• 0 Posts
  • 16 Comments
Joined 1 year ago
cake
Cake day: June 6th, 2023

help-circle







  • Lead dev of grapheneos is extremely toxic in communication. I don’t trust someone like that developing the software running on a phone.

    EDIT: This comment seems to be particularly controversial, with many people praising GrapheneOS as a project, while ignoring the developers views and actions. Although my opinion of the main developer is negative, the project itself and its goals are great. To clear up some confusion, I want to add to my previous statement:

    At first, this seems like the standard “separating art from the artist”, however, GrapheneOS is a ton of code, not just art. When it comes to other forms of art, like literature or paintings, an artist maliciously hiding their personal beliefs in their otherwise “unbiased” work might degrade the quality of the final result, but does not have much significant impact outside of that. When it comes to code, programs, OSes, this changes. The artist (programmer) changing their art (code) based on their personal beliefs is not just a degradation in quality, but a security risk for anyone running the code and trusting the developer. Having seen the way the GOS dev speaks about its community and even people in support of him (see Louis Rossman’s video), it becomes clear that the mentioned “risk” of malware is very much present. Like many others, I don’t have the time to verify the source code of an entire Android rom myself, which means I would have to trust the GOS dev to not insert anything malicious, after the statements he’s made. I’d have to trust him after he’s grouped a majority of his community into “people who are after him and are swatting him”. It’s a very real possibility that someone with beliefs like that would add malicious code to his project, and I’m personally not willing to run that risk.

    Please note that I am not encouraging people to “go harass the dev”, that is an immoral action nobody should be doing. I am trying to inform people of the developers behavior online, past and current, so they can make a decision for themselves whether to run his software on their personal devices.






  • The bootloader of your phone (if locked) is one of the most secure parts. It’s very hard to get into a modern phones bootloader. In contrast, finding an exploit in a running phone is a lot more feasible.

    If a vulnerability was abused to get into your running phone, it will persist until the phone reboots, and the bootloader verifies the core parts of the operating system at startup. In order to persist past a reboot, malware like that would need a vulnerability in the bootloader, or a bypass for its integrity checks.

    Alongside that, any background services (“daemons”) that got stuck or became slow over time are forced to restart. Operating system updates can be applied, and working memory is cleared.

    In general, it’s just good advice to just reboot your phone once in a while. There’s no harm in doing so.