Remix.run Logo
fluffypony 9 hours ago

I don't want to gush about this too much, but it's SUCH a big deal. Graphene has languished with hardware support for so long - they basically only had Pixel devices as first-class citizens, which are not bad devices per se, but it's hard when you're spending most of your time doing something without the manufacturer's support.

There is a very real possibility that we end up with devices that can play modern mobile games at high frame rates on a secure, privacy-focused mobile OS, which is a huge step towards general adoption of something like this as a daily driver.

bubblethink 6 hours ago | parent | next [-]

This is such a strange comment that is full of contradictions. Pixels are supported because the manufacturer supports alternate OSes. I don't get what languishing means here. Pixel hardware lags behind the latest Snapdragon hardware, but it's not something that average people know or care about. So, you can gush all you want, but I don't see why it's a big deal. It's great that they found an OEM and it's great for the overall health of the project, but not because of gaming or the latest Snapdragon.

gchamonlive 5 hours ago | parent | next [-]

Does pixel support alternate OSes or it just doesn't get in the way of custom firmware developers?

And for the gaming aspect, there is a huge market for mobile gaming, specially in Asia, so having a manufacturer like Motorola adopting GrapheneOS as a first class citizen will improve the chances that high performance applications will have better performance in such OSes which is a big win.

throawayonthe 2 hours ago | parent [-]

i mean, that sounds like a subjective distinction, but it lets you unlock the bootloader and then re-lock it with your own keys so eh..?

sharperguy 2 hours ago | parent | next [-]

they used to publish a buildable AOSP tree for the device which is no longer the case

gchamonlive 2 hours ago | parent | prev [-]

If you conceive a device to be shipped with a specific OS that's a completely different relationship with the developer than just giving the keys to the kingdom and wishing good luck, so I hardly think this is subjective

t0bia_s 2 hours ago | parent | prev | next [-]

Lets hope those Motorola devices will be smaller then current Pixels.

user2722 5 hours ago | parent | prev [-]

I do hope however having a Snapdragon device will be beneficial to having postmarketOS support.

For now having Android-type OS on a daily driver is a must, but for older devices (thinking of 10 years time) I'd like to explore an OS which doesn't depend of Google open-source drops and delayed security open-source drops, which is the situation for ROMs without an ODM partner.

bubblethink 4 hours ago | parent [-]

Do you mean to say that postmarketOS is somehow better on non Pixel devices? I would assume that Pixels are closest to upstream and have the longest software support life in Android world.

opan 2 hours ago | parent [-]

pmOS runs well on a couple OnePlus phones (6, 6T). For whatever reason the Snapdragon 845 and 865 have decent mainline support. I expect the OnePlus 8T to join the prior list of phones in the near future. You can similarly look at which gaming handhelds are supported by ROCKNIX and what SoC they use to get an idea for which ARM SoCs have decent mainline support. I expect the vast majority of phones and other ARM devices to not be very well-supported. RockChip is usually the safest bet, but I've been pleasantly surprised with some Snapdragon stuff.

monegator 8 hours ago | parent | prev | next [-]

"general" people really play actual games on phones? I thought the general public at most played with time waster freemium games

archievillain 8 hours ago | parent | next [-]

I wouldn't consider gachas to be "actual games" (sue me), but yeah, they do tend to have way more complex gameplay and graphics than the timewaster freemium games of yore. Genshin Impact is essentially a single-player MMO, it has an open world and lots of characters and different weapons etc etc.

monegator 7 hours ago | parent [-]

still wouldn't bet the general phone audience find those games to be the the deciding factor in a phone

DrewADesign 6 hours ago | parent | next [-]

I think it would be on par with camera quality— really important to some, bot not a huge deal for most.

Good enough quality screen for solid video media performance, generally, would be an absolute must I imagine.

applfanboysbgon 5 hours ago | parent | prev [-]

The "general phone audience" is some 5 billion people. If even 10% of them want to play games, on what is in the current year likely to be their primary if not only computer, that's already a market segment of 500 million. It wouldn't honestly surprise me if the number is closer to 15 or 20%, mobile gaming is extremely popular.

monegator 4 hours ago | parent [-]

i would be surprised if it was more than 1-2% for those "graphic intensive games"

normies use consoles, sometimes PCs

my personal beef, after a camera that gets decent photos in low light, would be an accurate GPS that doesn't crap out after half an hour

applfanboysbgon 4 hours ago | parent | next [-]

