GrapheneOS

Open source privacy and security focused mobile OS with Android app compatibility.

Website: https://grapheneos.org/
Forum: https://discuss.grapheneos.org/
X: https://x.com/GrapheneOS
GitHub: https://github.com/GrapheneOS

Public Key

npub1kwarc5z9lwhen05uknd2nuwhhthd4ws0cku3t9j3rchm0fcd6luslse0nj

NIP-05 Address

grapheneos_at_grapheneos.social@momostr.pink

Profile Code

nprofile1qqst8w3u2pzlhtueh6wtfk4f78tm4mk6hg8utwg4jeg3utah5uxa07gprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntqy8hwumn8ghj7mn0wd68ytnddaksa7s7xx

Publishing to

relay.momostr.pink

nostr.mom

relay.primal.net

Author Public Key

npub1kwarc5z9lwhen05uknd2nuwhhthd4ws0cku3t9j3rchm0fcd6luslse0nj

Show more details

Last Notes

2026-09-18 21:28:06 UTC

Vanadium version 153.0.8010.52.0 released:
https://github.com/GrapheneOS/Vanadium/releases/tag/153.0.8010.52.0
See the linked release notes for a summary of the improvements over the previous release and a link to the full changelog.
Forum discussion thread:
https://discuss.grapheneos.org/d/42105-vanadium-version-15308010520-released
#GrapheneOS #privacy #security #browser

2026-09-18 12:35:24 UTC

GrapheneOS version 2026091700 released:
https://grapheneos.org/releases#2026091700
See the linked release notes for a summary of the improvements over the previous release.
Forum discussion thread:
https://discuss.grapheneos.org/d/42090-grapheneos-version-2026091700-released
#GrapheneOS #privacy #security

2026-09-18 12:05:44 UTC

- reply

No, their devices have very poor updates and security features.
Fairphone 5 and earlier have end-of-life kernels without security support. Their newer devices will too. They lack proper firmware, driver and HAL updates too.
There's no proper secure element and many other missing security features.
Fairphones are designed and made by T2Mobile. Fairphone aren't the ones designing the devices and aren't in a position to make the massive improvements needed to meet our requirements.

2026-09-18 12:05:37 UTC

- reply

2026-09-16 20:07:03 UTC

- reply

No, and we still plan to support the Pixel 11 series as long as it gets fully functional MTE support.

2026-09-16 19:14:55 UTC

- reply

Performance appears to be fine for MTE on the Pixel 11. We don't know which it was completely removed from firmware and disabled at launch. It's added back to firmware but still disabled in Android 17 QPR2 Beta 4 which was released after our initial thread about it. We used that to enable it and test it. It passes all our tests and other standard tests. We benchmarked it and the performance is fine. There may be cases where it has higher overhead but the faster CPUs make up for it.

2026-09-16 19:01:35 UTC

- reply

> With today's AI-powered rapid reverse-engineering, isn't releasing a security fix tantamount to disclosing the vulnerability to threat actors?
Yes, and we can reverse engineer it ourselves to ship it before December 2026 so it's not the end of the world.
It heavily draws into question what is supposed to be accomplished by the security preview system instead of simply allowing the patches to be shipped immediately as source code. It's hardly hidden by hiding that for months.

2026-09-16 19:00:19 UTC

- reply

It will be far easier for us to support upcoming Motorola devices than Pixels. Qualcomm will hopefully expand MTE support beyond the highest end flagship SoC soon so we can expand to more than flagships. Pixel 11 didn't remove it from hardware, only firmware, so that's good news.

2026-09-16 18:54:53 UTC

- reply

Pixels are now significantly harder to support than many other devices. One of the only advantages of Pixels is now a disadvantage instead. They're still the best fit for us due to the updates and security features but it burns time we want to spend on privacy and security work.

2026-09-16 18:54:45 UTC

- reply

We could have shipped an Android 17 QPR1 update already since our port was completed. Instead, we have to deal with ongoing pain until Android 17 QPR2 is released in December 2026. This will not be an issue for Motorola since we'll have official firmware and driver code provided.

2026-09-16 18:54:31 UTC

- reply

Google is also once again failing to comply with our GPL source requests for weeks. We requested CD1A.260905.001.A1 sources on September 1st and were only provided access today. The kernel build IDs are the same for 17 QPR1 Beta 9 and 17 QPR1 so we have that already at least.

