Volkswagen started blocking GrapheneOS users

230

mmicrotonal about 3 hours ago 150 commentsRead Article on discuss.grapheneos.org

⚡ Community Insights

Discussion Sentiment

53% Positive

Analyzed from 5514 words in the discussion.

Discussion (150 Comments)Read Original on HackerNews

moooo99•about 2 hours ago

It is amazing how Volkswagen keeps messing up. I am currently in the market for a new car, an EV specifically. Volkswagen brands were at the top of my list for many reasons, among them the excellent driving assist implementation.

I got an offer from a dealer three weeks ago and was going to order the car, then the API for the community integration got turned off. I decided to hold back and see what comes from it. Now this, which ultimately - since I am a GrapheneOS user - makes me completely cancel my plans.

I really do not understand VWs thinking here. It would cost them little to nothing to continue not blocking the the inofficial API and not block GrapheneOS (or other non Play Protect androids) users. It would have no adverse effects on the average Joe, but it would gain a lot of support and enthusiasm from heavy users, differentiating from other brands. Not to mention the fact that it is the USERS data in the first place

this_user•about 1 hour ago

German companies, especially old school industrial ones like VW, have a very hard time understanding open platforms. The view everything through the lense of liability and compliance first. Their thinking is that if someone runs their app on a custom ROM and uses that to manipulate the app in any way, and that causes some extremely hypothetical damage, that they might be held liable for not having prevented this situation.

Obviously, the chances of that are virtually zero. But they'd rather make their product worse than assume with any kind of risk, even if it is virtually zero. That is simply the way in which German enterprises operate.

anonymousiam•34 minutes ago

If they have concerns about the security of their app on some platform, they have the choice to either put "security" into the app, or to trust the platform vendor to provide the security. The correct solution is the first way. Deferring trust to the platform provider is the lazy way.

If their APIs are done correctly, they shouldn't be afraid to expose them.

formerly_proven•about 1 hour ago

If I had to guess it’s liability concerns around the app-based remote unlock and parking + R155 and CRA. A lot of european companies have moved to require attestation in their apps, likely spurred on by the CRA.

user3939382•about 1 hour ago

VW didn’t seem too concerned with compliance when they were rigging their pollution tests.

zie•3 minutes ago

That was just engineers engineering their way into creating Electrify America :)

xenocratus•about 1 hour ago

They'd have you know they actually cared a bit too much about said compliance itself.

this_user•about 1 hour ago

I mean, the only reason they did it was to be able to comply with the requirements of the test.

But the reality is that every once in a while you have a scandal like this or something like Wirecard, and it happens, because the culture is such that absolutely nobody thinks it possible. That includes officials and regulators whose first instinct will often be to come after the people trying to expose the scandal, as has happened in the case of Wirecard.

neya•44 minutes ago

Yeah sure, the company behind Dieselgate and single handedly destroyed the diesel market is worried about compliance? Give me a break.

adrianN•32 minutes ago

VW is large enough that different parts of the company can have very different opinions.

oaiey•18 minutes ago

I think there was no specific thinking in that space at all. They went for attestation of the app for security reasons of the API and their testing only runs on normal android and iOS devices. Consequently, they realized later this and write a response pointing to their tested platforms.

So understanding why they drop it is IMHO easy. Understanding why they use only attestation based API despite and forcing their third party ecosystem out is stupid. Companies do not understand open communities.

OsrsNeedsf2P•about 1 hour ago

VW is obviously not thinking that any noticable portion of the userbase uses Graphene, and someone (somewhere) is going to get a promo by making VW infra adhere to "standards" or something

riedel•38 minutes ago

Actually we need to force our European governments to use services that do not depend on foreign services (ie. Google or Apple). Then I guess it will only then become obvious to them how crazy the situation has become.

The company's have done their thing to ensure that the average guy wouldn't even try escaping their lock-in. So chances are becoming smaller and smaller to hope for a critical mass of users to complain.

echelon•about 1 hour ago

I don't use Graphene, but now I'm out of the market for a VW.

Vendor lock-in to Play services is ridiculous.

