it's URGENT for GrapheneOS to build its own phone

grayway2

The situation with Google is worsening everytime. First they removed Pixel device trees and after they announced that only verified apk will be allowed on certified OS.

Now, they don't publish Android 16 QPR1 code in AOSP when they usually do it in 48 hours.

I don't know how GrapheneOS will find the money for building its first phone but the situation with Google Pixels and AOSP is terrible.

Eirikr70

grayway2 A cup of tea, dear ?...
Don't participate in spreading alarmist messages. Google is changing its Android strategy. But that's not yet the end of GrapheneOS. The bootloaders of the Pixel 10th gen are not locked. And anyway if Google ever decides to go closed source, no GrapheneOS hardware will change any of it.

userofgos

grayway2 Alarmism isn't necessary right now and declaring it "URGENT" isn't helping.

grayway2 don't know how GrapheneOS will find the money for building its first phone

The GrapheneOS project are not building their own phones, they are in talks with and partnering with an major OEM that does build phones for regular consumers. It is still unknown who this OEM is (for good reason) which is still in the process of developing a device that meets the security and hardware requirements (which will likely take more than a year). Putting unnecessary pressure on the project is likely not helpful.

This partnership with the OEM has benefited the project greatly already by providing early access to select portions of the code: https://xcancel.com/GrapheneOS/status/1964754118653952027#m

The GrapheneOS project are not the only ones impacted by the changes Google is making, even the mainstream OEM's are impacted.

Google's existing system for distributing security patches to OEMs was already incredibly problematic. Extending 1 month of early access to 4 months is atrocious. This applies to all of the patches in the bulletins. This is harming Android security to make OEMs look better by lowering the bar.

The existing system should have been moving towards shorter broad disclosure of patches instead of 30 days. Moving in the opposite direction with 4 months of early access is extraordinarily irresponsible. Google has also abandoned pretending it's private by allowing binary-only embargo breaches.

Android's management has clearly overruled the concerns of their security team and chosen to significantly harm Android security for marketing reasons. Lowering the bar for OEMs to pretend things are fine while reducing security for everyone is a ridiculous approach and should be quickly reversed.

Android is very understaffed due to layoffs/buyouts and insufficient hiring. This is impacting Linux kernel and Android security.

wuseman

grayway2
We don’t yet know why there is a delay. Since it’s the first time I don’t think we should sound the alarms just yet.

DeletedUser481

grayway2

The late release of QPR1 is alarming for sure. But at this point it's more likely the software just isn't ready for the pixel 10 specifically and they don't want to release it just yet. I doubt they are really going to release a month old build with no changes at all.

raccoondad

wuseman Since it’s the first time I don’t think we should sound the alarms just yet.

No reason to when google has said they will release it, the issue is probably a security one if I were to speculate. Maybe they caught something nasty

Other speculations may point to legal issues with the monopoly BS

starglider

DeletedUser481 This seems like the most reasonable explanation. Hanlon's Razor and all. Google has their problems, but some of the comments here act like they're the Evil Galactic Empire instead of a semi-monopolistic profit-driven tech company.

Separately, though, I'm not sure how GOS making their own phone addresses the Android release concerns. If Google closes up Android, having a GOS phone isn't going to improve things.

Having an alternative to Pixel phones does, overall, make sense, but it's addressing a problem that's completely distinct from "Google decides to abandon AOSP." If that happens, there's almost no way that any small team could continue to reasonably maintain a hard fork of Android.

harp

DeletedUser481 But at this point it's more likely the software just isn't ready for the pixel 10 specifically and they don't want to release it just yet.

But QPR1 is rolled out for Pixels with the Stock OS already, it's only not pushed to AOSP yet? So I don't think it's a Pixel 10 specific Problem. Nobody (except Google internals) knows the real reason at the moment.

de0u

starglider I'm not sure how GOS making their own phone addresses the Android release concerns. If Google closes up Android, having a GOS phone isn't going to improve things.

Having an alternative to Pixel phones does, overall, make sense, but it's addressing a problem that's completely distinct from "Google decides to abandon AOSP." If that happens, there's almost no way that any small team could continue to reasonably maintain a hard fork of Android.

Google (hypothetically) deciding to shut down AOSP would not be the same thing as Google deciding they won't have any OEM partners -- that would basically mean that Samsung, Sony, etc., would need to individually or jointly fork Android or stop selling phones. Or, I guess, switch to HarmonyOS!

If Google (as expected) continues to license Android to other handset makers, and GrapheneOS joins with a handset maker, it plausibly would remain possible for a high-security Android variant to exist. Obviously there is no way to meaningfully speculate about licensing terms -- for a non-AOSP Google Android or for an industry fork of Android.

I expect people will speculate anyway.