Is security lessened due to Google no longer providing Pixel Branches?

ElectricBlue

https://www.ghacks.net/2025/06/13/googles-aosp-changes-may-make-custom-roms-harder-to-build-for-pixel-devices/

Just going off this article and the fact I know it's likely been discussed to death but I'm genually curious if having to reverse engineer and rebuilding is worse off than what was provided before?

de0u

ElectricBlue My sense is that so far it requires much more developer labor but has not resulted in falling behind on Google's security updates. More developer labor presumably slows down GrapheneOS-specific initiatives, and I think the project has made posts counseling patience and suggesting some features may come more slowly than previously expected.

Overall I expect that if there are serious impacts on security then the project will say so. Meanwhile, I think it's too early to ask for the project's considered opinion of the impact, because they're still figuring that out. More will be known when the Pixel 10 ships, but probably not before then.

Please note that I do not speak for the GrapheneOS project.

ryrona

Another possibly relevant point is that now more binary blobs are copied from stock OS images than before, less is compiled from source code. This may mean GrapheneOS' ability to fix vulnerabilities or implement new lower-level security features may be reduced, as modifying these binary blobs are generally not possible, at least not easily or in a maintainable way.

ElectricBlue

ryrona I think you worded exactly what I was asking better. For without certain blobs things like lineage os sacrifice features: which is perfectly fine considering longevity is the main concern but with GOS I'm worried about their ability to harden as hard as deeply as they could before.

argante

ryrona Consider that it's possible to legally make reverse engineering for such a blob. One team deals with RE and writes the documentation, while the other writes its own implementation based on that documentation. That's how Nouveau was implemented. I think a Pixel's blob won't be terribly complex, and it's manageable. Tools supporting RE have advanced significantly in recent years, so this is always a backup.