How important is AOSP to GOS really?

barding

Hi
I'm so new to this I'm just reading up in preparation to migrate, but when I look at the recent dropping of Pixel device trees, I can't help but see an opportunity to reduce the reliance on Google. I mean, it seems to me they've basically stopped doing the only thing that "only they" can do? Isn't everything else in terms of developing AOSP more of an issue of developer hours than of some sort of unique capability of Google?

Of course, I realize that developer hours isn't trivial, and I don't expect things to change immediately (and I guess this isn't really more about GOS than any other fork), but with all the things Google are doing to hurt forks (plus the remaining uncertainty connected with antitrust cases), I can't help but wonder how far something like GOS would be from saying goodbye to Google? I mean, I can imagine a situation where all the forks pools resources to create something like a parallel FOSS Android project under a non-profit foundation. I can even imagine some OEMs being interested in funding such an effort, as they too would probably like to rely less on Google.

de0u

barding Assuming GrapheneOS will run on phone hardware and remain a high-security system, somebody needs to build secure phone hardware and document how it works so that GrapheneOS can use the features.

Google has laid out a lot of money to build phones with strong verified boot, a strong key store, a flash controller supporting wrapped storage keys, memory tagging, etc. So far, other phone makers either have weaker hardware security or don't make it available to operating systems they don't own.

This problem isn't unsolvable in theory, but it would require at least one large company to do things differently, or a lot of money to fund some sort of open-hardware initiative. Such initiatives exist from time to time, but so far have not resulted in high-security phone hardware.

Also, assuming hardware were produced somehow, Google has agreements with repair shops in many countries, many cellular carriers, etc., that would not be easy or cheap to replicate.

At least in the short term, I suspect that if GrapheneOS on Google phones becomes untenable then people will end up paying a lot more money for phones that can run GrapheneOS, and repairs will be inconvenient.

chinook

So what are you suggesting, forking AOSP and writing a mobile system (including drivers on Pixel hardware) on their own from now on?

I don't see how that would be a less problematic or time/money-consuming.

barding

chinook Not necessarily suggesting it, but trying to ask what it would require and how feasible it would be in different scenarios, including one where people start working for an Android foundation (rather than Google suddenly being forced to divest Android and then you have to deal with Elon Musk running it or something). I mean, to me it doesn't seem like Google are only contributing directly useful stuff to new Android versions (in the sense that stuff like reworking menu systems is "handy, but not necessarily useful"). Also, doesn't part of what happened with the device trees basically like saying they have to reverse-engineer drivers already?

wonder75

barding The current state of Android is the result of 17 years of development of many large teams, backed by big tech billions.

Now imagine a single small team without proper funding doing the same.

barding

wonder75 They wouldn't be starting from scratch, though, just like Google didn't.

matchboxbananasynergy

We do need AOSP. If Google stopped making AOSP and it was forked by another group, or by a collection of OEMs etc., chances are it would lose its security focus, and wouldn't necessarily be as good as it is now. It could be done, though.

It's not realistic for GrapheneOS to singlehandedly maintain AOSP or just divert from it just like that, though. If we had the resources, sure, but it's a lot of work.

barding

matchboxbananasynergy Right, so in a sense it's kind of hard to see what would happen if the US DOJ were to force Google to divest Android, but I guess the best-case scenario could be something like the members of the OHA and perhaps certain governments realising it would be better to pool resources and fund an independent nonprofit rather than just ending up in the grasp of another self-interested monopolist? Honestly, it doesn't feel impossible the way things are looking today, with companies increasingly funding initiatives within the FOSS landscape.

matchboxbananasynergy

barding Sure, that's not out of the question. AOSP could also be given to a company that cares about security and open source and sees the value in that.

