I love GrapheneOS and I use it daily for more than 2 years. However, and as Louis Rossmann pointed out in one of his videos, they really need to work on the "defensiveness" and "rants" of their communication. Even when they are 99% right most of the time, they sometimes don't come as mature and professional.
My gut feel is that Micay is genuine, and obviously also very defensive.<p>At least some of the defensiveness is warranted. Maybe most of it. Regardless, it comes across in most GrapheneOS communications, and it's sometimes counterproductive.<p>A related issue, which I'm sure Micay can appreciate, is that users of GrapheneOS tend to be cautious, and increasingly will want to know why the project should be trusted, now that it is popular and on a lot of radars of adversaries.<p>(For example, hypothetical scenario that's plausible, given the incentives: State actor (e.g., RU, US, CN) or organized crime group long-con starts with a public harassment campaign of Micay. Followed by sleeper volunteers taking more control of the project, initially under the pretext of helping insulate Micay from harassment, and taking some of the load off. Later maybe even impersonating Micay. Now the threat actor has backdoors to a large number of especially privacy/security-conscious parties, including communications, 2FA, location, cryptocurrency wallets, internal networks where those people work, etc.)<p>I think it probably hasn't been compromised like that, but it's an obvious real possibility, and IMHO, until GrapheneOS is more transparent, some natural users of GrapheneOS are going to consider iPhone relatively "the devil you know".<p>Again, I think Micay is genuine, and I'm a fan of the project and appreciate it. And I hope the project understands that's compatible with critical thinking about infosec, and doesn't take personal offense at that.<p>(Source: Am long-time GrapheneOS user, and have donated.)
I agree that this is an issue, but it is impossible to prove a negative. The same could be said for Apple's or other manufacturer's signing keys. Who guarantees that the US government hasn't required access to the iOS signing keys? Or China in exchange for access to the Chinese market? They probably wouldn't even want to reveal that the signing keys were leaked if they were allowed to, since it would undermine their security story.<p>With a non-profit project of highly principled security experts, there is at least a high probability that they'd rather blow up the project than compromise. People elsewhere in the thread criticize Micay because he deleted the CopperheadOS keys, but to me it increases trust in the GrapheneOS project, since he clearly puts the security of his users over money, fear, and whatnot.<p>In the end trust arises from running a project or company long-term without evidence that you somehow compromised security.<p>I wonder in general how this situation could be improved. Second or third independent reproducible build + confirmation signing?
All of the defensiveness is warranted. They speak neutrally and objectively.<p>The project is not going to relinquish control to any 3rd party. Not even the Motorola partnership is given control over the GOS project. The hypothetical you describe is not possible by design.<p>The GOS project takes no issue with critical thinking, and encourages it. But that is often used as an excuse to handwave attacks. There is a very big difference between criticism/critical thinking and attacking them.<p>Note that there are more individuals in the project than Micay. Multiple people handle multiple responsibilities, its not one person.
Personally, I <i>like</i> that they come across as a little paranoid. That's <i>exactly</i> the attitude I want in the people protecting my privacy and security. I hope the developers lie awake at night, unable to fall asleep because terrified that someone somewhere is plotting to attack and exploit them
Thats... a horrible thing to want for someone. No one on the GrapheneOS team is paranoid or mentally ill.
There's healthy paranoia and there's treating even casual commentary/criticism from anyone as an existential threat & coordinated attack...and responding to that with sustained, coordinated attack campaigns online. That's what Micay's history is.<p>That's not healthy for any project.
This is false. Commentary and criticism is not treated as a coordinated attack. Coordinated attacks are treated as coordinated attacks. Criticism is often used as an excuse to try and hide attacks, and many people unfortunately cannot tell the difference. Kind of like this reply, which attacks Micay under the guise of criticism.
Well, they have had to deal with multiple swattings, constant misinformation from some competitors (e.g. Murena's CEO doing interviews with various media where they insinuate that security-hardened systems like GrapheneOS are only for criminals and secret agents, complete with 'think of the children'-style arguments), and some local/national governments boosting the narrative that GrapheneOS is for criminals.<p>So I can understand why they are as defensive as they are.