2026-09-16 18:43:20 UTC

- reply

It would be interesting to know if Google's legal team is aware they're giving Pixels months of early access to new Android features and bug fixes including certain important security patches. Pixels being given this competitive edge over Google's OEM partners is very dubious.

2026-09-16 18:40:10 UTC

- reply

Google should not be gatekeeping security patches to the standard Android platform code from Android OEMs but that's what they've started doing. Other OEMs will get these patches in December 2026 via Android 17 QPR2. We can ship them early by reverse engineering the code instead.

2026-09-16 18:33:56 UTC

- reply

Pixel Update Bulletin for September 2026 has additional patches to standard Android platform components used by non-Pixel devices. These patches are relevant to non-Pixel devices but haven't been made available via the September 2026 Android Security Bulletin or preview patches.

2026-09-16 18:30:10 UTC

- reply

We already ported our code to Android 17 QPR1 since before it was released on September 15th but don't have permission to release it yet. We're working on backporting Pixel firmware, kernel drivers, userspace drivers and HALs from Android 17 QPR1 to Android 17 for now instead.

2026-09-16 18:26:22 UTC

- reply

Non-Google Android OEMs and AOSP-based projects can ship yearly and QPR2 releases. There are also security backports to those releases. Security preview access is needed to ship patches without months of delay. We've had that since before our Motorola partnership via another OEM.

2026-09-16 18:15:31 UTC

Android 17 QPR1 is the first release since Android Honeycomb (3.x) adding new APIs for app developers without a release to the Android Open Source Project. The new APIs are currently exclusive to the Pixel OS and aren't available to other Android OEMs.
https://developer.android.com/sdk/api_diff/37.1/changes

2026-09-16 12:51:37 UTC

- reply

When we update the Pixel firmware, kernel drivers, userspace drivers and HALs to the September 2026 release from today that will be noted in the release notes. It will not contain a list of fixed CVEs since there's already an upstream list. You cannot search for a CVE on our release notes page to determine whether it was fixed. That's a common misconception created by the list of CVEs for security preview releases which are Android Security Bulletin YYYY-MM-01 patches provided early.

2026-09-16 12:49:43 UTC

- reply

We don't provide a list of each CVE for fixed vulnerabilities. It's up to the upstream projects to list those and we reference the upstream updates. We only reference CVEs in specific cases where we specifically backported those patches ourselves. The list of CVEs at the bottom of each of our release notes sections is a list of the current backports from the security preview releases which were not already present in our main releases. It doesn't list ones already in regular releases.

2026-09-16 12:36:14 UTC

- reply

CVE-2026-58704 is a modem firmware vulnerability with a patch released today and it will be included in our upcoming release.

2026-09-16 12:35:35 UTC

Vanadium version 153.0.8010.47.0 released:
https://github.com/GrapheneOS/Vanadium/releases/tag/153.0.8010.47.0
See the linked release notes for a summary of the improvements over the previous release and a link to the full changelog.
Forum discussion thread:
https://discuss.grapheneos.org/d/42045-vanadium-version-15308010470-released
#GrapheneOS #privacy #security #browser

2026-09-13 13:10:27 UTC

- reply

> What about Taler instead, which truly is cash-like?
It's far further from cash than Monero and Monero is not the only cryptocurrency with privacy. Taler doesn't provide similar functionality able to replace existing systems. It deliberately avoids providing privacy on the receiving end too.

2026-09-13 13:05:34 UTC

- reply

The initial device won't but it's possible there will be future devices with one.

2026-09-13 01:33:01 UTC

- reply

More information:
https://grapheneos.social/@GrapheneOS/117225731764489295
#note1ltd…wa3f

2026-09-13 01:32:16 UTC

Secure paste has been merged into GrapheneOS to provide a replacement for focused apps being able to read the clipboard:
https://github.com/GrapheneOS/platform_frameworks_base/pull/435

2026-09-13 01:17:37 UTC

- reply

The point is that they banned open source projects providing the tools we use to obtain our funding and pay developers.
We strongly support building full alternatives to banks and centralized financial services. We also strongly believe those should use encryption to provide strong privacy, unlike Bitcoin and Ethereum which enable mass surveillance of financial transactions in their own way.
We're not on the same page as a project which is against escaping corporate finance.

