Running BOINC on GrapheneOS?

0xC0DED0D0

I like the idea of helping out BOINC - distributed computing for scientific research - using my phone while it's charging and otherwise idle. Official Android client works just fine, though it's a bit "rough around the edges".

Plenty of stars on GitHub for this very mature project, but the client operates on the principle of Dynamic Code Loading (DCL) through storage. It is my understanding that each BOINC project has it's own "applet" running in the client, through this utilization of DCL.

So, with this in mind, how much of a security risk does this constitute for a "Regular GrapheneOS Joe", with no "special threat profile"? Is it advisable to run the BOINC client within it's own profile (background tasks allowed, obviously)? Or could I keep it chugging along in the Owner profile?

Anything else to consider?

littlerack

0xC0DED0D0 Anything else to consider?

Like not installing it on a device that is not that powerfull and it's "use" is more expensive than that of a laptop that can be "volunteered-into"?

Probably9857

0xC0DED0D0

The whole point is to allow other (unknown to you) people to run arbitrary code on your device. I would personally not be willing to accept that risk.

If you really want to do it, maybe get a used device solely for that purpose.

Johnnyloans

Probably9857 Literally no one has said this.

The OP is asking for his point of view:

0xC0DED0D0 Regular GrapheneOS Joe", with no "special threat profile"?

You're safe to run it on the main profile.

Touching on Phone efficiency:
My phone takes fifty 0-100% cycles--assuming no degradation--to consume 1kWh of electricity.
Pocket change that I'd throw away.

An adversary would not skip all of the low hanging fruit. I'd wager there are far more PC BOINC users than phone. Coding an exploit for windows is far easier and more lucrative than trying to breakout of a GOS sandbox, and subvert selinux, etc

No one will target you mate, keep the lab coat on.

0xC0DED0D0

littlerack Like not installing it on a device that is not that powerfull

Smartphones have plenty of juice, really. I'm only on a 9a, admittedly, but even that is already on par with some budget laptops in terms of computing power. It's not a data centre, by any means, but that's precisely the point - distributed computing utilizing resources everywhere and anywhere.

littlerack it's "use" is more expensive than that of a laptop

Don't quite understand the expense argument here?

Are you concerned about battery wear? Client is set to only activate once battery charge is at x % - ideally past the limit where battery bypass kicks in. Similarly, the client should be set to pause if battery temperature exceeds a certain point.

Probably9857 I would personally not be willing to accept that risk.

Not even in a separate profile, then?

littlerack

Probably9857 For example, let's take a look at the issue that is open since 2020 "Can we please not "ping" Google just to see if the Internet is available? The BOINC client currently shares my IP with Google without my consent or any any privacy policy mentioning that. That's arguably a GDPR violation as IPs are personal data."
Maybe they've just forgot to close it

In general, that's the issue with apps, you never know if a dev considers something to be not a big deal. In a privacy-concious community its not that OK

Probably9857

0xC0DED0D0 Not even in a separate profile, then?

I would only do it on a separate device. But that's just my opinion. Of course a separate profile would be safer than a profile with all your personal data.

0xC0DED0D0

littlerack take a look at the issue that is open since 202

Valid point, and one to consider for potential privacy implications for anyone using it.

Here's another: what might be ascertained from analysis of idle CPU cycles consumed by BOINC?

And, to my original question on security – the applets running in the client: what's their potential threat vector?

Johnnyloans

Sorry every comment is saying to not use your phone how you'd like due to their personal reasons. What are we GoOgLE?

I will reply to your OP later on.

0xC0DED0D0 what might be ascertained from analysis of idle CPU cycles consumed by BOINC?

The issue with BOIC is like a person ascertaining:

Throw away your high heels ladies. Adding just 1 inch--2.5cm--to flats increases ankle injuries by 20,000%. Your bones will break soon--heels aren't best practice.

Or: "Don't go outside; did you hear about the car crash 4 days ago? Inside the house is safe."

They're saying BOINC could have be malicious even if inadvertently. Yes, it's possible; however, I doubt most people that recommend this inspect the 20-100 apps they have installed due to the high importance of their own apps and needs. They likely find BOIC to be frivolous and not worth the risk--to them.

If you want to, do it. Many GOS users enjoy control and install every meta and google app there is.

Probably9857

Johnnyloans every comment is saying to not use your phone how you'd like due to their personal reasons

Literally no one has said this.

I take it for granted that the OP will make their own decision after considering (or ignoring) our feedback.