targeting our team with fabricated stories and bullying. Perhaps all of this is because he wants to maximize profits for Murena, but how is he going to achieve that by claiming serious privacy and security is for pedophiles?
Here's a paywall bypass for the 2 paywalled articles above:
These are among the most egregious cases of France's corporate and state media presenting highly inaccurate state smearing of GrapheneOS as fact but there's much more.
Apr 5, 2026, 8:48 PM
@GrapheneOS woo interesting I didn't know those declaration from Gael 😵💫 about you as project
@GrapheneOS
In a world of corporate and state over reach, anyone wanting privacy is the enemy.
@GrapheneOS And this thing is old, for example, back when the first versions of Firefox were released, France had demanded versions of Firefox with significantly reduced security to allow law enforcement agencies to take remote control of it. I didn’t know about it at the time; I was too young, but I know it happened.
During the gradual transition to encrypting the web, France was reluctant and initially wanted to limit encryption to states websites and banks.
Surveillance by the French government has taken an even more aggressive turn since 2015, following the Charlie Hebdo attacks.
The GDPR has so far proven ineffective, and it is mainly due to the censorship and decisions of the Constitutional Council and the Court of Justice of the European Union that the French government is prevented from going further than it would like, but every year, it tries to circumvent these decisions.
Apr 6, 2026, 1:40 PM30(-ish) toots yesterday and today on /e/. Have you considered increasing the character limit per toot? Perhaps one longer toot (let's say, 1500 characters? 3000?) could summarise all your views on this topic?
@jon_bon Why doesn't Mastodon provide configuration for character limit through the configuration file? If it provided it, we would increase the limit to a much larger value. Since it doesn't, we're not currently doing it. We don't really want to have to patch each release of Mastodon and make sure we don't miss any new places they reference the hard-wired value of 500. We could do that but we prefer using the unmodified package which is why we haven't done it yet.
@GrapheneOS Privacy isn't a crime
Apr 5, 2026, 10:29 PM@codimp je n'ai trouvé aucune source à ce sujet, ça a été répété par le gars de GOS, mais comme d'hab dans ses attaques gratuites contre le reste du monde (Lineage, MicroG, Murena, F-Droid, etc.) il faut le croire sur parole, et si tu insiste il dis que tu fait partie d'une cabale qui le harcèle :-/
@bohwaz
C'est dans la vidéo en tête de fil
@GrapheneOS Can't wait for your Motorola partnership to further legitimize GrapheneOS.
Apr 5, 2026, 9:39 PM@GrapheneOS Le Parisien :
"Ces engins jusqu’à présent inviolés, qui protègent les communications et qui ne partagent pas les données sur les serveurs, sont un nouveau défi que le parquet cyber entend bientôt relever."
C'est exactement pareil avec Signal sur Android si on n'utilise pas le cloud, ils nous prennent pour des imbéciles.
@davep @GrapheneOS Hahaha, furthermore, this false claim makes no sense: GrapheneOS does not route user communications through these servers; GrapheneOS is not a company and does not offer services such as messaging or email etc.
@GrapheneOS thats how you know you are doing something right
@GrapheneOS I boosted this out of sympathy, but are there public sources for these statements?
@GrapheneOS
they dont like free competiting with their paid services/products?
Apr 8, 2026, 8:29 AM@GrapheneOS same question, do you have a source about this funding? Genuinely curious.
@fla Here's one of many cases you can hear it in his own words:
https://www.projets-libres.org/en/podcast/e-os-a-degoogled-android-gael-duval-e-foundation-murena/
> The European Union has subsidized us to the tune of several million for this project.
You can find the details of the millions of euros in funding being given to /e/ and how /e/ is heavily influencing where the money is going. They're steering government funding towards themselves and projects aligned with them. Many of these projects have a history of attacking the GrapheneOS project and our team.
Apr 5, 2026, 9:10 PM@GrapheneOS So just the basic stuff you can already get from a pi-hole, DDG app tracking protection etc.
Apr 5, 2026, 9:00 PM@GrapheneOS to be fair they don't promise security, only privacy. at least in their foreword on their website here.
I don't think it's by accident that they don't even use the word secure, or security, on the whole page.
I've seen claims before where they claim it's better than GrapheneOS. But in what regard? Maybe degoogling and having alternatives pre-installed? GrapheneOS is probably more involved to get the same apps. That's the only way /e/ is better in my opinion
Apr 5, 2026, 9:02 PM@GrapheneOS but I'm fine with not even comparing them. grapheneos is an OS and /e/ is a ROM
@codebam @GrapheneOS They are both operating systems. ROM is an inaccurate term.
Apr 5, 2026, 9:15 PM@HybridStaticAnimate @GrapheneOS well it is a ROM in the sense that you flash it with TWRP, or you can
Apr 5, 2026, 9:16 PM@HybridStaticAnimate @GrapheneOS GrapheneOS is a factory image and is used with a locked bootloader
@codebam @GrapheneOS Yes, that doesnt mean anything in this context though.
@codebam @GrapheneOS This does not make something a ROM. ROM is an inaccurate term.
