I agree that this is an issue, but it is impossible to prove a negative. The same could be said for Apple's or other manufacturer's signing keys. Who guarantees that the US government hasn't required access to the iOS signing keys? Or China in exchange for access to the Chinese market? They probably wouldn't even want to reveal that the signing keys were leaked if they were allowed to, since it would undermine their security story.

With a non-profit project of highly principled security experts, there is at least a high probability that they'd rather blow up the project than compromise. People elsewhere in the thread criticize Micay because he deleted the CopperheadOS keys, but to me it increases trust in the GrapheneOS project, since he clearly puts the security of his users over money, fear, and whatnot.

In the end trust arises from running a project or company long-term without evidence that you somehow compromised security.

I wonder in general how this situation could be improved. Second or third independent reproducible build + confirmation signing?

All of the defensiveness is warranted. They speak neutrally and objectively.

The project is not going to relinquish control to any 3rd party. Not even the Motorola partnership is given control over the GOS project. The hypothetical you describe is not possible by design.

The GOS project takes no issue with critical thinking, and encourages it. But that is often used as an excuse to handwave attacks. There is a very big difference between criticism/critical thinking and attacking them.

Note that there are more individuals in the project than Micay. Multiple people handle multiple responsibilities, its not one person.

Thats... a horrible thing to want for someone. No one on the GrapheneOS team is paranoid or mentally ill.

There's healthy paranoia and there's treating even casual commentary/criticism from anyone as an existential threat & coordinated attack...and responding to that with sustained, coordinated attack campaigns online. That's what Micay's history is.

That's not healthy for any project.

https://xkcd.com/225/

Louis has a Kiwifarms[1] account.

[1] https://en.wikipedia.org/wiki/Kiwi_Farms

Rossmann is a way bigger ranter than GrapheneOS people. Have you seen some of his videos lol.

Rossmann wanted to work with GOS and they didn't want him. So Rossmann made that video to make Daniel look bad for revenge probably. Saying he was leaving GOS was a lie, not that GOS can push malicious updates which was also a huge lie. Even after pointing that out that part wasn't corrected because Louis doesn't care about accuracy, he only cares about making Daniel/GOS look bad. He used his big following to punish Daniel. Now he works with Nick from Calyx after he got pushed out and are doing business together.

The more you learn about the story, the more you see the Copperhead stuff was just the beginning and those involved held grudges and pushed their grudges onto more people who bought their lies and it continued. Privacy-focused OSes that pretend to compete with GrapheneOS suck. GrapheneOS is led by someone with integrity, unlike some other projects.

Rossmann publicly blasted a private discussion, twisting what was going on, and then lied to his own viewers. Such a claim from an identity verified kiwifarms account holder holds no weight.

The difference is that Louis' rants are contained to his channel and largely only paid attention to by his fanbase.

Micay rants are most often on other peoples' platforms and he deliberately tries to draw as much public attention as he can muster.

There might be one, in France.

There is no bad behaviour. Defending oneself isnt an unreasonable thing to do. GrapheneOS is entirely funded by donations and receives a lot of donations to this day. Them defending themselves is not an existential risk, the attacks against them are.

Nobody on the GrapheneOS team is mentally ill or unwell. There is no personality issue. Defending themselves is not an ubquenchable drive to be right, it is the right of anyone to be able to defend themselves.

[dead]

One common personality disorder I see a lot is psychologizing your interlocutors to invalidate them, thus insulating you from having to think you're wrong about something

Classic OCPD behaviour

[flagged]

Signal obedience at all times or be destroyed.

Agreeable people don't make it very far. But please do put your money where your mouth is and try for yourself, show us the way.

I'll keep being disagreeable. Because it works.

> By extension should we not use Linux as Torvalds is essentially in the same boat?

Eh, Linus signs his personal name to rants. Having a blog post by GrapheneOS per se making non-factual personal attacks (nestled among, to be clear, factual attacks) does seem wanting for maturity, at least from a distance.