A car is a big purchase, and ideally not something I discard after a few years. I'd like it to not treat me like a second-class citizen and renter who can't make decisions over how to extend the life of my purchase.

zamadatix•about 1 hour ago

It's ridiculous, but are we only saying that because we're on HN or is it because the portion of the userbase who thinks it's actually a bad thing is the larger one?

bojan•about 1 hour ago

Same here. I'll be in a market soon and I had my eyes on a VW i4 or a Škoda Enyaq, but this makes me seriously reconsider. I really wanted to support local industry and buy a European product this time, but they are making it seriously difficult (no, don't get me even started on Stellantis).

joe_mamba•about 1 hour ago

Go with Dacia, though their EVs seem to have very low range.

abyssin•about 1 hour ago

2022 Dacia Sandero is a great car. Analog buttons, good build quality, well designed. And it’s cheap.

gslepak•about 1 hour ago

I'm kinda glad that it's VW blocking GrapheneOS users in a cynical way. When my parents got a VW Jetta they never stopped complaining about it and never bought one again. So it tracks that they'd also be the car manufacturer to block GrapheneOS and stomp on their user's privacy.

It's an easy market to win at this point. The bar has been lowered so much. Already have a nice car? Just don't display utter disdain for your user's privacy and you get our $$.

y-c-o-m-b•about 1 hour ago

> Volkswagen brands were at the top of my list for many reasons

You should definitely reevaluate how you constructed your list. VW has a history of being scummy (https://en.wikipedia.org/wiki/Volkswagen_emissions_scandal) and their ICE cars are notorious for being unreliable compared to the Japanese car-makers. To be fair, EVs do change the equation a bit, but given their scandal plagued past, there's no way I would put them at the top of any list.

michalhosna•38 minutes ago

> their ICE cars are notorious for being unreliable compared to the Japanese car-makers.

I always read this online, but my personal experience in EU doesn't match that at all in quite a sample of people and cards of last ~15 years. At least not for older cards. The reliability after 100k km seems to be somewhat similar.

The repairability of VW-group stuff in 3rd party services is soo much better and cheaper. The WV-group is huge and many models across the brands share same parts and full engines. There exist non-OEM alternatives and people know how to fix those cars.

I have never bought new car. But driving anything but VW got expensive fast.

Toyota cars can have bespoke parts even between different parts of the year for the same model. Continuous improvement isn't really that cool for cars.

jstanley•about 1 hour ago

The emissions scandal is completely different, because in that case they were illicitly making the car work better for its owner.

formerly_proven•44 minutes ago

As opposed to the rest of the auto industry which has a stellar track record of adhering to emissions and fuel economy regulations /s

https://en.wikipedia.org/wiki/Diesel_emissions_scandal https://en.wikipedia.org/wiki/Defeat_device

aka13_404•about 2 hours ago

This is sadly not even the full extent of it. What they did is, they locked their api entirely for anything that is not play protect certified. That means, all the cool stuff that was doable via community-driven projects is now dead in the water.

The "app" they provide is 60% advertisement, 30% features, and I unironically preferred using a Home Assistant connection instead of of it for everything. Even for automations like "when to preheat the car", since that was easier and more intuitive outside of their native function.

This also means, that charge control from the cars side is not possible to automate anymore.

Sure, one could take the position "but it was never officially promised", but for some people, including me, having the api (which is paid btw) was a selling point.

Yes, I registered specifically for this comment.

subscribed•about 2 hours ago

I feel you. From my side I try to complain / rate / review every time, even if it's a low effort action, to cost them time and in the case of the regulated companies, to slightly worsen their complaint stats.

There's enough of users to start making a difference. Really, even a low effort action raising valid concerns (security theater, a lie, google's monopolistic position, anti-competitive, etc), keywords that will make their response more careful and potential complaint to the regulator more impactful.

helterskelter•about 1 hour ago

Things like this can actually be a good way to nudge a company in the right direction sometimes. Nobody uses those internal review systems, and sometimes their stats are actually important. A handful of users might make up a really big chunk of the reviews.

In a similar vein, I once met a woman who told me how she would enter every single one of those stupid contests that you'd see printed on cereal boxes and ice cream containers because literally five people enter into those things, so you're odds of winning are surprisingly high. Apparently she won a bunch of them, but her favorite was when got a week long vacation that included going on a fishing trip with Ben and Jerry of "Ben and Jerry's".

z3c0•about 2 hours ago

So "Play Protect" is doing all the damage to the third-party ecosystem that it'd seemed designed for.

