Addressing concerns of resource constraints

[deleted]

How does one respond to comparisons of GrapheneOS security to iOS and stock Android centered around man-hours expended (i.e. looked at a lot less than any iPhone)? Here are a few examples. Questions of that kind have been posited to me by people considering switching over but I'm simply not qualified to provide a definitive answer. I can link them to the Features page discussing attack surface reduction and exploit mitigations but it doesn't fundamentally address their concerns. “They'll say, 'Well, here's a company with near unlimited resources and here's bunch of maybe competent developers with limited funding one whom has Bender the Offender as his Twitter profile pic.' Snowden's endorsement usually goes a long way, but leaves questions of long-term viability and resource constraints unaddressed.

MetropleX

[deleted] one of my main arguments is that while say Google has all the resources to focus on making the full OS they don't have ALL the resources as in the most skilled/technical people in every sphere of technology, they have many, but not all of them want to work at Google.

This fact is demonstrated by Google/AOSP relying just as heavily on those niche focused individuals competent enough to contribute to it upstream.

Our lead developer has made numerous contributions that have landed upstream benefitting every Android user from AOSP to other OEMs. Android as a whole is made stronger only thanks to projects such as GrapheneOS and where OEM flavoured Android distributions have to take a middle road between their corporate objectives and our security/privacy, GrapheneOS does not, our security/privacy is the ONLY focus.

abcZ

Simply put, its not just the resources of GrapheneOS. Its the resources of GrapheneOS + the resources of Google + the resources of everyone who contributes to the Linux kernel + the resources of everyone who contributes to all of the different packages that make up AOSP.

[deleted]

abcZ Yeah, the mention of it being based on AOSP usually does very little because so are all the other "custom ROMs".

MetropleX This fact is demonstrated by Google/AOSP relying just as heavily on those niche focused individuals competent enough to contribute to it upstream.

Our lead developer has made numerous contributions that have landed upstream benefitting every Android user from AOSP to other OEMs.

The contributions upstream are mentioned quite extensively on GrapheneOS website. I agree that addresses (or at least should address) the fact the people leading the project are competent but nevertheless resource-contained. But I don't really know what it takes to track AOSP which according to Daniel GrapheneOS deviates from far less than the others.

abcZ

[deleted] The distinction between "the others" and grapheneos (and similar competent projects), is that "the others" don't actually contribute anything of much value. They either add in half-baked hardware support, or throw in every broken feature they can come up with, and often intentionally violate security (like permissive or broken sepolicy) in order to make those features work.