Thoughts on selling of Pixels with preinstalled GrapheneOS

I don't mean to be discouraging, but one of the worst things someone selling devices with GrapheneOS can do is sell near EOL or EOL devices to people. Nobody should be selling something older than a Pixel 6 right now, and that's cutting it close (https://grapheneos.org/faq#recommended-devices should be one's guide on which devices would make sense for this).

The reason for that is twofold. You're selling a phone to someone with the promise of it being secure when it cannot be past EOL. When GrapheneOS stops providing extended support releases for it (which are not complete, cannot be complete and do not make the device secure), those people are left stranded with an insecure device and without the technical knowhow to know what to do about it and what it means.

The second reason is admittedly more "selfish", but those same people may reach out to us, frustrated, because the phone they bought is no longer receiving updates, and why is that?

It's completely fine and allowed to sell devices with GrapheneOS provided you clearly explain that you're a third party and not affiliated with GrapheneOS, and that you do not modify the OS (as if the OS is modified, it is no longer GrapheneOS, and shouldn't be called that).

idontknow and there's "factory unlocked" which allows you to install the custom bootloader

No, It does not allow you to install an "custom bootloader".

idontknow

I wouldn't pay attention to Reddit comments like that.

The way I look at it, I was providing a service. For some people time is money and the time for them to secure a proper phone, learn about GOS, setting up their computer with the proper drivers to install it and setting up the phone is a significant cost in time. This is time they could be making more money (than it would cost to hire someone to do the above) or could spend doing other things like spending time with family, or recreational activities. I know a few directors and executives at my employer and they work 60 to75 hours a week. They use all sorts of services a "regular person" could do themselves (house cleaners, grocery delivery, vehicle cleaning and maintenance etc.) because their time is more important than doing these menial tasks in addition to their job. And it's not just executives that use these services, a lot of "regular people" do as well for their own reason.

Many of the naysayers look at the situation from their own perspective. "Well I bought a phone and installed GOS myself, why would anyone hire someone to do that?". Might sound harsh to say this, but those people have a limited view and likely will never be entrepreneurial.

They themselves probably use many services (go to restaurants, hire a plumber etc) that someone else with different skills could easily turn the table and say the same thing (well why don't they just cook food themselves, well why don''t they just unclog the drain themselves).

I think if you keep your overhead down, and start out slow then you could see where it goes. You might also start out consulting people on how to set up GOS on their own phones and installing their GOS devices for privacy. There is a lot of research involved in setting up a GOS device to be private, secure and everyday functional for the needs of an average person.

And like @matchboxbananasynergy said, make you sure you are clear with your clients you in no way represent or are directly involved with the GOS project, are not involved with developing the OS and are only a 3rd party installer. Any support would have to be done by you during the support period you define, and not the GOS team.

Good luck with this!

idontknow I found this on the FAQ of the DivestOS website. Although not all points apply to GrapheneOS, I thought It could be useful.

"I want to sell devices with DivestOS preloaded, what should I know?¶

Selling devices with official builds of DivestOS installed is OKAY and within the license. Some preferred suggestions:

Handle the sale in good faith.
Do not market DivestOS as a magic bullet of privacy and/or security.
Verify the GPG signature and checksums of the builds you download/install.
Use Extirpater + factory reset to ensure no previous user data remains.
Ensure the device firmware is up to date before flashing.
Use the DivestOS recovery if supported.
Do not modify any system or firmware partitions such as /system, /vendor, or /boot.
Lock the bootloader if supported.
If the device requires a token or keyfile to unlock the bootloader, provide it to the user.
Leave it at the setup screen.
Leave the default wallpaper.
If you preload apps only source from the existing F-Droid repositories. (This would not apply as there are no existing F-Droid repositories on GrapheneOS by default.)
If you are not using official builds of DivestOS:

Make it clear to your users that it is unofficial.
Use the branding variables in the scripts to rebrand it.
You must make your sources available to your users as per the original repositories' respective licenses. Compliance is mandatory!
Consider upstreaming any appropriate changes."