I've slowly but surely been moving away from any service provider of any type who does not allow me to use their service without their often Play Services-dependent app. Changing vehicles would be a lot harder though.

strcat•32 minutes ago

Developers have to go out of their way to implement triggering Play Integrity API checks in their app and then retrieve the results to check on their services. They're putting a lot of effort into banning anything not licensing Google Mobile Services. It's definitely not a security feature since it permits devices with no security updates for more than 8 years but not a far more secure OS than anything Google certifies. Google doesn't allow GrapheneOS to obtain certification and certification comes with highly anti-competitive rules which would be completely unacceptable. Their licensing system has been ruled illegal in South Korea and other countries should not only do the same but ban the Play Integrity API and other related anti-competitive features. These are not actual security features and that's an excuse for the actual purpose of enforcing their GMS licensing model including forcing including a bunch of Google apps with extremely privileged access and using their builds of many OS components shipped from the Play Store.

afarah1•about 2 hours ago

Driving a rental car in Germany almost makes me cheer for the ongoing bankruptcy of their auto industry. It really needs a full reset at this point. Sad thing is EU law mandates for a modem in the car as well as intrusive driving aids that actually make driving less safe by constantly driving your attention away from the road[1]. So there is no hope to get a minimally decent car in Europe in the near future, unless a wider reset also happens at the political and social level.

[1] https://www.youtube.com/watch?v=f-S76WEl25k

lisper•about 1 hour ago

That is one of the best, most profound and prescient videos I have ever seen.

techpression•about 1 hour ago

Whoever came up with the idea that the car should beep loudly even close to the speed limit has clearly never driven a car. The best way to silence it is to constantly be over the speed limit or well below.

iroddis•about 1 hour ago

Probably made worse by the fact that _every_ VW brand car I’ve driven has read about 10% high on the speedometer. I think I’m going 100 kph, but timing using the km markers on the highway show I’m going about 90.

When I talked to the dealers, they said that the speedometers only have to be accurate +/- 10% according to the SAE specifications.

After DieselGate I assumed that the high reading was to game the fuel consumption game.

Never again, VW auto group…

jabroni_salad•5 minutes ago

I have a GTI and with cruise control on, the speedo and my phone's gps reads exactly the same speed.

storus•18 minutes ago

Just use the speed reported by your GPS. Most navigation apps show the GPS-based speed.

lnsru•about 1 hour ago

This thing makes me crazy. But I can somehow ignore my Skoda’s whining. The other car was bought months before this regulation happened and I will keep it as long as I can.

AJRF•about 2 hours ago

I don't know how large a group who will do this is - but if the UK bans VPNs I can see Graphene having a very large target on its back.

  - Buy Pixel, Get Graphene
  - Use FDroid, don't sign up for Google Play, download Tor browser
  - Censorship resistant access to the internet without handing over your ID.

Pixel being a fairly popular phone in the UK is the interesting bit - if you had to buy some niche device I couldn't see it hitting more than a few hundred people doing it, but there are likely 100k pixels in the UK, and it's still possible to buy one and put Graphene on it.

The squeeze on the free internet happened so quick by the UK (well it took years of indifference and a failure to enshrine protections - but once they started moving the did so super fast)

Realistically we're speed running ID being tied to internet usage - create your escape hatch while you can!

leoedin•about 2 hours ago

There must be 10s of millions of x86 PCs with unlocked bioses in the UK. The issue won't be running an open device. The problem is software - what does someone running Linux do if the government mandates online services require proprietary attestation APIs?

It's scary how quickly the banning is moving. The problem is what happens next. When they realise that banning things doesn't really work. The next logical step is severely limiting internet traffic.

torginus•7 minutes ago

I think a lot of them already do, considering you can do things like digitally sign legally binding contracts.

lifty•19 minutes ago

The first wave will be to mandate ID verification for online services. Some people will then start using p2p services, so the next step is to ban devices that can run non-approved software. Probably having your own VPS running your own software will also not be allowed. And like that, all the avenues for escaping control will be closed… for your safety, of course.

rjsw•about 2 hours ago

Am currently trying to open a business bank account in the UK, several banks require running a proprietary ID validation app.

jasonvorhe•about 2 hours ago

Don't use those services. You're not gonna miss most of the crap after a few weeks anyways. Everything else is consent.

altairprime•about 2 hours ago

> what does someone running Linux do if the government mandates online services require proprietary attestation APIs?

One dual-boots to a reputable Linux vendor’s signed/sealed OS image with secure boot enabled in BIOS, so that the attestations are valid; financially supports said vendor; contacts them quarterly with check-ins on the status of their lockdown+attestation roadmap and uses professional journalism approaches to highlight their (in/)action; and, contacts one’s relevant governing body to petition for the addition of that vendor’s signed/sealed product line to be added to the authorized signatures list by both government-sponsored apps and to the verification platforms of the competing vendors (in order to balance the necessities of attestations with an appropriate degree of anti-monopolistic protections for consumers).