A nonprofit for AOSP could be good, as long as the actual people working and funding it maintain an interest in security and openness.

barding

matchboxbananasynergy I guess at a minimum, they'd have to not care less about security than Google does. I was kind of thinking a bit about how different forks have different priorities and sometimes even seem to have a bit of an adversarial relationship, but with all being "supported" by current AOSP, it could be conceivable to have some sort of cooperation on keeping up maintaining and developing a "usable starting point" for all the forks -- even if Android were to be sold to a company that cares a lot less. I'm also kind of fearful that Google might close off/stop actively developing more central parts of AOSP as they move to integrate Android and ChromeOS (e.g., "shared clipboard" sounds a bit to me like they'll close-source some clipboard component while possibly starting to neglect the current "local" clipboard).

barding

de0u yeah, for sure the hardware is a very different beast -- though I'm pretty sure I saw GOS say something that seemed uplifting even in that regard in some Mastodon post. I also think some companies are underestimating the sale value of "secure device open to other OS": I mean, I wouldn't ever consider getting a Pixel if not for the possibility to run GOS, so if someone like Samsung had just committed properly to secure hardware to meet GOS requirements plus oem unlock, I bet they'd get a larger share of device sales overall (and honestly, I'm finding it hard to imagine Samsung actually makes enough money off ads to not secretly want to just make hardware -- but I guess you can't close Pandoras box one it's open).

Anyway, I was mainly thinking about the software here, because my impression was that Google have been shaving off slices of AOSP to close-source them, and that GOS were already kind of adding a meaningful amount of their own code to the project. I'm also generally probably slightly more optimistic about what FOSS projects can achieve than some other people, so there's that :) (I mean, it's hard to see Linux going from what people saw it as in like 2000 to what it is today as anything other than a resounding success -- but yeah, it requires some sort of concerted effort that I'm not sure how to achieve).

de0u

barding For sure the hardware is a very different beast -- though I'm pretty sure I saw GOS say something that seemed uplifting even in that regard in some Mastodon post.

Indeed, and I hope that bears fruit (even if Pixels remain usable by GrapheneOS in the future). But I really do think that sort of relationship might end up with expensive phones that are inconvenient to repair. And there is already plenty of griping about Pixel phones not being as fast or cool as Samsung devices, not having microSD slots, not having 500 Hz displays, etc. To me, switching to a smaller company just doesn't seem likely to result in better hardware at lower prices. Getting top security may end up requiring paying real money.

barding I also think some companies are underestimating the sale value of "secure device open to other OS": I mean, I wouldn't ever consider getting a Pixel if not for the possibility to run GOS, so if someone like Samsung had just committed properly to secure hardware to meet GOS requirements plus oem unlock, I bet they'd get a larger share of device sales overall [...]

Maybe? Let's say there are 250,000 GrapheneOS users on in-support Pixels. That's all pixel models sold over the past four years. Meanwhile, Samsung sells 200 million phones every year (source). If all GrapheneOS users switched to Samsung then Samsung's sales would go up ... 0.025%?

Please feel free to check my math. I used 200,000 compared to 200,000,000 to get 0.1%, then divided by 4 to account for the GrapheneOS fleet being spread over four years.

barding

de0u But I really do think that sort of relationship might end up with expensive phones that are inconvenient to repair

Wasn't the point that a manufacturer felt comfortable with "upgrading" hardware to something that matched GOS requirements and leaving the option open to OEM unlock rather than someone making "the GOS device?" I kind of feel like that sounds less like a... "mediocre novelty phone" that some projects tend towards, but I guess we'll have to wait and see (I should say I really am rooting for projects like Fairphone, etc., and that I think they can't really be expected to do more than "break new ground", so to speak, at the moment; without them, it would seem even more hopeless).

de0u If all GrapheneOS users switched to Samsung then Samsung's sales would go up ... 0.025%?

Yeah, it's a bit of wishful thinking, but someone not-Google could market the capacity more heavily, though. More and more people are getting fed up with Google (or all the ad-tech guys), so I think you could reach quite a few people with that message.. and then it's not only a question of gaining some market share, but also of not losing market shares to whoever would decide to go for it. In any case, if not Samsung, then someone else (if I were Sony right now, I would be looking for a new angle for my mobile business, though security isn't really in their dna).

de0u

barding Wasn't the point that a manufacturer felt comfortable with "upgrading" hardware to something that matched GOS requirements and leaving the option open to OEM unlock rather than someone making "the GOS device?"

