AOSP and Pixel Device Support

DeletedUser433

is it really that bad? im sure gos will survive

grapheneosuser34508934

https://grapheneos.social/@GrapheneOS/114359660453627718

https://grapheneos.social/@GrapheneOS/114478523676759080

The feeling from their socials - and that's all we have to go on barring an official reply - is that with their lead developer MIA, and with the lack of OEM access, lack of device trees, it is going to be harder to port. I am positive they will succeed, however, it's more concerning about the long term future and if Google will eventually just pull the plug entirely. They are almost there now reducing AOSP to a fraction of what it used to be. They've basically given it an lobotomy and now it's on life-support.

Graphene are talking about needing their own devices, which shows their level of optimism going forwards. Frankly, it's feeling more unsustainable than previously, and over time, the effort may not be worth the 'reward' so to speak.

argante

Viewpoint0232 Does it mean the Pixel 9 series is the last one to have fully "officially" supported hardware by GrapheneOS

The Phone number doesn't matter here. Let's say we have a Linux kernel (Vanilla) and it is developed by Linux developers. Google applied its modifications to this official Linux kernel (Vanilla), which were adapted to ASOP. GOS developers saw these changes step by step (or patch by patch) and applied their own modifications.

Now it will be the case that the Linux kernel will continue to develop, Google will develop its changes behind closed doors and from time to time will publish such a kernel. GOS developers will therefore face a situation in which they will have a huge change, which will result from changes made both by Linux developers and Google itself. And they will not have information about what exactly was changed in relation to what. For example, there will be no marking of fragments that directly referred to Pixel phones. This difficulty will apply to all versions of phones supported by GOS.

See that the Grsecurity patch was publicly available. But it was huge. So when a major change happened in the Linux kernel and at that time the Grsecurity patch stopped being public, no one managed to port that change to newer kernels. So what's the point of having open source code when the workload to make such an update is so huge that no one managed to fully maintain that patch (there are ported parts, like OpenPaX).

grayway2

What a piece of shit company. They could at least let us know about that a couple months ago but instead they are dropping that news the same day of Android 16 source code release to AOSP.

wuseman

grayway2 Indeed. So much for Google being the good guy OEM company.

n2gwtl

grayway2 they can do whatever they want to new devices. But up to the 9, it should be maintained as it has been.

n2gwtl

grayway2 it's the policies imposed on them that drove them to this decision.

randomname

is there any reason for them to keep allowing bootloader lock with custom key for next Pixels now that pixels aren't the reference device for aosp ?

argante

randomname There isn't one and I'm afraid they'll block it.

r134a

argante Assuming they will, would that apply to p10 and upwards, or could they retroactively apply this to older pixels aswell? If the later is the case, assuming u have up to p9 already running GOS, this won't apply?

argante

r134a Assuming they will, would that apply to p10 and upwards, or could they retroactively apply this to older pixels aswell?

Yes. This isn't about the Pixel phone version, but the AOSP version. You currently have A15 installed, and this change applies to A16 and later.

Viewpoint0232

So what other devices are left then? The only one I can think of that is friendly to so-called custom ROMs is the Fairphone, but it has plenty of downsides (less security in terms of hardware features and firmware updates, larger size, worse price to specs ratio) and is also not sold worldwide (though the same is true for the Pixel).

Bimmy

Viewpoint0232 So what other devices are left then?

We might make some guesswork based on information from a former project with apparent sympathy for GOS: DivestOS. Before its discontinuation, the DivestOS developer wrote:

[...]
Bootloader relocking is restored and has been tested working on 23 devices and is available for 26 more. Verified boot is also restored on 36 of those devices

(Source: https://web.archive.org/web/20241223233559/https://divestos.org/index.html)

Some caveats:

Above info is from an archived, discontinued site. No guarantee that any reports there are accurate and still valid today.
DivestOS had a different scope, although with some overlap with GOS. (s. https://web.archive.org/web/20241230182056/https://divestos.org/pages/patch_levels#why ). What once worked -- and worked for DivestOS --might be totally inapplicable as of now and for GOS.
Even for some supported devices there were strong warnings or undocumented steps. (s. https://web.archive.org/web/20241231111703/https://divestos.org/pages/bootloader#fastbootLocking )
Many of the devices with reasonable support from DivestOS were out of manufacturers' support for one or more security relevant components.
Some devices were very outdated. (Personal note: I still find it impressive how long DivestOS provided harm-reduction for so many devices.)

Still, I find it a very valid question. What other devices and OEMs might offer a path forward, if Google does not want us any more. Where should we look? What allies could we make?

StormyDanielz

Viewpoint0232 yes the fairphone is pretty cool IMO but nowhere near in terms of hardware security standards of GOS. Just adding a Titan MX module to the stack would be great, but I'm afraid it's much more complicated to the point of it's not realistic, requiring so much ressources, it'll be better invested in your own built

Kiba

I have a Huawei Mediapad tablet and when I bought it you could unlock the bootloader.
2 months after buying it Huawei removed this possibility to do so and devices that had not been unlocked are now locked.

So it can happen.

That said, the way to unlock the bootloader is easier with Google and I don't think this feature will be removed from existing Pixels.

argante

Kiba That said, the way to unlock the bootloader is easier with Google and I don't think this feature will be removed from existing Pixels.

Regulations can force them to do so:

Backdoors by design: hardware and software makers are ordered to bake permanent law-enforcement access points into phones, laptops, cars, and IoT devices (Rec 22, 25, 26).
Criminalized resistance: services or developers who refuse to spy on their users face fines, market bans, or prison (Rec 34).
No one exempt: the rules cover every “electronic communication service”, from open-source chat servers to encrypted messengers to vehicle comms systems (Rec 17, 18, 27.ii).

So if Pixel is not blocked, it means that there is still an opportunity to bypass these regulations and Google could be punished for it.

DeletedUser299

argante So if Pixel is not blocked, it means that there is still an opportunity to bypass these regulations and Google could be punished for it.

Suppose they could, with their revenue stream, you could fine Goolag the equivalent of a small countrys GDP and they could pay, probably in cash.

imp667

grapheneosuser34508934 I just bought a pixel 9 😬

argante

DeletedUser299 Suppose they could, with their revenue stream, you could fine Goolag the equivalent of a small countrys GDP and they could pay, probably in cash.

Google softly introducing more and more locks and restrictions. There is currently no clear reason to lock the bootloader, but it could invoke these changes in the EU and do it globally, explaining that it wants to treat users the same way. I'm concerned that Google emphasizes that does not want the Pixel to be a reference device for AOSP. This is just one step away from locking the bootloader.

GrapheneUser599901

Realistically what can the users do to help gos long-term? I'm willing to donate, but is there a plan for expanding the Dev team to deal with the increased workload?

Bimmy

GrapheneUser599901

Regarding your last question: GrapheneOS published a job ad (s. https://grapheneos.org/hiring ).

spl4tt

argante Google always had a reference phone. It's really weird to see that change now

Titan_M2

Probably the only way to keep working in the long run would be to build their own smartphone.