DE version is available. Content is displayed in original English for accuracy.
Advertisement
Advertisement
⚡ Community Insights
Discussion Sentiment
60% Positive
Analyzed from 3508 words in the discussion.
Trending Topics
#google#android#more#pixel#source#open#phone#grapheneos#linux#security
Discussion (92 Comments)Read Original on HackerNews
But they won't learn that on their own. They are breaking the deals. So we move. We force their hand
What do you have in mind?
Android is not a Linux desktop or server distro. It is not about you getting to put what you want on the hardware you bought for free.
Operating systems are hellaciously expensive to maintain and that only gets worse in markets with rapid hardware improvements, as the smartphone market was up until maybe the late 2010s. Google is not a charity. SV did not come into national prominence for making investors $0. There is no money in giving maybe one in one-hundred smartphone users (and that's being generous) a bunch of code, for free, so that they can put it on their gizmo and talk to their nerd friends at their hacker meetup.
When they pitched Android as "open", they meant that carriers and device makers could load it up with all of the revenue-enhancing bloat that they wanted. In return, Google got a device that would let them hoover up all of the data they could ever want in order to build better ad service profiles for those using the devices. That is, after all, their business.
For a while, this could coexist with us screwing around with a real-life tricorder. At some point, though, the free stuff turned into a revenue opportunity that had to be exploited. And so, it will be.
I think we're all more surprised by how long it took for Google to make these bad moves. For a period of time in the 2010s we actually started thinking maybe Google was alright.
GrapheneOS is often around 4 to 6 months ahead on merging Linux kernel LTS releases. We used to handle this ourselves but switched to the Android GKI LTS branch maintained by Greg KH. Unfortunately, it was often struggling to keep up even before the absolutely massive increase in Linux kernel security patches this year. AI models have rapidly accelerated vulnerability discovery and it's an ongoing crisis for the Linux kernel. We want to be on the latest LTS revision within days and want to be using the latest LTS branch within months of it being released. We're not at all happy with how Android is handling things and plan to fix that ourselves. We'll get things back to how they should be.
We also ship all the AOSP userspace patches months before Pixels due to shipping all of the security preview patches as soon as possible. There are sometimes minor regressions but we find and fix them ourselves downstream. The security preview system has a terrible design especially considering that frontier AI models can reverse engineer the patches. There should at least only be a source embargo for around 24 to 72 hours rather than pretending as if it can work with the patches available 2 to 6 months in advance.
It'd be interesting to see which one is happening here.
They're not treating GrapheneOS very differently from other vendors, except that Graphene isn't relevant enough to sign a contract with because they don't make phones (or money, really).
Google should be putting out the code and patches like they used to, but the constant badgering of Google on this issue feels off. I don't see anyone complaining that Samsung isn't supporting their security-focused fork enough, or complain that Apple is delaying the bootloader unlock process by a day.
Despite their very worst, selfish intentions, Google is the very best vendor of commercial open source software. While Google's open source project collapses, there's plenty of space for other vendors to step in.
We should bemoan Google's fall from grace, but only because they're on the way to becoming just as bad as every vendor but Librem if they keep this up another decade.
Can we just stop saying "Google" as if it's same faceless org? No, it's not Google, one or two asshole execs are behind this policy.
Bigger problem is HarmonyOS and similar devices, compatible with Android. Opensource threat from china!
And no NSA backdoors or honeypots!
Otherwise there's no need for NSA backdoors (as Cellebrite matrix shows) :)
GrapheneOS has the bootable AOSP and will have Google-alternative device support.
We probably need an equivalent to Play Services, app signing/porting/publishing tools.
With these in hand could we talk Valve into providing the scalable alternative to the play store?
So it seems like the problem isn't that the new API is Pixel exclusive, but that the first and third quarterly release patches each year are Pixel exclusive?
* Google drop "real" Android source-code updates to OEMs _and_ the public every half.
* But they ship four Pixel updates, including documentation + SDKs.