True. And my understanding is that part of that picture is an expectation that the next round of Qualcomm SoC's will have better security (e.g., MTE), so in a sense the right thing can happen "naturally". But:

Unless the mystery OEM is big, I suspect the phones they are shipping may not be up to the featurefulness of Samsung, Google, Sony, etc.,
While conceptually much of the work to meet the GrapheneOS standards is straightforward, rewriting the bootloader to accept a third-party signing key requires some development and a fair amount of testing, and an OEM might not be comfortable the first time shipping that to all of their customers, in which case a "GrapheneOS phone" might be a small-volume special-order thing, thus some mixture of more expensive and harder to get.
GrapheneOS wants a commitment to fast, frequent patching of firmware bugs, and long support time. This is still somewhat rare. For example, last time I looked, Samsung issues some patches fairly quickly, but only for fairly-recent devices. The sort of cadence Google has been doing for Pixels costs real money.

Sony is large enough that they could afford good security people if they decided to -- I expect they could even afford enough good security people to handle a monthly cadence for their upper-end devices.

But as long as so many customers (99% of the market?) are satisfied with insecure phones or with phones that are reasonably secure but locked to the vendor's ecosystem, it may be hard for a company to make a business case for spending a lot more on security to get a tiny number of new customers.

Panda-na

You can check their roadmap :)

They eventually want to move away from todays systems, to more virtualization. They don't spesifically say that it means ditching AOSP, but at least the Linux kernel.
https://grapheneos.org/faq#roadmap

barding

Panda-na yeah, I saw that, but I'm not very confident in my understanding of it. To me it seems to say at least a couple of things: Firstly, achievable by GOS on its own, is to run Android itself "sandboxed off from the kernel." Secondly, depending on a lot of external factors, they hope that the general way of OS development will be towards something similar, or developing services meant to run sandboxed off from the kernel, so that the current monolithic Linux kernel is fully replaced in any OS?

The first part is called a long-term goal, while the second part is "years from now." Not sure if that's a language barrier, but I'd normally understand long-term to mean years from now, while something like replacing the linux kernel could be at least a decade?

matchboxbananasynergy

de0u

Unless the mystery OEM is big, I suspect the phones they are shipping may not be up to the featurefulness of Samsung, Google, Sony, etc.,

What features in particular are you worried about here?

While conceptually much of the work to meet the GrapheneOS standards is straightforward, rewriting the bootloader to accept a third-party signing key requires some development and a fair amount of testing, and an OEM might not be comfortable the first time shipping that to all of their customers, in which case a "GrapheneOS phone" might be a small-volume special-order thing, thus some mixture of more expensive and harder to get.

Possibilities include a device being sold with GrapheneOS out of the box, alongside with that model being sold with its stock OS in a way where you could install another OS (like GrapheneOS) on it, as is the case with Pixels currently.

GrapheneOS wants a commitment to fast, frequent patching of firmware bugs, and long support time. This is still somewhat rare. For example, last time I looked, Samsung issues some patches fairly quickly, but only for fairly-recent devices. The sort of cadence Google has been doing for Pixels costs real money.

That's all in our requirements, which are the first people interested parties are pointed to. If they're interested, they are aware they need to be able to provide that.

barding

de0u Unless the mystery OEM is big, I suspect the phones they are shipping may not be up to the featurefulness of Samsung, Google, Sony, etc.,

Depends on what you're thinking of. I get the feeling we'll see more and more "AI touchup" instead of increasing base camera capabilities, for instance. Maybe even camera hardware downgrades, at least relatively, by not upgrading for new generations.

de0u But as long as so many customers (99% of the market?) are satisfied with insecure phones or with phones that are reasonably secure but locked to the vendor's ecosystem, it may be hard for a company to make a business case for spending a lot more on security to get a tiny number of new customers.

Are they satisfied or do they percieve "some random OS off teh interwebz" as a risk in itself? If the latter, I'm pretty sure some reputable company going "this is good stuff" could change that. I'm also not convinced it needs to cost substantially more.

de0u

de0u Unless the mystery OEM is big, I suspect the phones they are shipping may not be up to the featurefulness of Samsung, Google, Sony, etc.

matchboxbananasynergy What features in particular are you worried about here?

