[Cortex5936]

I love GrapheneOS and I use it daily for more than 2 years. However, and as Louis Rossmann pointed out in one of his videos, they really need to work on the "defensiveness" and "rants" of their communication. Even when they are 99% right most of the time, they sometimes don't come as mature and professional.

[neilv]

My gut feel is that Micay is genuine, and obviously also very defensive.

At least some of the defensiveness is warranted. Maybe most of it. Regardless, it comes across in most GrapheneOS communications, and it's sometimes counterproductive.

A related issue, which I'm sure Micay can appreciate, is that users of GrapheneOS tend to be cautious, and increasingly will want to know why the project should be trusted, now that it is popular and on a lot of radars of adversaries.

(For example, hypothetical scenario that's plausible, given the incentives: State actor (e.g., RU, US, CN) or organized crime group long-con starts with a public harassment campaign of Micay. Followed by sleeper volunteers taking more control of the project, initially under the pretext of helping insulate Micay from harassment, and taking some of the load off. Later maybe even impersonating Micay. Now the threat actor has backdoors to a large number of especially privacy/security-conscious parties, including communications, 2FA, location, cryptocurrency wallets, internal networks where those people work, etc.)

I think it probably hasn't been compromised like that, but it's an obvious real possibility, and IMHO, until GrapheneOS is more transparent, some natural users of GrapheneOS are going to consider iPhone relatively "the devil you know".

Again, I think Micay is genuine, and I'm a fan of the project and appreciate it. And I hope the project understands that's compatible with critical thinking about infosec, and doesn't take personal offense at that.

(Source: Am long-time GrapheneOS user, and have donated.)

[microtonal]

I agree that this is an issue, but it is impossible to prove a negative. The same could be said for Apple's or other manufacturer's signing keys. Who guarantees that the US government hasn't required access to the iOS signing keys? Or China in exchange for access to the Chinese market? They probably wouldn't even want to reveal that the signing keys were leaked if they were allowed to, since it would undermine their security story.

With a non-profit project of highly principled security experts, there is at least a high probability that they'd rather blow up the project than compromise. People elsewhere in the thread criticize Micay because he deleted the CopperheadOS keys, but to me it increases trust in the GrapheneOS project, since he clearly puts the security of his users over money, fear, and whatnot.

In the end trust arises from running a project or company long-term without evidence that you somehow compromised security.

I wonder in general how this situation could be improved. Second or third independent reproducible build + confirmation signing?

[HybridStatAnim8]

All of the defensiveness is warranted. They speak neutrally and objectively.

The project is not going to relinquish control to any 3rd party. Not even the Motorola partnership is given control over the GOS project. The hypothetical you describe is not possible by design.

The GOS project takes no issue with critical thinking, and encourages it. But that is often used as an excuse to handwave attacks. There is a very big difference between criticism/critical thinking and attacking them.

Note that there are more individuals in the project than Micay. Multiple people handle multiple responsibilities, its not one person.

[ryandrake]

> The GOS project takes no issue with critical thinking, and encourages it. But that is often used as an excuse to handwave attacks. There is a very big difference between criticism/critical thinking and attacking them.

Responding to attacks so defensively is almost alway a bad look for organizations. They could really use a PR person with a more measured voice that corrects facts and projects confidence, and does not convey victimhood, insecurity or defensiveness. Take a look at the tone of press releases issued by companies when some tech press bozo writes a hit piece on them, for good examples of dealing with people attacking you.

[HybridStatAnim8]

I would not use those words to describe the approach they take. They make the effort to speak neutrally and objectively, but the issues they are making light of are often exactly as extreme and common as they describe. Many people have voiced appreciation that they decide against a "corporate-speak" approach. The GrapheneOS accounts are meant to be accounts that let project members speak to users, rather than take on a corporate appearance.

[neilv]

I'm sure you realize that confident assurances of a random new pseudonymous account on a Web site isn't sufficient for anything of importance.

Is there an authoritative source of information about how a takeover like that isn't possible by design, which people can verify, analyze, hold parties accountable for the pieces that require it, etc.?

[HybridStatAnim8]

I am a GrapheneOS user and community member, and I am active in the chat rooms. I made this account to assist with misinformation.

