Thanks

This sounds like some kind of personal beef with Micay. That’s understandable, and here’s a Louis Rossmann video showing how toxic that individual can be (you go over some of that in your links as well). So I absolutely get it.

That said, the project itself is fantastic. [Here’s the Privacy Guides page on why GrapheneOS is preferred]

The moment I hear this “personal beef” bullshit, I see dishonesty. Does everybody have a personal beef with this disgusting person? Dozens of YouTubers, hundreds of internet users, privacy guide writers like me, Techlore, Rossmann and others? What the fuck is this “personal beef” thing I always get told, when I have publicly documented 5 years worth of stuff on security charlatans in FOSS, privacy and tech communities?

The project is not fantastic, but closer to snake oil, and almost identical to CalyxOS or other AOSP fork builds. It is mostly a rebranding of AOSP features with app permission controlling and firewalling. I dissected it when a spy was sent by that community to siphon the chatroom discussions of privatelife Matrix room. I did this breakdown last year or so by referring to the GrapheneOS features page.

https://i.imgur.com/pQHoq84.jpg

There are only 3 things they ever did on their own as extras, and even they have basically no value in the grand scheme of things, them being offering:

instead of 16 character, 64 character password limit on lockscreen
PIN scrambling
Morula method of exec spawning instead of Zygote method used in most AOSP projects

Now, I will elaborate on these 3.

Elaborating on first one, it is kind of useless as you can see for obvious reasons.
For second one, you already understand why fingerprint avoids the issue of someone peeping at your PIN/password entered across your shoulder. Fingerprint is infinitely superior. Even more so with Android and iOS both offering biometric Lockdown features.
This one is somewhat half credible, but the goal is to destroy the memory blocks used by an app after it is exited, so that memory blocks do not retain essential text strings of data to exploit. For this, you can just go to Developer Options and enable “Don’t keep activities” and it will achieve the same effect as Morula method of exec spawning implemented by GrapheneOS.

So out of the 20-30 features GrapheneOS claims they developed, everything is either a modification of app permissions or firewalling or AOSP feature rebranding.

Also, as you may have famously heard about “Sandboxed Play Services”, it is not developed by GrapheneOS, but a project called ProtonAOSP, whose developer is kdrag0n. GrapheneOS copied that off and rebranded it as their own developed thing.

As you can see, GrapheneOS is basically a lot of marketing and in reality, there is negligible or nothing beyond the surface. This is called snake oil, or selling bridges/dreams.

To me, the Privacy Guides version of the story seems more believable, at least in terms of where the contributors went.

PrivacyGuides are disgusting people that shelter trolls and laundered $17,500 public donation money of PTIO privacy community. The receipts are public and it is a crime. If you excuse that, I do not think you give a shit about genuine privacy endeavours. I still remember them making one person a moderator because he posted a faux libel hitpiece on me, and them (Jonah) stickying a comment by Micay calling me an agent sent by Chinese government to destroy privacy communities. This person is who you seem to like. https://web.archive.org/web/20220502064114/https://old.reddit.com/r/PrivacyGuides/comments/uged1y/is_grapheneos_actually_good_or_just_hype/

I hope you’re sensing a trend here: we should restrict discussions to technical merits, not discussions about individuals.

I wonder if you have read this. Read the paper by Ken Thompson, co-creator of Unix and C, on why we should be able to trust the developer and NOT the code. https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf

The projects of people ARE attached to the people who create them. They cannot be separated. And yes, the projects MUST be judged based on person’s conduct. Not doing this allows GrapheneOS dev to go around falsely slapping epithets like “neonazis” on Bromite and FlorisBoards devs upon mere disagreements.

https://github.com/bromite/bromite/pull/2102#issuecomment-1155760155

https://github.com/bromite/bromite/issues/2141

http://web.archive.org/web/20220803142758/https://github.com/florisboard/florisboard/issues/1921

Ideally, there would be some kind of wiki the community could keep that links to sites along with notes about caveats and whatnot (e.g. Privacy Tools’ conflict of interest allegations, GrapheneOS’ toxic leader, etc), with the intent of being a resource of where to get more information instead of a definitive guide.

I already did it in the form of 2 article length posts chock full of evidence spanning 5 years across internet. Not many people have ever put up this much of a fight to keep privacy community clean and good selflessly. And I do not think I carry the onus of creating such a wiki by myself, when I do not get as much community support as I should, and people choosing to call it “personal beef” and wash hands away selfishly.

I am proudly arrogant for standing for the correct thing – ethics – as I keep doing whatever guide work I do. Yes I recognise I sometimes tend to sound rude and blunt, but I will not lie or sugarcoat things. And I think it is okay and a rare quality.

Here is an alternative Piped link(s):

and here’s a Louis Rossmann video showing how toxic that individual can be

see Louis Rossmann walk back his support for Lenovo here

Piped is a privacy-respecting open-source alternative frontend to YouTube.

I’m open-source; check me out at GitHub.