2026-09-12 23:10:21 UTC

- reply

We don't have a large carbon footprint for what we are doing. The whole point is that line of attack doesn't make sense. What we're doing is not using a large amount of power especially compared to available alternatives with far worse results. Fuzzing would use drastically more power but yet none of you would be bothering us about it. It is clearly not about resource use.
Back to claiming we're crazy again too.

2026-09-12 22:48:14 UTC

- reply

We never said anything of the kind and don't appreciate baseless claims that we're somehow crazy.

2026-09-12 22:24:30 UTC

- reply

We never said it banned software funded by cryptocurrency. That's a misrepresentation of what we said in the linked post by someone who keeps posting many lies and misrepresentations to direct hate towards GrapheneOS.

2026-09-12 22:15:25 UTC

- reply

We accept donations with the ones listed as https://grapheneos.org/donate and mostly use Ethereum, Monero and Bitcoin ourselves.

2026-09-12 22:12:32 UTC

- reply

LineageOS and especially operating systems based on it are the opposite of privacy and security hardened. It does not appear to matter to people recommending moving to those throughout these threads that they use generative AI themselves:
https://github.com/LineageOS/charter/blob/main/ai-coding-assistants.md
Here's another recent thread addressing a way people are being misled:
https://grapheneos.social/@GrapheneOS/117217086326813038
Motorola Mobility is wholly owned by Lenovo and has nothing to do with Motorola Solutions beyond a shared history prior to 2011.
#note10df…zlpx

2026-09-12 21:55:20 UTC

- reply

An experimental branch in our Camera repository was rebased on top of main which results in the commits being orphaned.
Nothing in that experimental branch is against our publicly stated policies and none of it is hurting code quality. Only high quality code will be merged upstream as always.
We've renamed it from compose to compose-prototype to help address it being misrepresented.
Defederating abusive people and moving content to our top-level feed is also the opposite of a cover-up.

2026-09-12 21:33:21 UTC

- reply

Similarly to AI, social media has been an incredibly disruptive and largely harmful technology. The recent days of hive mind abuse towards us are a great example. We're still using social media to publish information about GrapheneOS and communicate. We even have accounts on Facebook and LinkedIn.
No amount of abuse will change our minds about what we believe is the best way to approach the brave new world we live in. We'll continue doing what we believe is best for our users and the world.

2026-09-12 21:13:14 UTC

- reply

Privacy and security on computers was always always thoroughly neglected. It is no longer nearly as viable to continue doing so and dismissing it as only mattering in targeted attacks.
The vulnerabilities being discovered were nearly entirely already there and it's a good thing they're getting found and fixed. Many years of technical debt must be repaid. Decisions such as monolithic kernels and massive codebases written in C and C++ must be repaid. We have to somehow keep users safe through it.

2026-09-12 21:05:53 UTC

- reply

LLMs are a massively disruptive technology causing a lot of harm and information security is one of the areas most impacted by it. It has been heavily adopted for offense and defense. It's very scary how good the latest models are at finding vulnerabilities and even developing exploits for those. It isn't viable for GrapheneOS to pretend that isn't the case and skip protecting our users from it. There's an ongoing crisis for privacy and security but attackers only have a temporary advantage.

2026-09-12 20:59:44 UTC

- reply

Directing endless hate towards us with lies, misrepresentations, bullying and vitriol is not going to convince us that we've made any incorrect decision in our approach to this. We believe we're doing a large amount of good with our approach and that it massively outweighs the harm.
AI is being used to harm our users with far more powerful surveillance tech, rapid vulnerability discovery, rapid exploit development and much more. If we did not adapt then we would be failing to protect our users.

