Device attestation is how you can use private keys you don't actually have access to. It has a lot of value to literally anyone who wants to store tokens or use one time authentication codes. Linux folks need to implement the full stack and offer an open alternative to payments, secrets, and tokens. In the age of LLMs there is no excuse. It is annoying as hell that I can't buy a System76 or Framework laptop with a fingerprint sensor but a Lenovo comes with one that works on Linux perfectly.

>which is still ridiculous as such systems have no benefit to people, only to technofeudalist corporations.

GrapheneOS literally has an app that uses attestation and isn't for "technofeudalist corporations".

https://attestation.app/about

> install any operating system like you can with an actual computer

This is in practice only true of IBM PC compatibles these days, you really can't install any OS on modern Macs. Maybe you can on (some?) Chomebooks?

If this is your stance it's trivial to have your cake and eat it. You can easily build your own GrapheneOS based image, which will then be unable to use attestation (because your own keys you'll use for the secure boot won't match).

And I'm not trying to be snarky, if that's the only thing, it's solvable right now. Everything else will work.

And concerning "you can't just buy a device and install is" - android and iOS are far more secure than any desktop os, and both pixel/iPhones are far more secure than any computer (or any other phone as well (we'll get the third one next year)). GrapheneOS actually explains "whys" in their hardware support faw section.

Generally maintaining an os is a hard work, so that perhaps explains why there's not many mature offerings.

A piece of wisdom I read here is that "install any operating system like you can with a [PC]" is something that you can only do with a PC. PC's are the exception. Every other device is controlled by the manufacturer.

It's pretty trivial to get your own almost-GOS with root. The official GOS release simply doesn't support it in the production images.

Why not root has been explained many times and you actually either want the official image with no root exactly because of the benefits, or you want custom image because you don't need these benefits.

For location faking Mock location works on GOS,l.

I see much bigger problem with not having a reliable backup than not having root.

Software freedom is about freedom of choice, not philosophically mandated security holes. You are free to take the GrapheneOS code and introduce a huge vulnerability in the form of a privilege escalation path from sandboxed apps if you wish, it is open source and you can easily compile and flash your own build.

Mobile phones store incredibly intimate data and are incredibly vulnerable to seizure. It stores my message history, pictures I've taken, so many other records that together would provide an incredibly detailed view into my private life. And it is on my person at all times, even through checkpoints where I have minimal protections against search and seizure like borders! This is not a device that I want a broad surface for modification of system software on.

If you are technical and want root its very easy to patch a build of GrapheneOS to include whatever mechanism you want. You can even automate this to continue to receive updates.

I think the decision of GrapheneOS to maintain the attestation features and not providing user root is what gives it a fighting chance of being accepted as legitimate 3rd choice. See: Revolut and others adding GrapheneOS keys and trusting their attestation

Like or not, for most users, having root access is a liability, especially with more and more important things being held on phones . Someone downloading a photo editing app and then having a rootkit installed in the background that waits to empty their bank account is not a workable situation.

GrapheneOS's goals are privacy which must start from a secure baseline. If you want to make it less secure yourself, you can, but it's not the goal of the project.

It's not anti-user if it doesn't add the features you want that would destroy the security of the OS.

It has many features that give the user more control. Like disabling emergency alerts, protecting your data from attackers, contact and storage scopes (lying to apps for more privacy while retaining functionality), sensors permission, network permission.