> It's scary how quickly the banning is moving. The problem is what happens next. When they realise that banning things doesn't really work

This confidence that ‘attestation doesn’t really work’ is the same sort of confidence that lead the Linux user community to largely scoff at, and ignore, attestation’s threat from when it was ballistically launched three decades ago towards the future. Options are now very limited for stopping it, and largely reduced to ‘getting some Linux into the approval list’. Severe compromises in user freedom will be required for the signed+sealed distro images to receive government approvals.

Imagine if Linux were an app on a video game console and you start to see the outcome: it’s a perfectly great working environment into which all of /usr/local and /opt and /home are writable, but the lockdown prevents you from modifying the OS in any way that could defeat the attestation protections. Apps you install into /opt can only access their own /opt/prefix, apps you install into /usr/local can access $HOME. The apps you install can choose to write session data (such as digital age verification certificates) to a system-protected /data store keyed first by the kernel’s signature, and second by the vendor signature the kernel reads from the app; with the understanding that an attestation latch-forward after an exploit patch will wipe that store, and that dual-booting to a different vendor will suspend access to sessions stored by that vendor.

This is, to climb on my hobby horse for a moment, why I continue to believe that Valve will be the first Linux vendor to receive government attestation approval alongside Apple / Google / Microsoft have previously across the desktop and mobile spaces. I’d really prefer that to be Graphene, Ubuntu, and Valve — but Graphene’s customer base is hostile to this, Ubuntu doesn’t have any incentive to care, and of the Linux vendors out there, Valve has a decade-long head start on the need for a locked-down and attested platform for business reasons. All of the above falls out naturally from considering how to defend one app from another on Android, iOS, Steam Deck, and Xbox. So far as I can tell today, though, Linux intends to be left out in the cold on all this. Oh well.

doublerabbit•7 minutes ago

I would never ever trust Linux from a vendor.

If it's not installed by myself, I am not using it.

As you accept government gift in approval consider it tapped. At any point they can return to the vendor and go "install this". No? Okay bye to your certification.

dmantis•36 minutes ago

>signed/sealed OS image

This way we will just have unremovable age verification, spyware, online accounts to use the os, name another bs from other vendors. What's the point of Linux then? The moment big corps and the state can seal spyware into your computer, they'll happily do it.

I'd rather have a separate burn device with whatever os for state services which lives in a faraday cage most of the time and have a proper OS I control on the main device than give somebody control over it.

spogbiper•about 2 hours ago

https://www.androidauthority.com/google-pixel-organized-crim...

“Every time we see a Google Pixel, we suspect it might belong to a drug dealer,” said a police official leading the anti-drug operation in Catalonia.."

Seems like some countries/areas are already targeting the Pixel (really its because of GrapheneOS)

HybridStatAnim8•27 minutes ago

It is far more likely that it is due to scams and grifts that pretend to be GrapheneOS, associated with GrapheneOS, or based on GrapheneOS, rather than GrapheneOS itself. Criminals tend to be not that bright.

RickS•about 1 hour ago

I regret not signing up for Discord when they first introduced facial recognition and middle schoolers were trivially spoofing their ID checks with meme pics.

There's really something to be said for greedily signing up for most things and trying to get grandfathered before the zipcuffs tighten.

IRL, though, fuck this. Home depot added flock cams and broad facial recognition, grocery store installed turnstiles, haven't stepped foot in either since. I'm just dropping out of the IRL retail economy left and right.

LightBug1•about 2 hours ago

Who said the UK is going to ban VPN?

Genuine question. That's news to me and I'm here.

tentacleuno•about 2 hours ago

The "Technology Secretary" is actively investigating it[0].

[0]: https://www.birminghammail.co.uk/news/midlands-news/new-vpn-...

arbol•about 2 hours ago

When they realise their social media ban for children doesn't work

subscribed•about 2 hours ago

https://stateofsurveillance.org/articles/government/uk-lords...

It mostly happened already and it's in motion.

ravenical•about 2 hours ago

https://xcancel.com/BBCBreakfast/status/2066788360606138759

jasonvorhe•about 2 hours ago

They said so. "Nothing is off the table" was the quote, iirc.

iAMkenough•about 2 hours ago

Think of the children that will bypass all of the "protections" recently adopted by the UK.

gonzalohm•about 2 hours ago

How would they even do that? A VPN is just a remote machine. Anything can be a VPN

prmoustache•about 2 hours ago

VW blocking third party to access their servers is one thing, the thing that I find shocking is that you need to access VW servers to obtain your charging data while this should be directly available locally from the car.

bri3d•about 1 hour ago

The historical data is aggregated in some "cloud" rather than in the car, but if you want to collect and aggregate the data locally, you can still, for now at least. Car Scanner Pro and ABRP (A Better Route Planner) are both really popular for EVs for this exact use case, and both support VW EVs; they read battery charge state / voltage / temperature and operating states (speed, consumption, etc) using both standard OBD and proprietary manufacturer diagnostic IDs over the OBD port and then redo the aggregation and math that VW are doing on their end.

torginus•10 minutes ago

Isn't this for the same reason why you can't do banking on an unlocked bootloader phone?

