MetropleX [GrapheneOS] ⚡🟣 on Nostr: You weren't toldn to blindly trust the hardware. Using GrapheneOS is advised because ...

You weren't toldn to blindly trust the hardware. Using GrapheneOS is advised because the hardware can't be trusted.

The guidance given was stating that regardless of a device having 'kill switches' you still have to trust the hardware.

Specifically regards the Pinephone for example.

You cannot avoid trusting the hardware manufacturer for the SoC, the overall device and other trusted components.

Pinephone uses components with serious security issues and doesn't configure the SoC securely. They can't provide the standard expected security updates and the device is missing most hardware-based security features like those depending on a secure element and verified boot.

Hardware kill switches don't make up for having lots of security issues in hardware, firmware and especially software. Using an OS with nearly non-existent application security model, lack of modern exploit mitigations, lack of memory safe language adoption, etc. is not progress.

Android Open Source Project is a Linux distribution, as is GrapheneOS. A substantial portion of our work is on the Linux kernel. We've made significant upstream contributions to the Linux kernel project with the bugs we've found, patches we've provided and code review.

An operating system doesn't need to use systemd, glibc, gcc/binutils, pipewire/pulseaudio, Wayland/X11, GNOME/KDE, etc. to be Linux. Linux is a kernel.

The radios and other peripheral components included in the devices we support are isolated. The common claim that cellular radios aren't isolated is completely false. What sets GrapheneOS apart is that regardless of any 'backdoors' (hypothetical until proven otherwise) is that, like RCE exploits similar to those recently discovered/patched by Googles Project Zero in the baseband, actors will still need to have an OS based exploit on top to compromise your data etc. No other OS provides the level of protection that GrapheneOS offers.

No external actor has ever claimed to have compromised a GrapheneOS Pixel. This includes third party state affiliated operators such as Cellebrite. They however are focusing a lot on older generation Qualcomm based Pixels and may have something in the next 12-18 months. Which is again why we advise uaing a modern OEM hardware firmware/driver supported device. The likes of which Pine/Libre are not.