2026-09-12 20:54:36 UTC

- reply

Many of the recent threads attacking us are doing so with fabricated stories where they falsely claim we've covered up how we use technologies. In reality, these attacks started because we've been transparent.
The recent attacks began when we replied to a question about how we use AI. After the attacks began, we made a top-level thread explaining our AI policies and how we arrived at those:
https://grapheneos.social/@GrapheneOS/117236529351603001
We believe it's the right approach for us minimizing harm and maximizing good.
#note1tpj…v6ye

2026-09-12 20:43:11 UTC

- reply

We strongly believe in privacy including for financial transactions. People should expect nothing less from a privacy project.
It should be obvious we aren't fans of traditional banking and financial services built to enable mass surveillance.
We also aren't fans of unencrypted blockchains and believe those should be fixed.
We believe in the privacy of cash being preserved in the same way we believe in people's private conversations and thoughts being protected.
https://grapheneos.social/@GrapheneOS/117249893761790371
#note1zm9…aftl

2026-09-12 20:37:15 UTC

- reply

Cryptocurrency enables us to reliably pay a team distributed around the world. It has provided the majority of our funding and is how we're able to run GrapheneOS as a non-profit entirely funded by donations. Many other privacy projects also receive the majority of their donations via cryptocurrency.
We're being attacked because we're transparent about how we're funded, how we pay our team and our general belief in technology protecting people from authoritarian states.
https://grapheneos.social/@GrapheneOS/117249820677840570
#note1yel…0lsm

2026-09-12 20:22:24 UTC

This account has been posting lies about what GrapheneOS has said and done for the past several days. Those are being widely propagated across this platform. People are being played.
https://mas.to/@zzt/117246243842026067
This is very clearly a lie about what we said about codeberg and they're also lying about us about deleting posts we haven't. In previous threads they lied about us deleting a file we clearly never deleted and similarly lied about many things we said and did.
https://grapheneos.social/@GrapheneOS/117244144803720961

2026-09-12 19:22:07 UTC

- reply

Bitcoin's lack of on-chain privacy is a massive flaw. The mass surveillance enabled by the transparency blockchain is so far against the original ideals of the project.
Lightning doesn't provide strong privacy and isn't a solution to the lack of privacy in the Bitcoin base layer. Semi-centralized approaches as side chains aren't solving it either.
There's no fundamental blocker against Bitcoin implementing a shielded pool.

2026-09-12 17:58:15 UTC

- reply

You have to earn the ability to do it by posting comments which get positive karma. The same applies to downvoting and other things.

2026-09-12 17:46:18 UTC

- reply

She wasn't the only one doing it. A bunch of accounts with far more followers helped to spread lies and misrepresentations about what we've said and done. Many people engaged in personal attacks towards our team including referencing harassment content. Most instances are happy to allow people to link to and reference Kiwi Farms harassment content as long as there's some deniability through it being a link to a blog post or video based on Kiwi Farms content.

2026-09-12 16:36:03 UTC

- reply

We got the help we needed from people vouching for the past few weeks of our Hacker News posts and those are no longer hidden. That's why we made the thread and the situation is resolved for the time being. It doesn't solve the malicious accounts attacking us in each thread and flagging all of our posts but it's progress.

2026-09-12 16:33:25 UTC

- reply

The past few weeks of our posts on Hacker News are no longer wrongly hidden from everyone not logged into an account with "showdead" on. We spent a lot of time writing replies adding information, answering questions and making corrections as we do here. We didn't want it lost.

2026-09-12 16:31:11 UTC

- reply

Most of the responses we spent time writing on Hacker News over the past 2 weeks were flagged and hidden from everyone other than logged in accounts enabling "showdead". By making these threads on social media, we got the help we needed to get that undone. It was clearly worthwhile considering how much work went into writing all that content providing additional information, answering questions and making corrections.
You may not believe we get something out of it but we definitely do.

2026-09-12 16:29:25 UTC

- reply

It's important for GrapheneOS to get mainstream adoption and that means not ceding mainstream spaces to anti-GrapheneOS influence operations.

2026-09-12 16:20:34 UTC

- reply

You brought up how other operating systems were being heavily recommended to people. What you omitted is that those operating systems more heavily use AI than GrapheneOS and that it shows the attacks on us are disingenuous, dishonest, hypocritical and not being made in good faith.
https://github.com/LineageOS/charter/blob/main/ai-coding-assistants.md
We accurately called out personal attacks referencing harassment content and links to that harassment content being posted across the fediverse. Most instances freely allow it.

2026-09-12 16:15:28 UTC

- reply

The recent round of hate towards us on this platform primarily based on lying and misrepresenting things is a great example of the non-organic hate towards us. The accounts participating heavily lied about what we've said and done. They twisted things to attack us. It's yet another example of us being attacked to an extreme for things other projects aren't similarly targeted for doing. There were many recent attacks on the fediverse as part of this referencing harassment content.