There's no way to verify the integrity of the system, and any malicious app can just grab your banking credentials or enable criminals to unlock and drive away with your car.

9cb14c1ec0•about 2 hours ago

Google Play has been a huge drag on innovation and security in the mobile ecosystem. I'm actually looking forward to the time when AI kills the mobile app ecosystem so that every phone manufacturer can bundle their own "vibe-code-your-own-app" system with their devices, and the Google Play monopoly is broken.

miketery•about 2 hours ago

I don't think that will happen. Sure for a minority of users the same as people running linux for their daily driver, and I definitely support it!

It's possible that we get to a place where everyone cooks their own meal (vibe coded app), and only goes out to eat sometimes (official app store). Spreadsheets are the same, you can get a lot of milage, and most still buy and use closed source software.

Reminds me of this: https://www.robinsloan.com/notes/home-cooked-app/

bflesch•about 2 hours ago

I see a future where it is easier for startups to create their own mobile devices than to deliver certain functionality through the Google and Apple platforms where your own data will be used against you and where their devices can record you 24/7 without any remediation to ensure privacy.

doublerabbit•about 2 hours ago

Let's rewind 15 years ago when everyone was jumping and praising mobile Eco-systems. Did no one ever see this happening or were most too gullible with Facebook hugs and pokes

wongarsu•about 2 hours ago

My recollection of HN 15 years ago includes a lot of annoyance with apps that could have been a website and how these walled gardens harm our freedom

doublerabbit•about 1 hour ago

Got my date wrong. What about twenty years ago?

applfanboysbgon•about 1 hour ago

> everyone was jumping and praising mobile Eco-systems.

Literally who?

mystraline•about 1 hour ago

The app-devs were salivating on striking it rich on a garbage app.

The rest of us groan when we hear "DOWNLOAD OUR APP" or grocery stores that want you to install their spyware coupon app.

These days, nost apps are just data exflitrators, spyware portals, and surveillance pricing initiatives, wrapped up with a "FREE THINGY" wrapping.

kyledrake•about 1 hour ago

I had a used 2016 VW Golf and it was a lemon. It would have an average of one serious problem a month. I finally gave up being a professional car maintainer and dumped it, taking a huge loss because it was effectively worthless on the car market despite only being 8 years old. Fun car to drive, but what's the point if it doesn't work reliably? I completely lost my trust for VW vehicles after that.

Not surprising to me at all that their software is a similar high quality experience, but in general I think it's weird that cars have to be connected to the Internet anyways and I doubt the competition is substantially better.

minraws•about 1 hour ago

I am in market for a Car within a year or two, and I promise it won't be one from Volkswagen, if a company supports OSS platforms in cars and is available in APAC I will buy from them even if it costs 2x for the same specs (preferably a Hybrid but EV works too I guess).

Happy voting with your wallet folks. See ya.

jmward01•about 2 hours ago

I want a law that requires publishing your API for apps like this as well as allowing users to crate their own frontend based on it. That would enable more privacy aware versions of these apps.

LostMyLogin•about 2 hours ago

Side note. Has anyone else noticed an uptick in GrapheneOS posts lately or am I crazy?

Viability1936•about 1 hour ago

Probably because it's quickly becoming the only reasonable option on mobile

HybridStatAnim8•23 minutes ago

GrapheneOS has an official partnership with a large OEM (Motorola), has near perfect app compatibility, is constantly improving upon user experience, and has been well known and regarded in the privsec community and by many trusted security experts. It appears to be gaining more mainstream awareness as a result.

Oh, and Android 17 has been released so there is hype for that.

qrobit•about 2 hours ago

Sort of, there're more posts about graphene in the year 2026 & they get much more attention. Aggregated some data and plotted it with my agent: https://boop.icu/Pr.png

Calgaryp•39 minutes ago

Lol not surprised by VW. Had a long fight with them because of this takata thing

jqpabc123•about 2 hours ago

Easy fix --- block VW from your car ownership.

amyjess•12 minutes ago

I'm sorry, but what? Why do cars need apps now?

monomial•about 1 hour ago

Modern cars are such enshittified garbage. I was in a modern Toyota recently and every time you start it, the screen shows a "Guest mode activated" that you need to explicitly dismiss. The only way to disable this is to install some stupid Toyota app which I would never install. Then you dismiss the popup and the home screen is "Experience Drive Connect" which is some stupid Toyota subscription which I would never subscribe to. What a piece of garbage. I'd probably just disconnect the whole screen entirely.

jasonvorhe•about 2 hours ago

It's not your car anymore, you're just renting someone else's hardware and access to their restricted platforms. Some recent cars even deny starting your car engine if the always on camera facing the driver thinks the driver isn't capable of driving "safely".

