/e/OS is not fully degoogled, as DNS connectivity checks, hardware attestation provisioning, and eSIM activation all go through Google.
It is often many weeks or months behind on security updates, especially in the WebView, which makes it easy to exploit.
It doesn’t support bootloader locking on many devices, and if you lock the bootloader on a phone that does support it, it could brick if /e/OS is on an older security patch than the stock ROM was.
It doesn’t use a lot of the hardening in GrapheneOS such as hardened_malloc which prevents memory corruption exploits, even if the hardware supports it.
And finally, /e/OS’s text-to-speech sends what you say to OpenAI, despite local options being available.
If you want a properly secure Android phone, the best option is GrapheneOS, however it only supports Pixel phones and future Motarola phones due to its high security requirements.
If you can’t get a Pixel then iOS in lockdown mode is the next best option, however if you can’t replace your phone, LineageOS is much worse than Graphene although it is still much better than /e/.
As someone who bought a Murena FairPhone 5 with /e/OS preinstalled because I had the option to pay a reasonable price for a decent phone that isn’t Google branded, and have been enjoying the experience with it for a while now, I don’t think I’m going to fall for that very obvious rage bait that’s been copy-pasted from an aggressive forum post.
I’ll give GrapheneOS my attention when it works on more than one phone. I hear Motorola is building a second phone for it to be compatible with.
/e/OS is not fully degoogled, as DNS connectivity checks, hardware attestation provisioning, and eSIM activation all go through Google.
They are working on some of this, at least eSIM activation. Also do you have a source for DNS connectivity checks? AFAIK they have used their own for a while
It is often many weeks or months behind on security updates, especially in the WebView, which makes it easy to exploit.
This is a serious problem, however their update speed is comparable to a lot of default Roms
It doesn’t support bootloader locking on many devices, and if you lock the bootloader on a phone that does support it, it could brick if /e/OS is on an older security patch than the stock ROM was
/e/os supports boot loader relocking on most official devices, however the community builds don’t support it. The bricking part has nothing to do with /e/os, it’s a hardware security feature of some devices. This would happen with any ROM including the official one
And finally, /e/OS’s text-to-speech sends what you say to OpenAI, despite local options being available.
I assume you mean speech-to-text? Anyway the feature is opt in and they have since updated it to include a prompt to inform you about what it will do. Their reasoning for a cloud option was that local options either are bad or have to high ressource usage (important as /e/os supports a lot of underpowered devices). Overall a stupid move, but they adjusted the feature to let users make an informed choice
If you can’t get a Pixel then iOS in lockdown mode is the next best option, however if you can’t replace your phone, LineageOS is much worse than Graphene although it is still much better than /e/.
Lineageos might have quicker updates, though it is even more connected to google, except for not including microg. However a lot of people will need google play services so they will have to install it anyway
Sorry but this sounds again like the typical e/Os bashing from GrapheneOS users.
Those two system are not the same. One is focused on security and the other on privacy.
Yes I know about the issues of e/OS, but it is still better than using Google or Apple.
For me personally I moved cause I don’t want to support american companies. So Graphene was no option, as I would need to give google some money or buy one 2nd hand. But Pixels are still quite expensive compared with others.
Why do you always need to attack other systems, they can coexist. We should be happy people have more options to break free from Big Tech companies.
There is no privacy without security. Android is one of the most widely exploited OSes and every month a dozen or more critical severity vulnerabilities are patched. Being 1-2 months behind on security patches is inexcusable for a privacy project.
I think you might not understand the meanings of privacy and security.
These are two different things, you can have privacy without security and the other way around. Having both is the best case.
As @ExLisper@lemmy.curiana.net said, some people care more about all those app trackers rather than have a full secure phone.
If there would be the one solution 100% privacy and security and available for most phones I would instantly use it. But it is not available yet.
If you are happy with Graphene OS good for you, but keep in mind it might not be what everyone is looking for.
Are those vulnerabilities ever exploited? The stats I’m seeing say that 30% of users run outdated Android version. Most attacks are malware apps installed from Play Store and mobile phishing sites. Yes, you have 0-click vulnerabilities but is anyone really setting up spoofed BT devices in public places? I think the risk of getting your phone taken over this way is extremely low, specially if you’re doing basic things like disabling BT when not in use. Tracking on the other hand is extremely common. Most non-open source apps will connect to multiple analytics and tracking APIs. I care more about controlling those connections than about theoretical attack using some 0-day exploit. GrapheneOS doesn’t have good tools to monitor and block trackers. /e/ and iode do.