2026-09-12 16:12:07 UTC

- reply

GrapheneOS gets a lot of support from people on Hacker News despite a bunch of malicious accounts trying to undermine us and moderation biased against us. We didn't have a solution to the past 2 weeks of our posts getting flagged today beyond asking for help on social media since we need people to vouch for our posts to undo that.
If we were going to leave hostile spaces then Mastodon would be the first to go especially after the most recent few rounds of unfair attacks on us.

2026-09-12 16:11:53 UTC

- reply

2026-09-12 15:41:31 UTC

- reply

Hacker News is owned by Y Combinator, an American venture capital firm heavily invested in surveillance tech. Their moderators have time to remove our posts for copy-pasting small amounts of text but not to remove years of libel and harassment. Perhaps it's time for legal action.

2026-09-12 15:34:37 UTC

- reply

There have been years of personal attacks directed towards our team on Hacker News primarily consistenting of libel. Many of these the threads with this content are highly search ranked. Hacker News moderators have been clearly active in many of those threads without removing it.

2026-09-12 15:31:52 UTC

- reply

Posts from these accounts making endless personal attacks on our team, linking to harassment content and making clearly disingenuous attacks are what should actually be getting flagged. Those posts getting flagged is becoming more common and the trolls have been complaining.

2026-09-12 15:21:55 UTC

- reply

If you have an established account on Hacker News, enable "showdead" in your settings, open our flagged posts and press "vouch" to help restore them. People have gone back through quite a lot of our posts and wrongly flagged them despite there being nothing inappropriate at all.

2026-09-12 15:20:22 UTC

- reply

There are numerous accounts malicious towards GrapheneOS on Hacker News which show up to make disingenuous attacks on it and downvote/flag all of our posts. Here's an example of one of those accounts which openly promotes Kiwi Farms harassment content:
https://archive.ph/JAunG

2026-09-12 15:13:51 UTC

Nearly all of the recent posts we've made on Hacker News are now being flagged which hides them from everyone by default. You can see this if you log into an account and enable "showdead" in your settings. Please vouch for our posts if you can do that.
https://news.ycombinator.com/threads?id=grapheneos

2026-09-11 21:23:06 UTC

- reply

We plan to add a feature for it.

2026-09-11 21:21:15 UTC

- reply

Search is a planned feature.

2026-09-11 21:21:07 UTC

- reply

Pixel 11 has an upgraded secure element but doesn't currently have support for MTE. Stock OS uses MTE for a small number of base OS processes and apps explicitly opting into it when users enable Android Advanced Protection Mode.
Pixel 11 appears to be in the process of getting MTE support added in which case it will be a minor security upgrade over the Pixel 10. We can add support for it if MTE gets added and is fully functionality. There's partial support in 17 QPR2 Beta 4.

2026-09-11 20:03:26 UTC

- reply

We can make it available for installation outside GrapheneOS through our App Store soon. However, we likely can't provide RCS outside of GrapheneOS and we don't want to encourage people to move away from using RCS with E2EE.

2026-09-11 20:02:46 UTC

- reply

The initial implementation will require sandboxed Google Play and then we can work on replacing it.

2026-09-11 19:35:06 UTC

- reply

Messaging will be overhauled even more. We plan to add RCS support with Messaging Layer Security (MLS). That will provide E2EE with contacts using Google Messages or iOS. RCS with MLS can already be used on GrapheneOS via Google Messages but we want to avoid people needing it.

2026-09-11 18:48:43 UTC

- reply

It's a massive overhaul and may need a few releases to reach the Stable channel. We're working on a version 14 release fixing issues with the predictive back animation, tapping contacts not always showing the right SIM with dual SIM and some outdated icons/colors we missed.

2026-09-11 18:21:49 UTC

- reply

We're going to be overhauling or replacing most AOSP apps in the near future: Calculator, Clock, Contacts, Gallery, Keyboard and Phone.
The apps we created will be overhauled too. PDF Viewer is done and Camera is next. Camera and PDF Viewer will be getting many new features too.

2026-09-11 18:14:41 UTC

- reply

You need to enable the Alpha channel for Messaging in App Store.