This is the WEF future your conspiracy uncle was telling you about during family gatherings. Well.

guitcastro•about 1 hour ago

We need an opensource car OS, to prevent the car enshitification, but the automakers will never allow it.

stymaar•about 2 hours ago

I hate that cars are every day more and more crammed with software, when car manufacturers can't seem to be able to make half-working code in the first place (looking at you Nissan, who just can't even put the correct timestamp on your GPS data points…)

techdmn•about 2 hours ago

My car won't let me flick the windshield wipers while the car is parked. I don't know why, maybe they think I'm throwing rain onto... already wet pedestrians? Similar problem with auto-folding mirrors. My mirror was frozen shut one day, and I didn't notice until I'd been driving for a few blocks (which is on me). Figured I'd just cycle the fold-unfold a few times to pop it free, but the button is disabled when the car is in motion.

Increasingly my vision of retirement is a life of luxury surrounded by hardware from before the internet era, things that do what I tell them, rather than telling me what I am and am not allowed to do.

bluGill•about 1 hour ago

I'm filling my shop with machining equipment without all the extras, but my first 6 years of retirement will be fixing those machines before I can make anything... (and family history doesn't give me good odds of living that long - which is average.)

quickthrowman•about 1 hour ago

> when car manufacturers can't seem to be able to make half-working code in the first place (looking at you Nissan, who just can't even put the correct timestamp on your GPS data when car manufacturers can't seem to be able to make half-working code in the first place (looking at you Nissan, who just can't even put the correct timestamp on your GPS data points…)

Nissan sells a ton of cars to subprime borrowers, quality isn’t exactly their focus. Hyundai/Kia and Stellantis also target the same buyers.

stymaar•27 minutes ago

Kia's GPS datapoints are pretty low effort (you only get a few, median distance between two points being 30km) but at least they aren't wrong!

izacus•about 1 hour ago

I'm glad the grapheneos support forum is proving very useful with "Why do you need a car app?" comment being highlighted by this link :D

ReptileMan•about 1 hour ago

Hey Mythos - create me open clone of VW software and tell me which chips to replace in the car. Thanks.

warkdarrior•about 2 hours ago

Answer from VW:

> Please note that the use of the Volkswagen app is only supported on iOS devices and Android devices with supported operating system versions.

Is it time to mandate app developers support all operating systems for a device?

queeshonda•about 2 hours ago

Just support a certain Android API level?

arkon_hn•about 2 hours ago

Supporting mainstream OEM variants can already be enough of a nightmare in behavioural differences. What motivation do most companies have to support Graphene, which will be a handful of customers at best? Developers may be fine with offering a best effort support model, but legal certainly wouldn't.

HybridStatAnim8•16 minutes ago

The funny thing is, nothing needs to be done to support GOS. GOS has 99% android app compatibility. The issue isnt that GOS requires changes in the app to support it, rather, the tools they are using explicitly ban non-certified OSs.

Dont let their boilerplate responses fool you, tools like play integrity only serve to push anticompetitive practices. The claims about not being able to support GOS are nonsense, and all they did was break existing support.

warkdarrior•about 2 hours ago

That's a starting point, but it seems the VW app is using a Google SDK for integrity checks, so maybe we need certain SDKs to be banned.

bossyTeacher•about 2 hours ago

The issue here is the Google-only remote attestation nonsense. It seems pointless to me. A device passing Google's attestation check tells you nothing. The device could well have malware on it and you won't know it. Integrity is a misnomer. The integrity scope is tiny.

ranger_danger•about 2 hours ago

No because that would be next to impossible, and prohibitively expensive to support for not enough gain.

If 97% of your users are on mainstream OSes, and the rest also account for disproportionately high numbers of bug reports, why should they bother supporting alternatives?

HybridStatAnim8•8 minutes ago

GrapheneOS maintains 99% android app compatibility. It does not require any additional funding or expenses to support GrapheneOS, and is actually more expensive to add these anticompetitive tools responsible for banning GrapheneOS.