I think a lot of HN users, living in our own PC-oriented bubble, may not have realised the world has completely passed PCs by and that smartphones are the personal computers of the current generation. While PS5 and Switch each have about 100-150 million in sales, there are an estimated 3 billion mobile game players. Are a majority of those "mobile game players" playing Flappy Bird, sure. But again, even 10% of that number being interested in "real games" would outnumber PS5 and Switch players combined. Fortnite and PUBG each have hundreds of millions of active users, most are on console but around 20% appear to be on mobile from a quick search. Genshin Impact also has tens of of millions MAU, a non-neglible percentage of which are mobile players. There are hundreds of millions of people for whom being able to play 3D games on their phone matters.

kuboble 4 hours ago | parent | prev | next [-]

Anecdotally,

In public transport I see almost as many people playing games on their phones as those watching videos.

throawayonthe 2 hours ago | parent | prev | next [-]

mobile has been the largest gaming market for years now, wdym?

SietrixDev 4 hours ago | parent | prev | next [-]

And yet Apple was at some point called one of the largest gaming companies in the world by revenue

https://www.cnbc.com/amp/2018/06/05/apple-one-of-the-biggest...

3 hours ago | parent | prev [-]
[deleted]
4 hours ago | parent | prev [-]
[deleted]
kace91 6 hours ago | parent | prev | next [-]

The key enabler is the camera. Manage a flagship level result in a Motorola, that’s the main reason people pay for High end devices nowadays.

I’m seeing enthusiasts go out of their way to get vivos and xiaomis now that they are surpassing the western counterparts based solely on that.

I think it’s doable, pixels did it with meh hardware for years. But I’m not sure if there’s enough overlap between people who care about selfie quality and open source enthusiasts.

strcat 2 hours ago | parent [-]

Motorola Signature and Motorola Razr Fold are ranked above the Pixel 10 Pro on https://www.dxomark.com/smartphones/. Pixels have fantastic camera hardware and software which is fully functional on GrapheneOS which isn't something we need to lose on a Motorola flagship. There will be much better CPU and GPU performance via Snapdragon too. The compromises are mostly in terms of getting some security improvements while losing others but we'll still be able to meet all of our official security requirements.

kace91 41 minutes ago | parent [-]

I haven’t been able to see actual results that match those tests in the Motorolas sadly. Maybe it’s more accurate in technical terms but I haven’t found good results in practice.

>Pixels have fantastic camera hardware and software which is fully functional on GrapheneOS which isn't something we need to lose on a Motorola flagship.

This is very interesting to me! Does graphene OS manage to keep google’s processing? How does that work?

thot_experiment 7 hours ago | parent | prev | next [-]

I'm not holding my breath but it would be amazing to have root and be able to tap to pay without constantly playing cat and mouse with google.

diacritical 7 hours ago | parent | next [-]

Unfortunately from what I read a couple of times, including a month or so ago, GrapheneOS discourages and doesn't support rooting the phone for security reasons that seem vague to me and don't appeal to my need to actually own my phone and OS. You could still root it with some third party tools from what I know, but not having root as the default makes it less of a secure FOSS OS and more of a closed down toy.

As for payment apps and other crap that refuses to run if I, the owner and administrator of my own device, don't have admin access, I would just refuse to run it. What's next - websites refusing to work if I have root on my Linux desktop?

strcat 2 hours ago | parent | next [-]

LineageOS also discourages and doesn't support replacing the core of the OS with a rootkit providing persistent app accessible root. GrapheneOS is no different from LineageOS in that regard. People do this with GrapheneOS regardless of our strong recommendation not do it. Our reasons for discouraging it aren't vague. It very directly harms the security model and is not a good approach to implementing any of the features hacked together through it. Those features should be properly implemented to fit within the overall approach taken by GrapheneOS. Giving root access to a huge portion of the OS harms security even if you never use the feature. It does not mean you can't do it, we only recommend you don't.

kevincox 6 hours ago | parent | prev | next [-]

Yeah, this is the deal breaker for me as well. The fact that I own my device is non-negotiable. It is the reason I left the stock OS and I'm not going back. The idea that I can't access my own files if an app doesn't explicitly give me access is wild to me. I understand there are security risks of a root permission but it is important to have that fallback when you need it and the existing permissions aren't sufficient.

strcat 2 hours ago | parent | next [-]

LineageOS also discourages and doesn't support replacing the core of the OS with a rootkit providing persistent app accessible root. GrapheneOS is no different from LineageOS in that regard. People do this with GrapheneOS regardless of our strong recommendation not do it. Our reasons for discouraging it aren't vague. It very directly harms the security model and is not a good approach to implementing any of the features hacked together through it. Those features should be properly implemented to fit within the overall approach taken by GrapheneOS. Giving root access to a huge portion of the OS harms security even if you never use the feature. It does not mean you can't do it, we only recommend you don't.

kevincox 2 hours ago | parent [-]

LineageOS provides ADB root access in stock builds. Sure, it isn't as convenient as some su apps but at least I can use ADB to access every file on the device. It probably also improves the attack surface compared to a su app.

