Watch interview with GrapheneOS on David Bombal's latest video

Hat

DeletedUser495
That's precisely why I'm asking. This is the principle used by manufacturers who produce devices for other brands on demand. This applies to both phones and household appliances. The brand receives a share of the profits either through licensing or by reselling the products itself.

I don't think that's the case here, though.

Having an alternative to Pixels will of course be beneficial for everyone. I also think that some users would like to support the Foundation by choosing this device.

de0u

Hat Having an alternative to Pixels will of course be beneficial for everyone. I also think that some users would like to support the Foundation by choosing this device.

In the current landscape not a lot of phones have good hardware security, and also not a lot of phones support verified boot of third-party operating systems, if an OEM is willing to work with the GrapheneOS project to meet the security standards, fast patch turnaround time, etc., that will be of substantial benefit to the GrapheneOS project (and, I suspect, to the OEM).

If some users are willing to donate to the GrapheneOS project, there are multiple ways to do that. And those ways don't have the weird corner cases that running money through an OEM would have. For example, what if a user buys one of these devices and returns it after 90 days? I guess the OEM could delay passing a donation on for some months, but that's not exactly a benefit. All of this assumes that the OEM would somehow know which of the devices are running GrapheneOS, which seems unlikely -- I have not heard of any plan for the OEM to sell GrapheneOS-only devices or even to sell devices with GrapheneOS preinstalled.

The GrapheneOS donation page currently has eleven options, all of which work for people who own Pixel devices, and all of which are likely to keep working for owners of a non-Google device.

Hat

On the other hand, the fact that the device is sold under a different brand name, and that the user performs the final installation, will reassure buyers who do not wish to reveal that they are purchasing a GrapheneOS device.

GraphPaper

Xtreix

Human After All

Robot Rock

;-)

MetropleX

Hat Xtreix there is indeed more than meets the eye.

Sorry I'll get my coat.

harp

Hat Will the GrapheneOS Foundation benefit financially from this collaboration with the manufacturer?

I think there are a couple of other very welcome benefits apart from any possible financial ones. For example the actual security preview releases, which are only possible due to the actual partnership with that OEM. Also users could benefit in terms of device warranty, as the OEM would certainly not refuse to honor it due to the use of GOS.

The OEM also benefits from this, of course, because there is a number of new buyers - albeit not a very significant number - who consciously choose to buy their product instead of a Pixel. And the may also receive support for the development of their stock OS in terms of security concerns. So it's a win-win situation for all sides.

And maybe there will be more donations for GOS, not only from new user, but also simply because of the increased attention paid to this project.

Hat

harp
Everything that you and @de0u said is true.
However, donations are typically driven by a small number of donors who contribute at a later stage.

Including the development costs in the device's initial price would benefit both the team and the users, as it would allow more features to be added later on. There are also other methods, such as companies paying to make their search engine the default browser option on Vanadium...

If GrapheneOS had a larger income, the foundation could grow faster and achieve more of its privacy goals.

indigomadelin

25:24 No user apps whatsoever have access to any hardware identifiers from the phone. Is the DRM ID (with per-app and not per-app-per-profile strategy) considered a hardware ID?

In the How to download apps on GrapheneOS phones section, you could have mentioned that F-Droid as a repository is not recommended because they build and sign apps themselves. Perhaps F-Droid as a client with the IzzyOnDroid repo would be acceptable.

44:40 You stated that Google FCM doesn't receive push notification data and only sends a wake-up call to the app. However, see https://arxiv.org/abs/2407.10589 and https://www.axios.com/2023/12/06/apple-google-requests-push-notification-data

de0u

indigomadelin Is the DRM ID (with per-app and not per-app-per-profile strategy) considered a hardware ID?

Strictly speaking, it's not, because for WideVine to work there is a provisioning step where the device is issued a certificate. Personally I am unaware of information about how to forget that certificate, or otherwise force reprovisioning. Perhaps somebody more knowledgeable will chime in.

MetropleX

indigomadelin 25:24 No user apps whatsoever have access to any hardware identifiers from the phone. Is the DRM ID (with per-app and not per-app-per-profile strategy) considered a hardware ID?

I personally didn't, in the context of the reponse, consider it a hardware ID referencing our documentation/FAQ. While I do appreciate what your getting at, the DRM ID issue has more variables, I wanted to give as high level broad interpretation of things as possible to help the flow of the interview leaving options open for further questions then or for further content and more in-depth issue focused/specific appearances. If the interest is there, as David mentioned he is looking to engage with either myself or the team writ large with a view to drilling down further if the demand is there.

indigomadelin In the How to download apps on GrapheneOS phones section, you could have mentioned that F-Droid as a repository is not recommended because they build and sign apps themselves. Perhaps F-Droid as a client with the IzzyOnDroid repo would be acceptable.

