Graphene OS: a security-enhanced Android build (lwn.net)

Article summary

Graphene OS is a security-enhanced Android build that aims to harden Android against various threats and prioritize user privacy. It is based on the Android Open Source Project and removes a lot of code, adding a long list of changes to improve security. The project supports a limited range of devices, including Google Pixel 6 through Pixel 9, and offers features such as a hardened malloc library and hardware memory tagging. Graphene OS also includes a sandboxed version of Google Play, allowing users to install apps while maintaining security and privacy.

Main themes

• Android security
• Graphene OS
• privacy features
• device support
• Google hardware
• alternative OS options
• security trade-offs

What commenters say

• Some commenters express concern over Graphene OS's reliance on proprietary Google hardware, potentially introducing security risks.
• Others argue that using Google hardware is a necessary compromise for achieving security goals, and that the benefits outweigh the potential risks.
• The limited device support of Graphene OS is seen as a drawback by some, who would like to see more devices supported, even if it means compromising on security.
• There is disagreement over whether CalyxOS is a viable alternative to Graphene OS, with some arguing that it provides similar security features and others claiming that it falls short.
• Some commenters point out that Graphene OS's focus on security and privacy may not be enough to prevent fingerprinting and tracking by apps.
• The Graphene OS community is seen as somewhat opaque, with limited information available about the project's governance and decision-making processes.
• There is a desire for more devices to be supported by Graphene OS, with some commenters suggesting that a 'good enough' security approach could be applied to a wider range of devices.