Thoughts on selling of Pixels with preinstalled GrapheneOS

matchboxbananasynergy

AlwaLe729 Note that the phone you received from Verizon is likely locked and can't be used to install GrapheneOS.

Unless of course you've already done so, which would certainly be the exception rather than the rule.

[deleted]

idontknow I found this on the FAQ of the DivestOS website. Although not all points apply to GrapheneOS, I thought It could be useful.

"I want to sell devices with DivestOS preloaded, what should I know?¶

Selling devices with official builds of DivestOS installed is OKAY and within the license. Some preferred suggestions:

Handle the sale in good faith.
Do not market DivestOS as a magic bullet of privacy and/or security.
Verify the GPG signature and checksums of the builds you download/install.
Use Extirpater + factory reset to ensure no previous user data remains.
Ensure the device firmware is up to date before flashing.
Use the DivestOS recovery if supported.
Do not modify any system or firmware partitions such as /system, /vendor, or /boot.
Lock the bootloader if supported.
If the device requires a token or keyfile to unlock the bootloader, provide it to the user.
Leave it at the setup screen.
Leave the default wallpaper.
If you preload apps only source from the existing F-Droid repositories. (This would not apply as there are no existing F-Droid repositories on GrapheneOS by default.)
If you are not using official builds of DivestOS:

Make it clear to your users that it is unofficial.
Use the branding variables in the scripts to rebrand it.
You must make your sources available to your users as per the original repositories' respective licenses. Compliance is mandatory!
Consider upstreaming any appropriate changes."

idontknow

@[deleted] @de0u @Max-Zorin @matchboxbananasynergy

Thanks all for your feedback. My take aways:

General consensus: It's not scummy, but there are right and wrong ways to do it.

Explain I'm a 3rd party, not affiliated with GOS, and that I will handle support for a specified period of time
Explain I do not modify the OS
Alternatively, sell the GOS setup as a "how-to" service with best practices (this is the real value to the consumer)
Sell at least a Pixel 6 (no older)
Tell customers when firmware support will end, and what this means
charge no more than $150 over price of phone
donate part of proceeds to GOS project (30-50%)
Don't misrepresent the product (silver bullet for privacy)

Build process:

Verify GPG checksums of the OS file
Completely factory reset phones prior to install
Ensure firmware is up to date
Do not modify the OS in any way, aside from requested apps

I will pilot a small number of sales and see how it goes.

[deleted]

idontknow Good luck

Skyway

idontknow not to discourse you but I bought a p6a to install grapheneos on and realized that I needed a bigger phone so I listed it on eBay with grapheneos installed . it didn't sell for much more then I bought it for . granted I bought a new device and sold it as like new . wasn't looking to make money.

[deleted]

idontknow Verify GPG checksums of the OS file

GrapheneOS Developers don't provide GPG checksums. Only an .sig file is provided which contains the SHA-256 checksum of the appopriate Factory Image/OTA Update.

idontknow

Skyway Skyway It's definitely a niche market and I have no delusions about selling like crazy. If I do this it will be made to order with lots of communication pre and post-sale. I do think non-technical folks are starting to gain interest in digital privacy, especially older folks from my home country, the United States of "3rd party doctrine" America.

router99

idontknow Would I be a parasite on the FOSS community for this?

Why do you even care what anyone thinks about that? Just do it. If it's successful, great. Nobody is forcing anyone to buy anything, people are choosing to send you money for the service provided. There is literally nothing wrong with that. If it is not successful, then it was not a good idea after all. It's that simple.

everything2protect

A few years back I was looking for this. First I wrote to the GrapheneOS team and asked if they'd do it. They said no. Then I reached out to a local repair shop with a good reputation in my area and asked if they'd help me with it. I was asking for a $100 markup. They thought the price was fair but in the end they said they couldn't do it, so I had to learn how to do it myself.

I'm a bit surprised to hear that anyone thinks this process is easy for anyone who doesn't live and breathe tech.

Source the device
device compatibility?
device close to end of life?
unlocked?
Flash
OEM unlocking needs an update first?
unlock the bootloader
boot into bootloader
only certain USB cables work
set the udev rules
at least 1 DE is incompatible
Want to avoid Google Play?
sideload Signal Private Messenger
sideload VPN software

Oh yea, and don't follow any youtube tutorial, because the install instructions may have changed since then.

IMO $100 is a deal to for a plug and play solution that removes the headache of all this stuff. Every citizen deserves privacy, not just those of us who have the time and skill to implement these solutions ourselves.

Main issue I see is how to establish trust. Not sure I'd ever buy one from someone I couldn't look in the eye.

Also, I'm pretty sure there would be trademark issues with the marketing. Not sure how that would work.

I really liked the comment above that suggested incorporating a GOS donation into the purchase price.

Personally, I'd love to see the growth of a grassroots tech support industry the same way we've got a dentist, a doctor, an accountant and a lawyer.

« Previous Page