8y security updates on FairPhone 5, will the devs consider porting GrapheneOS?

Fairphone seems to be "introducing" Android 13 in October 2023, and touting a security patch level of August 5:

https://support.fairphone.com/hc/en-us/articles/4405858220945-Fairphone-4-OS-Release-Notes

It's consistently behind in providing updates - if the vendor cannot properly support their device in a timely manner, that's firmware updates that an alternative OS like GrapheneOS cannot ship, the OEM has to ship those. That alone disqualifies a device like that from being considered, aside from the fact that they lack the actual hardware security features which GrapheneOS utilizes and considers necessary.

"Years of support" are no good if it means providing some updates, sometimes, after significant delays. Support should mean timely support. If GrapheneOS said it would support a device for its entire lifetime, but delivered patches months late, would you consider that acceptable? My guess would be that if you're using GrapheneOS, you care about receiving the latest security patches as a minimum, so the answer to that would be no, so why should Fairphone get a pass?

It is unfortunate that people fall for their marketing and think that the device is somehow a good or viable choice, or that it's somehow special and provides something that other devices don't.

Even from a repairability and sustainability perspective, I would argue that a Pixel 8 that will be receiving 7 years of proper and timely updates is a better bet. Google also seems to have committed to providing parts like screens, cameras and batteries for the entirety of the device's lifetime through ifixit. Could it be easier to replace the battery in the Pixels? Absolutely, and I would love to see OEMs move back to that, but again, that doesn't make a phone like the Fairphone a good choice until it can provide the bare minimum.

gosrox

I have had little problem with the Pixel 8 fingerprint reader.

Imagine if GOS had the self delete option after 5-10 failed fingerpirnt reads like iOS

That's not how it works on iOS...

It sounds like you're using a screen protector interfering with fingerprint.

@nodoze GrapheneOS has had sandboxed Google Play since 2021. CalyxOS is a blatantly unsafe choice. You're much better off using an iPhone than a Fairphone or CalyxOS on any device. Providing proper privacy/security patches and not misleading users about privacy/security with cover ups and false marketing is the bare minimum.

GrapheneOS and CalyxOS are very different. GrapheneOS is a hardened OS with substantial privacy/security improvements:

https://grapheneos.org/features

CalyxOS is not a hardened OS. It greatly reduces security vs. AOSP via added attack surface, rolled back security and slow patches.

Compatibility with Android apps on GrapheneOS is also much different. GrapheneOS provides our sandboxed Google Play compatibility layer:

https://grapheneos.org/usage#sandboxed-google-play

Can run the vast majority of Play Store apps on GrapheneOS, but not CalyxOS with the problematic microG approach.

https://eylenburg.github.io/android_comparison.htm is a third party comparison between different alternate mobile operating systems. It could include many more privacy/security features but it's a good starting point.

https://privsec.dev/posts/android/choosing-your-android-based-operating-system/ is an article with more long form comparisons between OSes.

GrapheneOS iOS' closed source nature and mandatory user identification makes it unusable.

mateowoetam There is no way this wasn't written by ChatGPT, right? It's such an incredibly strange way of writing. Are you an actual person?

gosrox Very sorry to hear of your pain. I have had no issues on my Pixel 7 running GOS as my daily driver for many months now. My Pixel 8 Pro recently arrived but I have not had time to install GOS and configuring things to switch from the Pixel 7 to the Pixel 8 Pro but, if I have fingerprint issues on the 8 Pro I will try to remember to circle back. My kids are running GOS on Pixel 6A & 7A with no major issues reported & my memory was/is that I tested finger print access on them fine before giving them the phones.

@CodexAG No, the purpose of GrapheneOS is not simply patching specific vulnerabilities which is a tiny portion of the work we do.

As explained earlier in this thread, Fairphone's devices do not meet basic security requirements for hardware, firmware and the software device support including drivers. In theory, drivers could be entirely rewritten over several years and maintained by us, but that's not realistic and is not what we work on doing. It would not change anything about the underlying hardware and firmware security, so the devices still wouldn't meet the requirements. Being 1-2 months behind on High/Critical severity patches and much further behind for other security patches is only one of the problems. Please look at the hardware requirements at https://grapheneos.org/faq#future-devices and check for yourself how many of those are provided by the Fairphone. Even the Fairphone 5 has a CPU core from 2021 without even PAC and BTI.

Your post violates the rules of our forum due to the unsubstantiated claims and misinformation. If you want to participate in the forum, your approach needs to change.

GrapheneOS ok but I thought it was common knowledge google can't be trusted to protect your privacy.

CodexAG No, it's about Google's scale and how much data their services end up having on people. They encourage people to submit lots of data and opt-in to features providing a lot of data. They use this to tailor their services to get you to use them more and to target ads to you themselves. At the same time, they're extremely well regarded for the security of their devices and services. You're buying into a social media echo chamber concept of privacy. The reality is that most companies have far worse privacy practices and people only talk about Google so much because they're such a large company with so much reach. We make decisions based on reality rather than marketing products to people buying into the social media, pop culture and mainstream media concept of privacy and security which is utter nonsense. Our goal is providing private and secure devices, not making money selling products. That makes us a lot different than most projects in this space which exist to earn money for the creators. Open source does not equal good and benevolent. The privacy and security space is full of scammers trying to convince people to buy their products, which requires them to convince people mainstream devices are worse than their own faulty products. You would be better off simply using Signal on a well configured iPhone than nearly any of those products.

Fairphone has an awful track record on security. They don't even acknowledge the issues or state how they're going to be resolving them unless it gets media attention. They claim to provide more software support than they really do. We aren't going to support these insecure devices. They'd need to greatly raise the priority of security, turn it around and acknowledge the past failings as part of changing the culture towards this there. We care about having actually private and security devices. People's perception on that is only relevant to the extent it's needed to expand the project.

Since the thread has been derailed with off-topic unsubstantiated conspiracy theories and misinterpretations of information in leaks about government spying, the thread is being locked. The off-topic discussion has been removed.