GrapheneOS is also not responsible for bugs in this app. Any bug reports coming from GOS are likely to be from the hardening toggles, which uncover bugs in the app. This is the apps fault, and these bugs still exist on other OSs. It should be resolved for the benefit of all users.

strcat•40 minutes ago

They don't need to do anything to support GrapheneOS. They only need to stop actively going out of the way to block it and any other alternative OS via the Play Integrity API. They put significant effort into blocking anything other than iOS or a Google Mobile Services Android stock OS certified by Google. They're not only blocking a non-stock AOSP-based operating system but rather anything other than iOS or a Google Mobile Services Android device certified by Google.

microtonal•about 2 hours ago

The app worked without issues until a few weeks ago. I used it for a year. It was not broken. GrapheneOS is just AOSP Android, optionally with Google Play Services.

My take is that they were trying to block rooted phones and/or custom ROMs of questionable origin and GrapheneOS just became collateral damage because all these companies do go the minimal route of using Play Integrity. GrapheneOS supports remote attestation through AOSP APIs, in fact, they have a page about it.

I think it's worth letting this be heard. GrapheneOS has > 400,000 users and is rapidly growing. Breaking things is not going to affect 5 people anymore, but thousands, ten thousands or hundreds of thousands, depending on what the app is.

Zak•43 minutes ago

> My take is that they were trying to block rooted phones and/or custom ROMs of questionable origin

There are only bad reasons for them to do that. End users don't get compromised that way in reality, but it does mean they might convince the app to do something that's bad for profits.

mschild•about 2 hours ago

Its not a different os though. Its still android. VW seems to just have turned on integrity checks which constantly cause issues for non-google androids. Plenty of banks do the same.

ryandrake•about 2 hours ago

> expensive to support

"Support" is such an overloaded and vague word in the software industry. What does it mean for a company to "support" an app/os configuration?

1. They deliberately target that app/os configuration, QA tests it, and answer customer support requests about it.

2. They target the configuration, QA tests it, but it's offered without customer support.

3. They target the configuration, but only release an untested build, use at your own risk.

4. They don't target the configuration at all, but the builds they do release happen to work on the configuration, totally unacknowledged by the company.

5. They don't target the configuration, and deliberately sabotage their application such that un-targeted configurations are actively blocked. Only adversarial users who hack the software are able to use it.

Too many companies say: "We can't do 1 because we don't 'support' it, therefore we must do 5!"

Zak•36 minutes ago

Proton is one of the best examples of this phenomenon. Almost all Windows games work on Linux via Proton. Sometimes they even run better than they do on Windows.

About the only time it doesn't work is when the game uses an anticheat system that intentionally blocks Linux. I can even see where the game devs are coming from when it comes to competitive games; cheating ruins the game for other players, and there's no way to prevent certain kinds of cheating without trusting the client to a degree.

I can't see any reasonable and user-respecting place VW could be coming from intentionally blocking access from open systems.

fsflover•about 2 hours ago

> If 97% of your users are on mainstream OSes, and the rest also account for disproportionately high numbers of bug reports, why should they bother supporting alternatives?

Because of those bug reports, very few may be specific to the non-mainstream OS? https://news.ycombinator.com/item?id=28978086

Arainach•about 2 hours ago

No. You're not required to use the app. You're not even entitled to use the app. If you want to use the app, you have to play by their rules. Plenty of device manufacturers have chosen to only offer iOS apps. No one talked about mandating that apps were available on competing platforms.

If you choose to use something like GrapheneOS, you are signing up for the fact that almost no one will test on your platform and plenty of things will be broken.

microtonal•about 2 hours ago

The app worked until a few weeks ago. GrapheneOS does not miss any functionality (nor security) for the app to work. The only change is that they started blocking non-GMS Android through the thoroughly anti-competitive Play Integrity.

Hypothetically, if GrapheneOS wanted to become a certified Android, it would probably not be blocked on technical reasons, only that becoming certified (last time a contract was leaked) requires running privileged Google Play Services (which is less secure) and pre-installing a bunch of Google apps that should not be uninstallable.

How is that not anti-competitive?

watermelon0•about 2 hours ago

The issue here is not that they didn't test on alternative distributions of Android, the issue is that they went out of their way to prevent anything but the officially blessed distributions.

Arainach•about 2 hours ago

As is their right. There's nothing that says everything has to be open to everyone. There are other car companies.

This site talks at length about running businesses, identifying your target market and focusing hard on them. The same thing applies to other aspects of software.

If I ran a cross-platform app (built on Electron or whatever) and a certain platform made up 0.1% of my users but 20% of my customer support team's time, I'd stop supporting that platform. It's literally not worth the effort. And I wouldn't just let it rot (that would keep the customer support issues going), I'd block it.

midasz•about 2 hours ago

Here it is, the true hacker mentality.

esikich•38 minutes ago

Sir, this is a VC bro website.