As for how such a thing would not be possible;

-GrapheneOS updates do not trust the network, so any compromise of update servers for OS and app updates would not be able to push malicious updates. Only those who hold the signing keys are capable of pushing updates that will be accepted.

-Multiple people review the code that gets included in the OS. There is not one point of failure when it comes to social engineering.

-GOS supports reproducible builds, so the code that is published can be verified to be the code that is built for the official builds.

So in other words, you would need to convince multiple people who are consciously protecting against this, and who have a proven track record of burning the keys if the privacy and security of their users are in jeopardy. On top of that, you need to conceal this from every developer, moderator, and community member who would raise the alarm at the slightest indication of compromise.

[Georgelemental]

Personally, I like that they come across as a little paranoid. That's exactly the attitude I want in the people protecting my privacy and security. I hope the developers lie awake at night, unable to fall asleep because terrified that someone somewhere is plotting to attack and exploit them

[finalst]

While I understand you are trying to be positive about this, I don't think it's good to want our team portrayed like this, sorry. Paranoid people are people who'd easily be influenced into doing harmful behaviors because it believes it will stop their problems. Making a response to inaccuracies and bad journalism platforming an extremely malicious actor isn't a symptom of that. We don't have people with severe mental illness on the team. That would be irresponsible and mental illness is not something to romanticise in my opinion.

[Georgelemental]

There is a very broad spectrum between "completely average and neurotypical" and "severe mental illness". E.g. "slightly atypical personality". The world would be a boring place if everyone was exactly the same

[finalst]

I agree for sure everyone should be different and have a diversity of how peoples brains work. The same type of think puts us into a bubble. We are definitely atypical because we are developing something quite atypical as well. Coming as a project member I just sometimes see comments that call us stuff like 'schizos' or 'paranoid' even when it is intending to be positive. I guess somehow they believe someone with a severe mental issue is more likely to an adversary of the government or whatever enemy they perceive? I don't know the justification behind it. I just find that odd, we're quite ordinary people actually. I don't think it does good for mental health awareness and for people who actually have these issues to backseat diagnose how people's minds supposedly work.

[busterarm]

There's healthy paranoia and there's treating even casual commentary/criticism from anyone as an existential threat & coordinated attack...and responding to that with sustained, coordinated attack campaigns online. That's what Micay's history is.

That's not healthy for any project.

[HybridStatAnim8]

This is false. Commentary and criticism is not treated as a coordinated attack. Coordinated attacks are treated as coordinated attacks. Criticism is often used as an excuse to try and hide attacks, and many people unfortunately cannot tell the difference.

[microtonal]

Well, they have had to deal with multiple swattings, constant misinformation from some competitors (e.g. Murena's CEO doing interviews with various media where they insinuate that security-hardened systems like GrapheneOS are only for criminals and secret agents, complete with 'think of the children'-style arguments), and some local/national governments boosting the narrative that GrapheneOS is for criminals.

So I can understand why they are as defensive as they are.

[Cider9986]

Recently, the socials have been more moderate and level-headed, imo.

[user_7832]

Could you share a link or something about this?

> ...responding to that with sustained, coordinated attack campaigns online. That's what Micay's history is.

For the rest, in general, I'm tempted to give grapheneOS the benefit of the doubt. Running any FOSS project is hard, running it against the (implicit) wishes of OEMs/Google (who throw in things like Play Integrity) is even harder, and doing it when 3 letter agencies at the US govt actively hate you is harder still.

Being paranoid in responses to FUD campaigns isn't ideal, but save coordinated attacks, I'd say fairly understandable.

[TehCorwiz]

Based on how discourse in the US has been perverted by inches and millions of mosquito bites they may not be wrong. Stamping out bad information fast and hard seems to be the only way to combat mass coordinated disinformation. Being polite just lets people play the "both sides have merit" game.

[singing_tartly]

not true at all...

There's no coordinated attacks on anyone or projects by GrapheneOS. They respond to misinformation, that's about it.

There have been many attacks on privacy/security projects, not just GOS, recently. If you keep up with the GOS forum you can see posts saying GOS was hacked without evidence. Other claims that GOS is only used by criminals. Theyre not true. Misinformation that aims to destroy the reputation of the project should be responded to.