I was specifically asked about F-Droid but my attention was and remains to draw interest to GrapheneOS and by omission of not recommending it believed it to be the best approach. Doing otherwise would have detracted from the positive message I wanted to convey, possibly resulting in unnecessary attention from parties negatively inclined toward us. Obtainium covers F-Droid also be it their main repo or third party ones anyway.

indigomadelin 44:40 You stated that Google FCM doesn't receive push notification data and only sends a wake-up call to the app. However, see https://arxiv.org/abs/2407.10589 and https://www.axios.com/2023/12/06/apple-google-requests-push-notification-data

While Apple and Google don't generally sit between an app and the servers it connects with, the notifications that an app sends to users typically do flow through those companies' servers.

It is obviously down to how the apps are made and how they format their push messages and what protocols they use to ensure they can't be read in transit. As mentioned above the approach was to talk as high level as possible and not get bogged down in the weeds too much. This was also totally unscripted and off the cuff.

de0u

indigomadelin You stated that Google FCM doesn't receive push notification data and only sends a wake-up call to the app. However, see https://arxiv.org/abs/2407.10589 and https://www.axios.com/2023/12/06/apple-google-requests-push-notification-data

Thanks for the link!

How much information an app server chooses to include in a push notification is up to the app designers. I encourage consulting the tables in the paper to see which apps are tagged as leaking which information. Apps one might hope would be sending "empty" push messages may well be reported that way, and apps one might expect to be leaking data might be reported to leak.

Johnnyloans

DeletedUser495

Partnerships or exclusivity deals are the bread and butter of business.

In the video, he says the OEM is making a normal phone they will sell to anybody--not grapheneos branded.

I think I heard before that you can buy it with grapheneos already on it if you want.

Your scenario, it is extremely common to have, say, a water bottle manufacturer make Taylor swift bottles and give her a cut. Or have access to a new market and give a cut. Put our product infront of your graphene group and we'll give you a cut.

de0u

Johnnyloans I think I heard before that you can buy it with grapheneos already on it if you want.

Here's what I'm aware of:

"Ideally the devices could be sold with GrapheneOS but it would be enough for them to meet our requirements so people can install it on the devices themselves. We do want to have the devices available in an official capacity with GrapheneOS preinstalled rather than third party companies doing it. We're talking to an OEM about this and are hopeful about it." (June 18 source)
"We're working with a major Android OEM on improving the security and updates for their devices in order to provide official GrapheneOS support. We're making good progress towards it. There will be an announcement with them at some point and then later an initial phone launched with official GrapheneOS support." (November 12 source)

I don't think I've read a claim that GrapheneOS preinstallation is expected to happen.

user2025

Great video,thanks to both lads there...lots of new and old things presented.

With the risk of offending or make polemics: may i ask the reason why our respected member / guest speaker used the avatar and not been physically present or face to face virtually in the interview !?

Thanks and keep up the great work ! ;)

Xtreix

user2025 may i ask the reason why our respected member / guest speaker used the avatar and not been physically present or face to face virtually in the interview !?

It was the same when The Hated One interviewed @flawedworld . Aside from the fact that some people don't like being filmed or simply want to keep their identities private, the harassment the team has endured for years is a motivation for this, as is the use of pseudonyms.

nandohyphen1

Great job @MetropleX ! This is a great interview! Love how you explain everything about this OS! Keep up the good work! 🎉

MetropleX

nandohyphen1 really appreciate your kind words and feedback. Thankyou.

Graphene1

MetropleX you smashed it pal.

sfb

I'm pretty sure that David Bombal is South African and MetropoleX is from the north west of England. But I might be wrong.

phone-company

sfb is it important where he come from? I bet he has a reason not to tell everyone everything :)

MetropleX

sfb MetropoleX is from the north west of England. But I might be wrong.

Yes, yes you are, I am from Cybertron. 🙄 😆

sfb

phone-company No it is entirely irrelevant where either of them are from. Are you an Arch user by any chance?

Eirikr70

Layman's question : what is the audience of David Bombal ?

c86

Eirikr70

He targets a lot is sysadmins and runs courses for coding. He also touches on privacy topics a bit. Some folks find he explains things well, some think he jumps on tangents and becomes difficult to follow. You can see a bit of that in his interview style.

There was also a video he put out a couple years ago on how to install GOS. Weird thing about that was he made his own install guide PDF that made the process more clunky than just following what was posted on the GOS website.

MetropleX covered a lot of detail and was pretty thorough. It was very similar to flawdworld's interview.

« Previous Page Next Page »