2026-09-11 18:14:25 UTC

The overhauled GrapheneOS Messaging app is available in our App Store via the Alpha channel.
Our new app development team worked on this for months. It's now a far better app with much higher quality code. We'll make a new release based on feedback soon.
https://grapheneos.social/@GrapheneOS/117253697387837898
#note12w5…f35l

2026-09-11 17:57:15 UTC

GrapheneOS Messaging version 13 released:
https://github.com/GrapheneOS/Messaging/releases/tag/13
See the linked release notes for a summary of the improvements over the previous release and a link to the full changelog.
Forum discussion thread:
https://discuss.grapheneos.org/d/41906-grapheneos-messaging-version-13-released
#GrapheneOS #privacy #security #android

2026-09-11 11:51:59 UTC

GrapheneOS version 2026091000 released:
https://grapheneos.org/releases#2026091000
See the linked release notes for a summary of the improvements over the previous release.
Forum discussion thread:
https://discuss.grapheneos.org/d/41899-grapheneos-version-2026091000-released
#GrapheneOS #privacy #security

2026-09-11 01:55:59 UTC

- reply

Pixel 11 will likely be improved to meet our requirements. Android 17 QPR2 Beta 4 added back MTE support after our initial thread about this. It turns out hardware support does exist. It's not clear why it was entirely unavailable and disabled in firmware at launch. There may be something wrong with it which has to be worked around in firmware. It may have simply not been implemented yet. We're now optimistic that we'll be able to support those alongside the Motorola devices.

2026-09-11 01:49:56 UTC

- reply

People's conversations, thoughts and financial transactions have been largely private for most of human history. Law enforcement still managed to do their jobs. They can continue to do so in a world where privacy technologies preserve historical privacy norms.
We use and support open source projects working on restoring the privacy provided by cash including Monero. Moving from cash to credit cards, PayPal, etc. is an ongoing privacy disaster. Bitcoin and Ethereum currently are too.

2026-09-11 01:31:21 UTC

@npub19xk…6hgp GrapheneOS is an open source privacy project with a development team spread around the world. It exists to protect people from corporate and government surveillance.
GrapheneOS isn't a business and our legal entity is a Canadian non-profit organization.
GrapheneOS is entirely funded by donations. The majority of the donations are made via cryptocurrency.
We pay people an hourly rate set in USD or CAD. We currently pay around 14 people with Ethereum donations and 1 person with CAD.

2026-09-11 00:30:58 UTC

- reply

LineageOS uses AI for development with far fewer safeguards. They do much less code review and have much lower standards applied to the code.
https://github.com/LineageOS/charter/blob/main/ai-coding-assistants.md
You're replying to one of many people simply using this as another opportunity to mislead people about GrapheneOS and promote using non-hardened operating systems which aren't in the same space at all. Those greatly reduce privacy and security vs. AOSP rather than improving them.

2026-09-10 11:56:14 UTC

- reply

A toggle for adding all contacts by default with the exception list being for excluding numbers instead of including them has been added for the next release already.

2026-09-10 10:32:55 UTC

- reply

We don't have a way to use it yet. We did add partial support for it to avoid the Skylo eSIM showing up as a regular eSIM and getting wiped when erasing eSIMs. We don't have the high-level parts to use it. It could be similar to how we support Android Auto but it's a super rarely used feature and hard to find the time to deal with it. It would also potentially be problematic for us to test it.

2026-09-10 09:43:48 UTC

- reply

Set it to Adaptive in the display color mode settings. Saturated was broken on newer Pixels and not supported on the stock OS so we removed it for now. If it's going to be added by GrapheneOS as we were doing then it needs to be done differently.

2026-09-10 05:47:20 UTC

- reply

MTE was unavailable in the initial Pixel 11 release but appears to be getting added back for Android 17 QPR2. We've tested it with Android 17 QPR2 Beta 4 which was released after our initial post and it appears to work fine based on all the tests we ran. It also performs well enough. If MTE ends up being fully functional in Android 17 QPR2 then we can support the Pixel 11.

