GrapheneOS or other custom ROMs don't solve the actual problem that you can't just buy a smartphone and install any operating system like you can with an actual computer, despite technically being one.

Also, GrapheneOS supports device attestation (the non-google kind at least), which is still ridiculous as such systems have no benefit to people, only to technofeudalist corporations.

▲

hparadiz 4 hours ago | parent | next [-]

Device attestation is how you can use private keys you don't actually have access to. It has a lot of value to literally anyone who wants to store tokens or use one time authentication codes. Linux folks need to implement the full stack and offer an open alternative to payments, secrets, and tokens. In the age of LLMs there is no excuse. It is annoying as hell that I can't buy a System76 or Framework laptop with a fingerprint sensor but a Lenovo comes with one that works on Linux perfectly.

▲

dingaling 3 hours ago | parent | next [-]

"Device attestation is how you can use private keys you don't actually have access to."

Read that phrase back and then ask "is this the future of computing that we wanted?"

The likes of passkeys, essentially user-hostile ssh keys that live on your device but aren't accessible by you, would have been an unbelievable dystopia to us in the 90s.

"Linux folks need to implement the full stack"

Nah it's fine thanks, I'd rather opt out of corporate serfdom than compromise my principles.

	▲	hparadiz 3 hours ago \| parent [-]
		That's just your opinion. Has nothing to do with Linux. And yes I would like a device like a soldered in tpm device that can generate private keys and verify signatures signed with the public key. Your misunderstanding of the technology not withstanding it does appear to me to be quite a valuable technology since it's in basically every computer these days. Stop speaking for Linux.

▲

sophrosyne42 4 hours ago | parent | prev [-]

Framework has a fingerprint sensor. [1]

[1] https://frame.work/products/fingerprint-reader-kit?v=FRANTD0...

	▲	jeroenhd 3 hours ago \| parent \| next [-]
		Lots of laptop vendors do. Very few integrate fingerprint scanners into any kind of secure authentication flow, though. There are decent fingerprint drivers for various brands, but connecting fingerprints to authentication beyond basic login requires manual setup. You don't actually need biometrics to use key material, that's what (f)TPMs are for. They're not set up to be usable out of the box in any Linux distro I've tried, though.
	▲	hparadiz 3 hours ago \| parent \| prev [-]
		It needs to come stock on every Linux laptop from now going forward period. Like you expect a screen to come with your machine. Every Mac has one now and I'm not going back to typing my password in every single time.

▲

gruez 4 hours ago | parent | prev | next [-]

>which is still ridiculous as such systems have no benefit to people, only to technofeudalist corporations.

GrapheneOS literally has an app that uses attestation and isn't for "technofeudalist corporations".

https://attestation.app/about

▲

spogbiper an hour ago | parent | prev | next [-]

> install any operating system like you can with an actual computer

This is in practice only true of IBM PC compatibles these days, you really can't install any OS on modern Macs. Maybe you can on (some?) Chomebooks?

▲

subscribed 4 hours ago | parent | prev | next [-]

If this is your stance it's trivial to have your cake and eat it. You can easily build your own GrapheneOS based image, which will then be unable to use attestation (because your own keys you'll use for the secure boot won't match).

And I'm not trying to be snarky, if that's the only thing, it's solvable right now. Everything else will work.

And concerning "you can't just buy a device and install is" - android and iOS are far more secure than any desktop os, and both pixel/iPhones are far more secure than any computer (or any other phone as well (we'll get the third one next year)). GrapheneOS actually explains "whys" in their hardware support faw section.

Generally maintaining an os is a hard work, so that perhaps explains why there's not many mature offerings.

▲

AlienRobot an hour ago | parent | prev [-]

A piece of wisdom I read here is that "install any operating system like you can with a [PC]" is something that you can only do with a PC. PC's are the exception. Every other device is controlled by the manufacturer.