> It very directly harms the security model

What do you mean by this? You mean that it is a "god permission" that bypasses other permissions? If so then yes, with great power comes great responsibility and it shouldn't be used lightly.

> and is not a good approach to implementing any of the features hacked together through it.

Maybe not, but is there an alternative? What is your recommended way to access all files of any app? This is my primary use case. Modification would also be valuable but I would be ok with read-only access.

> Giving root access to a huge portion of the OS harms security even if you never use the feature.

Can you explain why root access must be given to a huge portion of the OS? Why can't it be limited to specific apps or features (like ADB shell)?

> It does not mean you can't do it, we only recommend you don't.

Of course. It is your right to recommend whatever you want :)

thot_experiment 6 hours ago | parent | prev | next [-]

The "access your own files" thing is so insane! Hard to describe my feelings [negative] when I found out that all of my voice notes were in the voice recorder and the easiest way to get them out was to manually send each one to myself over discord. Google helpfully mentions that you can just "download them through google takeout" and doesn't leave any option for people who don't just give all their personal data to google.

MSFT_Edging 3 hours ago | parent [-]

I use a FOSS voice recorder app from F-Droid. It's just called "Voice Recorder" with an orange icon. It does exactly what it says, records audio from your microphone, lets you play them back. They're just files on the device.

Anytime I need a "simple" utility, I check f-droid first to get the one-trick-pony app over spyware from the play store.

Other utilities I use are: WorkTimer: pomodoro app DiskUsage: self explanatory Http Request Shortcuts: setup home screen app shortcuts that run http requests

rudhdb773b 5 hours ago | parent | prev | next [-]

It's pretty easy to make your own `userdebug` build of GrapheneOS using their official build instructions

That's what I do to get `adb root` and full file system access.

palata 4 hours ago | parent | prev | next [-]

> [I want root,] The fact that I own my device is non-negotiable.

I read that a lot, and I agree that I want to own my device. But that does not mean that I should have root access on the OS I choose to install on it.

Owning my device means that I should be able to install whatever OS I want. It does not mean at all that OS developers must do whatever I tell you to do.

kevincox 4 hours ago | parent [-]

Yes, that is why it is a deal breaker. I'll choose to run a different OS. I didn't say that GrapheneOS must support root. Just that I won't run it if they don't.

palata 3 hours ago | parent | next [-]

And I'm fine with you wanting root on the device you own. But you were implying that not having root means that you don't own your device. I disagree with that. You can totally own your device and not be root.

I think it is important, because I read a lot of comments that imply that "owning their device" means "owning the developers". And that's a wrong fight.

The real fight is that it should be illegal to prevent me from installing my preferred OS on a general-purpose computer.

kevincox 3 hours ago | parent [-]

Fair enough. Owning means having a choice. The unlockable bootloader enables that. But for me the choice of OS will be one that lets me access all files on the device should I need to.

galangalalgol 3 hours ago | parent | prev [-]

What should that support look like? Maybe have a userdebug build already built and available? I don't include a root account on hardened container images for some of the same reasons they cite. So including it for everyone and creating a way to activate it is suboptimal for people who don't want that trade off. A parallel build pipeline seems the most reasonable to me?

kevincox 3 hours ago | parent [-]

Yeah, I would be fine with a different build stream. I do think it could be sufficiently secure in a single stream but it will always be increased attack surface so the safest option is to do separate builds.

I also don't include a root account in my container images, but you probably have a root account on the sever that runs them in case you need to debug something. But you can probably also build and deploy a new container. At the end of the day you almost always want some last-resort way to access the data stored in case something goes very wrong. Whether that is for backups, "hostile" data export or for other reasons it is important to me.

galangalalgol 3 hours ago | parent [-]

I don't actually. Devs don't get root at my employer. Even on a vm. I have rootless podman, and can be root in a container. Even our gitlab instances don't have any privileged runners. So kaneko etc.

stavros 5 hours ago | parent | prev [-]

Hm, what do you mean? What app has to let you access your files? Is this Graphene-specific?

strcat 2 hours ago | parent | next [-]

There's nothing GrapheneOS-specific about it and it doesn't prevent rooting. LineageOS doesn't officially support it any more than GrapheneOS does. It doesn't stop people doing it for either. Our recommendations aren't law.

kevincox 5 hours ago | parent | prev [-]

Any files created by apps in their main data directories are inaccessible on most distributions of Android (I think it is actually required to be Google certified). The exception is apps that go out of their way to store files in user accessible directories or provide a feature to export or share data out of the app.