2026-09-10 02:23:06 UTC

GmsCompatConfig version 174 released:
https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-174
See the linked release notes for a summary of the improvements over the previous release and a link to the full changelog.
Forum discussion thread:
https://discuss.grapheneos.org/d/41858-gmscompatconfig-version-174-released
#GrapheneOS #privacy #security #gmscompat

2026-09-10 01:04:11 UTC

- reply

That's incredibly far from reality.
If we were using it for much more then we could buy a bunch of hardware and run open weight Chinese models locally. The reason we're not is because it's already being done by others.
It would be a higher priority if we were the ones responsible for dealing with the overall Linux kernel, AOSP and Chromium code getting security issues patched but we aren't. It makes more sense to spend our time and money on things not already being done.

2026-09-10 01:03:39 UTC

- reply

That's incredibly far from reality.
If we were using it for much more then we could buy a bunch of hardware and run open weight Chinese models locally. The reason we're not is because Google is already doing it. It would be a higher priority if we were the ones responsible for dealing with the overall Linux kernel, AOSP and Chromium code getting security issues patched but we aren't. It makes more sense to spend our time and money on things not already being done.

2026-09-10 00:15:53 UTC

- reply

You would probably be fine with us running a 256 core machine 24/7 doing fuzzing but yet us paying hundreds of dollars to get far more useful results is somehow us destroying the environment.
We do not understand where you're coming from or why you're so incredibly angry with us. It's not justified and does not make sense.
Many of the people attacking us travel around the world to conferences on airplanes, drive to work and probably have the carbon footprint of half our team or more.

2026-09-10 00:12:23 UTC

- reply

We spend hundred dollars per month on it and you're claiming we're destroying the world. We disagree with the premise in the first place but even if we did agree, it's such a disproportionate response.
How is it that this is such a big deal to you but you're not attacking everyone you know who eats meat, drives a car, travels by airplane and other wasteful things. Somehow we are the problem for using less resources on this than we've used for plenty of far less useful things.

2026-09-09 23:43:58 UTC

- reply

We're not conflating anything. It's openly a targeted harassment campaign with the ringleaders of it well aware of what they're doing. This is one of the main people doing it who has been boosted by most of the other people with highly boosted threads. There's no secret about what they are trying to do. They're heavily using lies and misrepresentations about what we've said and done to do it.
What is being done is not an attempt to convince us of anything and has done the opposite.
https://grapheneos.social/system/media_attachments/files/117/243/729/323/890/681/original/9480799a19d3ee74.png

2026-09-09 23:28:01 UTC

- reply

People using AI models doesn't imply the end result is lower quality. We hired the people who we decided are capable of producing high quality code and being productive with their usual approach to development. For people who made it past our initial screening, we gave test projects and we learned a lot about what they'll produce for us from it.
All of the work they're currently doing is clearly massively raising the code quality compared to the starting point of that AOSP app code.

2026-09-09 23:22:56 UTC

- reply

We're in the process of overhauling these apps by rewriting nearly all of the code in phases. It's becoming much higher quality code with many bugs getting fixed as part of it. That includes fixing upstream privacy and security issues which have been around for years.
Vast majority of experienced developers working at tech companies are using AI. Most of the people applying to us are using them. We have to filter through people who can pass our tests but are too reliant on AI.

2026-09-09 23:19:06 UTC

- reply

As you're well aware if you use GrapheneOS, there are a bunch of abandoned AOSP apps which haven't had any active development for years.
Those apps are stuck in the state they were in back in Android 5 or even earlier. Many even regressed. They've had bare minimum maintenance for years which gradually ended upstream.
The issues with those apps include them not being overhauled with privacy and security improvements applied elsewhere. It includes outdated dependencies missing patches.

2026-09-09 23:14:50 UTC

- reply

That's the direct opposite of what we've said. We're primarily using it to improve the quality of our code through additional passes of code review. We started doing that after multiple external contributors used AI to find a bunch of issues throughout our code. Most of those were issues like crashes but some were more important. Some of our low-level hardening features were not providing as much security as they were meant to be. We began using it proactively to catch issues early.

2026-09-09 23:02:30 UTC

- reply

Linux itself is heavily using AI models. Therefore, every Linux distribution moving to recent kernel versions is heavily built on top of using AI models. Creating a Linux distribution not heavily using it would require a hard fork of the Linux kernel and many other projects.
It's unclear what would be accomplished by banning AI for a tiny portion of the code while continuing to use Linux, AOSP, Chromium and hundreds of other projects heavily using it. We'd still be benefiting from it.