Could you share a link or something about this?<p>> ...responding to that with sustained, coordinated attack campaigns online. That's what Micay's history is.<p>For the rest, in general, I'm tempted to give grapheneOS the benefit of the doubt. Running <i>any</i> FOSS project is hard, running it against the (implicit) wishes of OEMs/Google (who throw in things like Play Integrity) is even harder, and doing it when 3 letter agencies at the US govt actively hate you is harder still.<p>Being paranoid in responses to FUD campaigns isn't ideal, but save coordinated attacks, I'd say fairly understandable.
Recently, the socials have been more moderate and level-headed, imo.
Based on how discourse in the US has been perverted by inches and millions of mosquito bites they may not be wrong. Stamping out bad information fast and hard seems to be the only way to combat mass coordinated disinformation. Being polite just lets people play the "both sides have merit" game.
<a href="https://xkcd.com/225/" rel="nofollow">https://xkcd.com/225/</a>
When Louis Rossmann thinks your communication has a problem with going on rants, it must be pretty out there.
Rossmann is a way bigger ranter than GrapheneOS people. Have you seen some of his videos lol.<p>Rossmann wanted to work with GOS and they didn't want him. So Rossmann made that video to make Daniel look bad for revenge probably. Saying he was leaving GOS was a lie, not that GOS can push malicious updates which was also a huge lie. Even after pointing that out that part wasn't corrected because Louis doesn't care about accuracy, he only cares about making Daniel/GOS look bad. He used his big following to punish Daniel. Now he works with Nick from Calyx after he got pushed out and are doing business together.<p>The more you learn about the story, the more you see the Copperhead stuff was just the beginning and those involved held grudges and pushed their grudges onto more people who bought their lies and it continued. Privacy-focused OSes that pretend to compete with GrapheneOS suck. GrapheneOS is led by someone with integrity, unlike some other projects.
Louis has a Kiwifarms[1] account.<p>[1] <a href="https://en.wikipedia.org/wiki/Kiwi_Farms" rel="nofollow">https://en.wikipedia.org/wiki/Kiwi_Farms</a>
Rossmann publicly blasted a private discussion, twisting what was going on, and then lied to his own viewers. Such a claim from an identity verified kiwifarms account holder holds no weight.
> However, and as Louis Rossmann pointed out in one of his videos, they really need to work on the "defensiveness" and "rants" of their communication<p>Not that I disagree but Louis Rossmann giving someone advice to tone down the rants is ironic.
Have you considered that the smooth-talking "mature" and "professional" people are more likely to sell your data to advertisers at the first opportunity?
Louis Rossmann caused a lot of harm to GOS and blasted them publicly for trying to raise issues privately. That is disgusting behaviour. He then lied to his own viewers about no longer using GrapheneOS, lied about fears of a targeted update despite that not being possible, among a lot of other things. Note he also has an identity verified kiwifarms account.<p>GOS only defends themselves from attacks. Its not that they are misinterpreting what is an attack, there are really just that many attacks. It leaves little room for much else than defense. Nobody should have to deal with the inhumane level of attacks.
It would be interesting if there were a state sponsored effort to discredit a project that helps some people keep their communications private.
Being "right" shouldn't excuse bad behavior, especially if you depend entirely on a community to survive, which we all do.
It's a personality type / disorder (pick your poison). There's no hope for change. Programming seems to attract such people, because they are fixated on being right and proving that they are right. I know a few more examples. My common sense policy is - if the software these types produce works for me, I will be using it, but I will never allow myself to be dependent on it. That kind of person will gladly burn their own house to the ground, with everyone in it, if that's what's required to prove their truths or maintain some kind of intellectual purity.
[flagged]
[flagged]
[flagged]
Signal obedience at all times or be destroyed.
Agreeable people don't make it very far. But please do put your money where your mouth is and try for yourself, show us the way.<p>I'll keep being disagreeable. Because it works.
[flagged]
[flagged]
> <i>By extension should we not use Linux as Torvalds is essentially in the same boat?</i><p>Eh, Linus signs his personal name to rants. Having a blog post by GrapheneOS <i>per se</i> making non-factual personal attacks (nestled among, to be clear, factual attacks) does seem wanting for maturity, at least from a distance.