Personally I'm not a "premium phone" sort of person (I have a 6a). Here are some features listed by others from this thread and other forum posts:

AMOLED display, custom refresh rate
24 GB of RAM
1 TB of internal storage
SD card slot
Two USB-C ports
DisplayPort Alt mode (graphics over USB-C)
2 physical SIM slots
eSIM chip that can support 10+ eSIMs
Ultrasonic fingerprint scanner
NFC, UWB
IR transceiver
Wireless charging
Standalone status LED (e.g., for a message-waiting indicator w/o turning the display on)
Broadcast (AM/FM) radio receiver

I think each one of those either is available now on some high-end phones or has been available in the past on some Android phones.

To be clear, these are not features that I am requesting!

de0u

de0u But as long as so many customers (99% of the market?) are satisfied with insecure phones or with phones that are reasonably secure but locked to the vendor's ecosystem, it may be hard for a company to make a business case for spending a lot more on security to get a tiny number of new customers.

barding Are they satisfied or do they percieve "some random OS off teh interwebz" as a risk in itself? If the latter, I'm pretty sure some reputable company going "this is good stuff" could change that.

Well... I think Google builds industry-leading security features into their phones, and tries to sell people phones based in part on security... and I think they are not exactly crushing out competitors with lower-security devices.

de0u

barding I'm also not convinced it needs to cost substantially more.

In a modern manufacturing economy, "economy of scale" is a gigantic factor. Many of the steps involved in building and shipping and repairing a device have large up-front fixed costs. For example, an injection-mold die (used to make complicated-shape plastic pieces such as phone shells) costs thousands of dollars, or maybe many thousands of dollars. The good news is that once you have a die it can be used for many thousands of phones. But that doesn't help if you're making just 5,000. Motherboard designs (including the pick-and-place instructions necessary for the automated assembly robots) are expensive too. Once you have a design and it's validated you can build potentially millions of phones, but if you're making just 5,000 phones then the giant cost of the design adds a lot of cost to each of those 5,000 phones.

If it's possible to use exactly some OEM's existing design, they've paid those costs already -- for the hardware. But "just" rewriting the bootloader (and testing it) probably costs well over $200,000. Divide that by 200 million phones, as Samsung does, and the per-device cost is invisible. But divide it by 5,000 phones and it's $40 per phone -- just for the bootloader, which most people don't think of as a feature at all, let alone a feature to pay real money for.

By no means am I suggesting that the GrapheneOS project will deliberately endorse a "bad" phone! But personally I will be unsurprised if, at least for the first device, it ends up being similar to an a-series Pixel in features, though not quite as good, but ends up costing a fair amount more. If enthusiasts immediately buy out the first production run because they are willing to throw down actual money for security, and people are begging for more production, the OEM might be willing to think about a second device with some of the premium hardware features people have suggested.

More opinions about cost/features in this thread.

matchboxbananasynergy

de0u Of these, to my knowledge, latest Pixels meet:

AMOLED display, custom refresh rate
1 TB of internal storage (as an option)
DisplayPort Alt mode (graphics over USB-C)
eSIM chip that can support 10+ eSIMs
Ultrasonic fingerprint scanner
NFC, UWB (UWB only on the Pro models)
Wireless charging (unless I am mistaken, not on all supported devices)

The rest of these are things people wish phones had, but which most phones don't.

I think what Pixels provide today is a good baseline to go off of, rather than people's wishlist.

In this case, we're talking about an existing OEM who would already be making a device. They would be making sure that our requirements are met on that device that they would be releasing anyway, along with potentially providing official GrapheneOS support by optionally shipping with it, or having green boot state for it if people flash it after the fact.

"Ordering" a phone from an OEM/ODM is different in that you actually have to pay that OEM to build the phone for you, and that's where each feature can increase the price to the point where it becomes too much for a non-profit to realistically pay/crowdfund.

An existing OEM who is already making devices has an incentive for that hardware to be good and featureful, because it's not just GrapheneOS that they're building it for, but for themselves as well.

It's still to early to tell, but I think some cautious optimism is alright.

barding

de0u Well... I think Google builds industry-leading security features into their phones, and tries to sell people phones based in part on security... and I think they are not exactly crushing out competitors with lower-security devices.

They don't provide industry-leading privacy, though, which I would bet is what most people want, even within GOS users (or, rather, security as a means to privacy). Most of us wouldn't be able to live a "high-security life" anyway, so the number of weak links are too many to say that the phone is the most meaningful piece of the puzzle.