By rooting your device you can access the app data directories as you wish.

stavros 5 hours ago | parent [-]

Ah, you mean /data/data, I see, thanks. I forgot as I've usually had rooted devices (until they stopped Google Pay working).

gruez 3 hours ago | parent | prev [-]

>but not having root as the default makes it less of a secure FOSS OS and more of a closed down toy.

I don't get it, it's "less of a secure FOSS OS" to not have root by default, but it's secure to run random apps as root and breaking android's security model? What's the threat model here?

treyd 2 hours ago | parent [-]

Those "random apps" are foss terminal emulators and other various foss apps I explicitly installed.

microtonal 6 hours ago | parent | prev | next [-]

As far as I know, root and tap to pay are pretty much mutually exclusive, at least if you meant Google Pay? Unlocked and rooted devices do not pass remote attestation. And it's not just something you can fake when you have root, since it is anchored in hardware (the attestation certificate chain is signed by a hardware-backed key and contains the verified boot state and verified boot key).

thot_experiment 6 hours ago | parent [-]

I can tap to pay with google pay on my rooted pixel while the spoof key isn't blacklisted, IIRC it uses dumped credentials extracted from other devices but I can reliably spoof Play Integrity and SafetyNet. It would be nice to not have an adversarial relationship with my things for once.

stavros 5 hours ago | parent [-]

"While the spoof key isn't blacklisted" is the critical bit. Soon, all the keys will be, as these old devices age away from being too common to blacklist.

HugoTea 7 hours ago | parent | prev [-]

GrapheneOS doesn't give you root access, citing security issues it introduces. You could re-compile your own copy with root access, though not sure if we'll then be back to some non-certified OS that can't make payments...

thot_experiment 6 hours ago | parent | next [-]

Yikes. Nevermind. The whole phone security model is one of the worst things to happen to computing, the concept that you shouldn't own your device for safety is so fucked.

palata 4 hours ago | parent | next [-]

> the concept that you shouldn't own your device for safety is so fucked.

That's not it. The concept is "if you choose to install this particular OS on the device you own, then it comes with this particular security model". That's totally fine. If you own your device, you can run Linux on it and you'll have root access.

"Not owning your device" means "not being able to install the OS you want on it". I want to own my device, obviously. But it does not mean that I own the developers of every OS in the world and that they should do whatever I tell them to do, for free.

zenmac 2 hours ago | parent | prev | next [-]

A non rooted device is NOT really my device, just seems like a leased device.

If we want to use banking app we have to use a non-rooted/leased device. That is what is really messed up. Personally I only use bank now that has website for banking. If they don't have a web site only app, then it is a red alert for the company.

b112 5 hours ago | parent | prev [-]

I think is great, if there are no ramifications when skilled people unlock it.

There's just too much hacking going on, malicious behaviour, to allow uneducated masses to have root on a phone. I've seen so many people just not understanding the outcome of their actions. You'd get people rooting because some shady app lied about why, and just wanted control.

And we don't need more botnets. And it's why banks sometimes throw a fit.

So if a recompile does the trick, and no downside, then it'd be fine.

gruez 3 hours ago | parent | prev [-]

>You could re-compile your own copy with root access, though not sure if we'll then be back to some non-certified OS that can't make payments...

GrapheneOS is already non-certified, for most apps that care, because it can't pass STRONG_INTEGRITY with play protect.

Markoff 8 hours ago | parent | prev | next [-]

it's quite a big deal Motorola will have officialy devices with unlockable bootloader now that Samsung is ditching it and Xiaomi is making unlocking almost impossible, Sony reintroduced it but has probably the worst VFM in the market, so having Motorola with pretty good VFM (better than Pixel outside US) is big news, though they don't really make smaller phones and I'm worried about camera quality or gcam stability

worksonmine 8 hours ago | parent | prev [-]

> There is a very real possibility that we end up with devices that can play modern mobile games at high frame rates on a secure, privacy-focused mobile OS, which is a huge step towards general adoption of something like this as a daily driver.

This might be true, but the priorities are depressing.