DANmode•about 2 hours ago

Understanding how those around you operate makes you no less of a hacker.

It can even make you a great/better one…

tedajax•about 2 hours ago

Increasingly these kinds of apps are a requirement for a lot of features so ...

warkdarrior•about 2 hours ago

Sure the app is not required, though one loses on all of the remote-control functionality (remote start, remote climate control, etc.).

Maybe then app developers should be mandated to open fully their server-side protocols, so people can create apps for platforms that are not supported by default. No more undocumented APIs, anybody can get an API key, no API serving limits!

microtonal•about 2 hours ago

Unfortunately, Volkswagen has an API, but made it much harder to use it since a few weeks ago:

https://news.ycombinator.com/item?id=48319509

queeshonda•about 2 hours ago

"tEsT yOuR PlatTfORM"

Fuck that.

mohamedkoubaa•about 2 hours ago

The solution is not to try to shame or force Volkswagen to support GrapheneOS, the solution is to (legally) force them to allow the car to run a custom CarOS, for which the community can write their own app

Arainach•about 2 hours ago

That's a non-starter in most countries. Since the car software is tied into a number of important safety features and regulated controls, custom operating systems will never be supported.

There are already massive problems with people miswiring head units to play videos while driving and updating their ECU to spew pollution into the air. You're not going to convince any significant number of people that it's a good idea to allow arbitrary code to run and control most of the other systems too.

dylan604•about 2 hours ago

> Since the car software is tied into a number of important safety features and regulated controls, custom operating systems will never be supported.

Then that's a poor design that should go the way of the dodo. Someone hacking the entertainment system should not be able to take over control of the engine. The entertainment system on planes do not allow one to hack into the autopilot. There should be no need for a firewall, they should have no shared wires between them.

Arainach•about 1 hour ago

"Safety critical" isn't just the drivetrain. I don't work in automotive and won't pretend to understand all the rules, but off the top of my head, some things that my car uses the head unit for:

* Backup Camera

* Turning traction control on/off

* Turning auto hold (maintaining the brake pedal while stopped) on/off

* Window defrosting

Many cars are even more integrated - are there any physical buttons inside a Tesla or is it all through the touchscreen?

dada216•about 2 hours ago

Those two set of systems are separate and very distinct.

Arainach•about 2 hours ago

They're not. Use any car's heads up display and you can configure an enormous number of things. Even if there was somehow a pure separation, things such as "playing video while the car is moving" are regulated in many jurisdictions and would land firmly in the "UI" layer.

juliangmp•about 2 hours ago

You'd hope so but I fear that many safety critical aspects run on the same system as the infotainment system... And that's a perfect excuse for manufacturers to keep these things completely closed

binary132•about 2 hours ago

“Users shouldn’t be same to control their own engines actually” hmm well ok then

Arainach•about 2 hours ago

One person's "controlling their own engines" is another "spewing nitrous oxides, carbon monoxide, and other pollutants into the air, giving cancer to neighbors and destroying the atmosphere". We tried the "don't regulate" path and it ended in a multitude of disasters.

subscribed•about 1 hour ago

May I introduce you to the "rolling coal" morons?

bdamm•about 2 hours ago

Could it be a right-to-repair issue? That seems to be the only legal wrench available for forcing automakers to open up access to anything.

ddalex•about 2 hours ago

Why should they ?! Do you also want to force them to design their cars so the engine is easily replaceable by a Custom Engine OS so that the community can build their own engines ?!?

callc•about 2 hours ago

Because laws are (mostly) a reflection of what society wants.

People are growingly concerned with both the car manu and Apple/Google control over their car and related extra software goodies.

Laws are really needed when businesses don’t play nicely. I don’t know the legal specifics, but I’m sure glad I don’t need to buy $1000’s of specialty tools to maintain my vehicle, and sure glad that replacement parts are readily available (and will be for decades).

Just image how much worse society would be if car manus did the same thing as Apple and had ID-paired parts. Sorry! Your AC doesn’t work anymore, please install a genuine Honda oil filter at your nearest Authorized Honda Shop, available for a minimum of $500.

DANmode•about 2 hours ago

Next thing you know these dirtbags are going to want to choose what wheels and tires to put on these things. The nerve!

(Yes, repairability and standardization are encouraged where feasible.)

bflesch•about 2 hours ago

That's unacceptable, because intelligence needs a way to steer your car into oncoming traffic if required to do so due to confidential national security reasons.