workeronthewalls
First of all: Now that's a bold statement.
How exactly do you know that Google isn't sharing information on vulnerabilities with the intelligence agencies before they share it with OEMs?
No, you're making the extraordinarily claim not backed by any evidence and contradicted by leaks. The burden of proof is on you.
And in general: Even if there is still the open source version, without the closed source security patches, just by thinking about the psychology here and I mean that of course most people that are interested in the most secure mobile operating system (GrapheneOS) and maybe even developed trust for it by using it for a long time and hearing mostly good stuff about it, wouldn't really choose the less secure open source version, especially not if the closed source patches are even recommended.
The regular variant is open source with tags pushed before it's released. The security preview variant is nearly entirely the same but with patches applied on top of the code from those tags which are provided under an NDA requiring publishing the sources at a later date. The sources for each security preview release will be published by publishing the patches and the script for applying them once the embargo ends. It will be open source as soon as permitted by the NDA for the patches.
If I would work at an intelligence agency I would get to that assessment really fast.
And for an intelligence agency it's a game of numbers: "Do I get everyone? Probably no. But I get many or even most of them. And some of the rest I maybe even get through the people I already catched with the first trap."
Maybe it's also kinda a panic button for intelligence agencies, which they are not really intending to use right now, but having it available in their arsenal. In that scenario they would, like in the famous security meme, just come to you, hold a gun to your head or similar and force you to install a backdoor through the closed source patches. Would that be the end of GrapheneOS? Probably. But that's kinda what panic buttons are known for I guess.
Long story short: I will not say that you are compromised by the intelligence agencies, but as someone interested in security I learned very fast to expect the worst if you can't proof something better. And I can't proof that you are compromised by the intelligence agencies, but I also can't proof that you aren't, although when you went open source only (except some hardware stuff), I guess we came pretty close to the proof that you aren't compromised.
You've ignored what was posted about and posted unsubstantiated nonsense. You only need to do basic critical thinking to see that you're thoroughly incorrect. All of the patches which are under embargo are for vulnerabilities in open source code. You have all of the open source code with those vulnerabilities. If open source works the way you believe it does, then people should be able to find and fix all of these vulnerabilities very easily. You don't need the patches for the open source code because you already have the open source code, and according to you that means people will find the vulnerabilities or backdoors in it. Therefore, it should already all be found and fixed already. Why are there still security vulnerabilities being fixed in open source projects if it works the way you believe?
It's far more difficult to understand a million lines out of the many millions of lines of open source code in the Linux kernel, LLVM, AOSP, etc. than it is to reverse engineer 60 patches for the upcoming bulletins. They're the ONLY changes in the security preview releases compared to the regular releases, so ALL differences in the compiled code are a consequence of applying the patches. You have access to the code to review and determine what the patches do, why and if they're correct/complete fixes. That's a far easier task than reviewing a massive amount of open source code at even a surface level without any hope of finding most vulnerabilities.
The source code of the patches is not inherently understandable to developers and they'd need to do a form of reverse engineering to figure out what they do and why. Doing it from the compiled code isn't actually as different as you believe it is. The patches do not come with a detailed explanation of the security issues they're fixing and how they're fixing them. They're source code with a basic commit message explaining what it's doing and rarely with much detail on it. You can take a look at the already public patches from the September 2025 bulletin for many examples. Have you reviewed those patches? Have you reviewed the changes made by us in our releases? Why is it trustworthy because it's source code instead of compiled code? Both can be reviewed. Having the source code makes it easier, that's all. There are only 60 patches applied on top of the regular releases for this. It's not a lot of code in total and therefore far easier than reviewing a large amount of open source code.
Your claims about this do not make sense and you're not participating as someone who appears to be acting in good faith. Making unsubstantiated and illogical claims disregarding what has been discussed isn't appropriate. It appears to be concern trolling now.