Apr 5, 2026, 9:25 PM@HybridStaticAnimate @GrapheneOS fair enough, I was just calling it a ROM in the sense that it's just as insecure, if not more, than the ROMs (or operating systems) people were flashing directly to their /system and /data partitions back in like 2014
They dont provide privacy. So a promise is already broken. But beyond that, privacy cannot exist without security. They arent mutually exclusive, they are intertwined. To ignore security means you are not a privacy project.
E/ is not better at degoogling. GrapheneOS does not connect to any google servers, run any google play code, have any privilege google services, etc. Sandboxed google play is sandboxed and must be installed by the user. All default connections are to first party servers hosted by GOS. It is not more involved to get the same apps, google or otherwise.
@HybridStaticAnimate @codebam @GrapheneOS
That it must be installed by the user doesn't make it different.
IMHO the two app stores included in GrapheneOS are not sufficient for the vast majority of users.
If "every" user needs to install it to have a usable phone, it really is part of the attack surface.
(And yes, I'm aware the Play services are sandboxed on GrapheneOS which improves privacy and security)
It's a bit like delivering a computer without network functionality because it reduces the attack surface, and then blaming the user if they install network drivers.
@realn2s @HybridStaticAnimate @codebam
> IMHO the two app stores included in GrapheneOS are not sufficient for the vast majority of users.
Our own App Store is the only one included in GrapheneOS. We don't bundle third party apps and services into the OS. Using those is entirely a user choice and will remain that way.
Our App Store provides Accrescent and the Play Store. If you think other apps such as Obtainium should be easily available then get those to submit their apps into Accrescent.
@codebam /e/ doesn't have similar privacy protections as GrapheneOS. Unlike GrapheneOS, /e/ connects to a bunch of Google services by default and also unlike GrapheneOS gives extensions privileged access to Google apps and services. We don't use the term degoogled and it's not the purpose of GrapheneOS but GrapheneOS does only connect to our own servers by default and does not give any privileged access to installed Google apps without the user explicitly enabling narrow forms via a few toggles.
@codebam /e/ fails to keep up with standard privacy patches and fails to provide standard privacy protections. /e/ has privacy invasive apps and services included. They have user tracking via a unique random identifier in their update client and multiple invasive services which are marketed as private when they aren't. They've had issues including leaking files stored in their cloud server to other users which turned out to clearly not actually be E2EE. Privacy also heavily depends on security.
@GrapheneOS So, your recommendation is, if I don't want to buy a Google Pixel, to buy an iPhone instead of another Android phone which can run LineageOS? Just asking for clarification.
@GrapheneOS I don't think you should attack frontally others like that whenever 😶
Reminding security is privacy is good.
Responding to attacks is good (which is not the case *here*)
I understand its CEO and the Murena company might have attack the GrapheneOS project in the past, and responding to that was normal too.
But I don't see attacking /e/OS like that often as a positive feedback in general. A simple reminder could have been enough.
❤️ on the GrapheneOS project btw
@GrapheneOS I prefer seeing post about GrapheneOS or Android security from your account than continous attacks on other projects (even if they are legitimatel), but that's my personal opinion
@blueluma /e/, Murena and Duval have been continuously attacking the GrapheneOS project for many years. They've misled a huge number of people about what GrapheneOS provides. Many people wrongly believe GrapheneOS isn't for them because of this.
GrapheneOS is a highly usable OS with far broader app compatibility than /e/. Unlike /e/, GrapheneOS has major privacy enhancements instead of rolling back privacy compared to the Android Open Source Project. /e/ adds a bunch of invasive apps/services.
@blueluma Gaël Duval has repeatedly claimed serious privacy and security projects are only for pedophiles, criminals and spies. They've specifically said this about GrapheneOS many times but have also attacked Signal before too.
Duval, /e/ and Murena aren't on the same side. They're doing what they think will make them money which is compromising between privacy and state access. They present protecting privacy from more than American corporations as nefarious. They're undermining privacy.
"I don't think you should attack frontally others like that whenever"
Gael Duval attack GrapheneOS, GrapheneOS responds to these attacks.
"I understand its CEO and the Murena company might have attack the GrapheneOS project in the past"
It's not in the past, these attacks are recuring, and he does it again in this recent video. Duval has been waging a disinformation campaign against GOS for years.
@Xtreix @GrapheneOS this post does not respond to a direct attack as far as I know
@blueluma @Xtreix It's a response to a long series of attacks by Duval on GrapheneOS claiming it's only useful for pedophiles, criminals and spies. He didn't specifically name GrapheneOS as part of the interview we showed a clip from but he certainly has elsewhere on a regular basis. We felt people would take it more seriously with him saying it out loud in a video as opposed to his regular posts across platforms where he says it. That's why we chose this over the many other cases he did it.
@GrapheneOS @blueluma @Xtreix I also think it's not the best to directly attack them and others. Stating that GOS is better than others and how smooth it works can be presented in a better way. I'm not a PR specialist but disputing false claims maybe can be done in a better way without "sounding desperate". Sry not native English and therefore don't finding the right words.
GOS is strong and works nice and I I'm so excited about the Motorola cooperation. Keep on with this awesome work.