[uqers]

https://xkcd.com/225/

[Cider9986]

That's hilarious thanks for sharing.

[tokai]

Realistically Stallman would start lecturing them on how his licenses are not open source.

[kibibu]

Richard Stallman would most certainly not use the term open source to lecture somebody about free software.

[toaste_]

When Louis Rossmann thinks your communication has a problem with going on rants, it must be pretty out there.

[joyous_limes]

Rossmann is a way bigger ranter than GrapheneOS people. Have you seen some of his videos lol.

Rossmann wanted to work with GOS and they didn't want him. So Rossmann made that video to make Daniel look bad for revenge probably. Saying he was leaving GOS was a lie, not that GOS can push malicious updates which was also a huge lie. Even after pointing that out that part wasn't corrected because Louis doesn't care about accuracy, he only cares about making Daniel/GOS look bad. He used his big following to punish Daniel. Now he works with Nick from Calyx after he got pushed out and are doing business together.

The more you learn about the story, the more you see the Copperhead stuff was just the beginning and those involved held grudges and pushed their grudges onto more people who bought their lies and it continued. Privacy-focused OSes that pretend to compete with GrapheneOS suck. GrapheneOS is led by someone with integrity, unlike some other projects.

[handedness]

That video of Rossman's was cheap theatrical trash. Disappointingly beneath him.

[HybridStatAnim8]

Rossmann publicly blasted a private discussion, twisting what was going on, and then lied to his own viewers. Such a claim from an identity verified kiwifarms account holder holds no weight.

[Matl]

> However, and as Louis Rossmann pointed out in one of his videos, they really need to work on the "defensiveness" and "rants" of their communication

Not that I disagree but Louis Rossmann giving someone advice to tone down the rants is ironic.

[dooglius]

Have you considered that the smooth-talking "mature" and "professional" people are more likely to sell your data to advertisers at the first opportunity?

[jasonvorhe]

I don't care about messaging or professionalism in marketing. I'm perfectly happy with the way GrapheneOS is being managed right now, including their lengthy technical rebuttals to any attempts of attacking the project to dilute its quality or reach.

[neonstatic]

It's a personality type / disorder (pick your poison). There's no hope for change. Programming seems to attract such people, because they are fixated on being right and proving that they are right. I know a few more examples. My common sense policy is - if the software these types produce works for me, I will be using it, but I will never allow myself to be dependent on it. That kind of person will gladly burn their own house to the ground, with everyone in it, if that's what's required to prove their truths or maintain some kind of intellectual purity.

[wyldfire]

It would be interesting if there were a state sponsored effort to discredit a project that helps some people keep their communications private.

[Cider9986]

There might be one, in France.

[aphorism]

So what if they're defensive and cringe in their rants? Are you so indoctrinated into believing performative aloofness is "professional" that you can't see clearly?

[mvkel]

Being "right" shouldn't excuse bad behavior, especially if you depend entirely on a community to survive, which we all do.

[HybridStatAnim8]

Defending oneself isnt an unreasonable thing to do. GrapheneOS is entirely funded by donations and receives a lot of donations to this day. Them defending themselves is not an existential risk, the attacks against them are.

[balamatom]

Why the scare quotes? Being right is the literal opposite of bad behavior.

[mvkel]

If you have zero consideration for other people, sure.

"I can't believe you wrote this terrible code. You clearly don’t understand how concurrency works. Do it again."

Technically right, but when you run out of people who actually want to work with you, you'll be writing the code yourself.

[balamatom]

What's worse: good work that I get to do myself, or bad work that I'm forced to accept anyway?

[aphorism]

Which "bad behavior" are you talking about?

[HybridStatAnim8]

Louis Rossmann caused a lot of harm to GOS and blasted them publicly for trying to raise issues privately. That is disgusting behaviour. He then lied to his own viewers about no longer using GrapheneOS, lied about fears of a targeted update despite that not being possible, among a lot of other things. Note he also has an identity verified kiwifarms account.

GOS only defends themselves from attacks. Its not that they are misinterpreting what is an attack, there are really just that many attacks. It leaves little room for much else than defense. Nobody should have to deal with the inhumane level of attacks.