2026-09-09 21:47:29 UTC

- reply

There are currently many widely shared threads directing hate towards us with major misrepresentations about what we've said in done.
A large number of people are using it as an opportunity to promote using operating systems which are the direct opposite of hardened and are much more heavily using AI models including for a lot of code generation.
LineageOS is certainly using it. CalyxOS, /e/ and iodéOS are based on it. CalyxOS is developed by LineageOS core developers.
https://github.com/LineageOS/charter/blob/main/ai-coding-assistants.md

2026-09-09 04:42:34 UTC

Vanadium version 153.0.8010.36.0 released:
https://github.com/GrapheneOS/Vanadium/releases/tag/153.0.8010.36.0
See the linked release notes for a summary of the improvements over the previous release and a link to the full changelog.
Forum discussion thread:
https://discuss.grapheneos.org/d/41830-vanadium-version-15308010360-released
#GrapheneOS #privacy #security #browser

2026-09-09 01:49:31 UTC

- reply

It isn't important because everyone else is using it but rather because corporations and governments wanting to break into people's devices are heavily using it. It is our job to defend against them. People do not seem to realize how easy it's getting for attackers to the point you can go grab exploits on GitHub and take over non-GrapheneOS Android devices. It can get that way for us too if we don't stay on top of things despite how they're degrading.

2026-09-09 01:47:39 UTC

- reply

Linux, AOSP, Chromium and the many projects those use are not simply dependencies. That's the operating system we're building on. It has extensive use of AI regardless of what we do. Linux is also being quite lax about how it's used.
We're working on privacy and security where finding holes to break through the defenses is a key part of it. These AI models are extremely good at doing it and are heavily shifting the advantage to attackers unless that's countered.

2026-09-08 20:19:59 UTC

- reply

GrapheneOS is based on projects heavily using AI including the Linux kernel. Cellebrite, NSO and other exploit developers are using it to exploit these projects. They currently have a major advantage thanks to AI which will likely be turned into a major disadvantage over the long term. It's getting a huge backlog of bugs fixed and creating enormous pressure to make systemic improvements.
Here's what Debian adopted, which is a similar idea but much more permissive:
https://www.debian.org/vote/2026/vote_002#texte

2026-09-08 18:07:22 UTC

- reply

We don't forbid using AI models for writing code but pull requests largely created that way will typically be rejected or skipped due to not meeting our requirements. It needs to be well written code which appears to be regular code written by a human regardless of the level of AI assistance involved in making it. It should not look like AI generated code. We do want to know if AI models are being used and how they're being used rather than people using it but not telling us they're using it.

2026-09-08 17:52:43 UTC

- reply

Going from having a working implementation of a feature to code we can merge often takes a long time. It can take months or even more than a year. It doesn't always work out. Sometimes we decide a feature ended up being too invasive or risky for other reasons and don't want to include it. We'll often do rewrites. Contributors need a full understanding of what they've submitted and need to be prepared to make substantial changes including fully rewriting it multiple times. AI slop isn't accepted.

2026-09-08 17:48:26 UTC

- reply

We have high standards for code being merged into GrapheneOS, especially for code in critically important parts of the project. Most of the changes made to the OS are to critically important parts of the code. It takes a long time to get features to meet our standards. There's usually a lot of back and forth review with many improvements requirements for anything significant. External contributors shouldn't try to take on major features without talking to us and planning that out with us first.

2026-09-08 17:44:21 UTC

- reply

This is an explanation of our existing policies which existed before today. It's not a formal document and is being written as we make these posts.

2026-09-08 17:43:19 UTC

- reply

We want people to report very serious Android Open Source Project security bugs to us but we can't handle a lot of minor issues. We don't generally need Chromium security bugs reported to us because they handle those far more quickly and have a far better system for releasing it. Linux kernel security bug reports are useful if they refused to fix it (arm64 kASLR) or it didn't get backported to the LTS. GKI LTS being behind the LTS is a separate problem we'll be addressing ourselves again soon.

2026-09-08 17:35:27 UTC

- reply

It isn't a good idea for people to point a model at an open source project and then start submitting bug reports to it. People need to be able to confirm the issues themselves with relatively high confidence before reporting it. It's okay to make some mistakes but it should not be the majority of what's reported. We do want people to report these kinds of security bugs to us but the signal to noise ratio is far too low right now. Even frontier models spew out contrived nonsense and fabrications.