* Now they added new APIs in a Pixel-only update.
* Google also drop security update backports to "trusted" OEMs monthly (which GrapheneOS have had access to for years).
So, there are now Pixel-exclusive app features on the Pixel SDK version which isn't available to OEMs - but, it's highly unlikely any app developer would actually depend on these new APIs, since Pixel marketshare is tiny to begin with. This in essence just makes Pixels a weird beta-testing device for what will come out a quarter later to "normal" devices, which is sort of an odd business decision, but also a weird thing to get really mad about, in my opinion (I do see what GrapheneOS are trying to do, with having OEMs saber-rattle about not getting features on the same cadence as Pixels, it just doesn't resonate very loudly for me).
However, the API headline seems to bury a deeper lede; in the thread, GrapheneOS also claim that the quarterly Pixel releases contain security content which is not appearing in the monthly backports. This is quite bad and very sloppy if true, since the Pixel releases can easily be patch-diffed and exploits backed out of them. I'd be interested in seeing this enumerated in more depth.
[0]: https://news.ycombinator.com/item?id=49741510
You're probably asking if they're able contribute anymore?
in terms of accepting, unless it's stuff like bugfixes to core mechanisms, not really.
We live in a time, if you want to build an android app, you easily can, but installing will be harder due to google concerns.
Nothing will happen, as it never does.
It’s closed too, sure, but at least it’s more consistent.
Google may just want to kill us and Apple don't even let this kind of software exist without massive hurdles...
However at this point, as a GrapheneOS user if I couldn't use it for any reason I'll go to iOS (even though I used it for a couple of years and I've been fed up).
Graphene is reaching that status for me every day and i'm looking forward to switching to it as my daily driver.
The short is that yes the GNOME/KDE apps do often look more impressive, but they suffer the same sort of malaise which seems to have infected Linux desktops sometime since Eternal September, and between the sporadic crashing and "this doesn't feel right", it's really hard for me to accept "It's more polished than AOSP!".
pmOS's installation page opening with a warning:
Which leads to a page that opens with: Does not do a lot to dissuade my skepticism. I know you said the apps specifically, but even there, it's like... I dunno.Anyone is free to fork, add the desired hardware support and flash.
(that's aside of some Moto flagships in 2027)
[0]: https://www.claimsjournal.com/news/national/2024/03/15/32248...
Oracle was a mighty powerhouse when it bought MySQL, StarOffice, and more. It lost defacto control of all of them, due to its stupidity. In the world of open source, the tighter you hold on, the less likely you'll retain control.
And yet, here we are, with Google playing games.
Google, a note: there are far more relying upon Android than you, and now there are forced alternative stores in the mix. If Samsung and everyone else said "sorry Google', or even a large majority, you're out. Gone. Nada.
They can now fork, and force old Android to have their new fancy pants 'Play' store too.
Google is also getting more and more pushy with Chrome. What if everyone depending upon that backend, shrugs and says "Sorry Google, we're hard-forking Chrome and we'll all maintain it".
The OEMs are incapable of writing a competent operating system, and don't particularly care to.
> Google is also getting more and more pushy with Chrome. What if everyone depending upon that backend, shrugs and says "Sorry Google, we're hard-forking Chrome and we'll all maintain it".
With what maintainers?
https://chrome-commit-tracker.arthursonzogni.com/organizatio...
It definitly still is. We run Postgres when we host our banking / financial stuff, but when we talk with banks and say that, they demand Oracle not that 'open source amateur stuff'. We have a version of our software for Oracle (and MSSQL) as well so no biggy, but still, we always try if we know it's not a complete immediate kill (which it will be if we put it in our documentation as only option). Oracle is still everywhere at the big guys.
Postgres ftw. Long may it eat their lunch.
Who will step up to maintain it? Keep in mind that it has to be somebody that every other OEM trust. In other words it would likely have to be an alliance of manufacturers. And they'd inevitably treat OEMs outside the alliance poorly and we'd be back to the current situation, but worse.