So you’re excusing lazy patching with improbability? Personally, I wouldn’t bet my privacy and security on a criminal’s lack of motivation.
It’s like eating candy from a bowl in which 5 are poisoned and 5000 are harmless. It’s improbable for you to pick a poisoned candy but because the consequences of choosing wrong are so perilous, I wouldn’t choose at all or choose a bowl with less poisoned candy.
GrapheneOS doesn’t have good tools to monitor and block trackers.
Yes it does. Rethink has (in addition to other awesome features) a local DNS blocklist option which you can configure to automatically block almost all telemetry apps send.
Good thing no one forces you to use it.
OpenAI feature is called Murena Voice to Text, so users don’t know, it’s OpenAI. They use tracking ids in their own update process. They ignore critique.
Graphene is currently only available for Google devices and therefore no alternative.
Lineage contains connections to Google as well.
Recommending iOS is ridicolous.
I just use whisper+ with heliboard. Works perfectly for me. https://f-droid.org/packages/org.woheller69.whisperplus
Murenas statement on the ids used for OTA updates:
For context, and I agree that this feature can be perceived with mixed feelings, especially because it was stupidly called „licence ID“ at the beginning of its implementation, we added it because we suffered from not having good statistics on /e/OS usage.
Of course we are not interested in tracking users at all, but we do want to know how many devices are running this or that build of /e/OS. This is very useful for making some decisions about device support and setting priorities for future development.
Just running statistics on OTA server request logs along with the device model didn’t give good results.
Now, and this is still part of our internal discussions, if we are able to find a way to get good quality stats without this OTA anon-unique identifier, we will consider it.
However, we sincerely believe that this anonID probably has no impact on user privacy (tracking IPs or device fingerprints would probably be much worse).
You can reset the id via ADB:
adb shell settings put secure ota_anon_hash <new value>
To me /e/OS (is it called slashyslash OS or e-OS?) has always been just a worse LineageOS.
I tend to agree but it still remove more google blobs from its codebase.
I hate /e/OS for sucking the air out of the room and leaving divestOS stranded. Fuck you /e/OS.
OpenAI feature is called Murena Voice to Text, so users don’t know, it’s OpenAI. They use tracking ids in their own update process. They ignore critique.
Graphene is currently only available for Google devices and therefore no alternative.
Lineage contains connections to Google as well.
Recommending iOS is ridicolous.
You can use Whisper+ with heliboard if you want offline voice to text.
what has prompted this, I wonder.
Is it already time for the lead GrapheneOS developer’s annual crash out? Where do the years go?
the fun thing is like, I use grapheneOS on a pixel 10 pro, though I find it kind of difficult to fess up to given the cringeworthy escapades of the graphene community.
who pissed in their cereal? does the mere presence of other ROM projects attack their identity in some way? have they claimed to be more secure than GOS and others?
You’re an ungrateful one huh. I wonder if you hate any of the other people who make software you use. 🤔💭
Wow what a leap. note that i said community and not project members, though they’ve not been without controversy either. let’s not pretend micay wasn’t massively problematic,
If I’m not mistaken that guy completely left the project like a while back now. Hasnt been involved in any way for a hot minute
AFAIK he’s just stepped down from being lead dev and still works on the projects. Doesn’t really feel different though because he’s still the only name I’d recognise online.
Wrong about everything + no arguments award 🏅
That may be true but it is still my best option if Google plays idiot like they seem to be planning. My current phone supports e/OS for the record and that’s the only reason I’ve paid it attention.
Ive always thought having options was a good thing.
If I drive a car towards a crosswalk, and people in it scream at me to stop, am I less culpable or more culpable if I have the window rolled down to yell “I’m going to brake in a second, you can trust me”? What if I know my brakes are worn out and I am already braking?
what.
Smart phones are a bad idea. A simple, dumb phone to make calls, texts and occasionally tether your laptop, vehicle tablet to for data access are all you really need. Even the dumb phone should have physical switches for the radios and a battery that can be removed without any tools.
