[fg137]

Exactly why I stopped installing LineageOS on my phone.

While part of it was that I was no longer interested in tinkering with ROM and playing cat-and-mouse game with SafetyNet/root detection/whatever, the other part is that I cannot trust these ROMs, some of which come (or came) with their own bloatware. Those that have official builds are of course better, but the overall experience and security situation is still much worse than OEM ROM, despite all the junk there.

P.S. another issue is that I became sick of is devs using xda forum as the only communication channel, including bug reports, updates etc. GitHub has existed for over a decade, and the issue tracker/release system is usable, yet they choose the worst way to do software engineering.

[empyrrhicist]

Agreed, the xda forum thing is a huge security smell. "Here, download this big binary from a random forum user and put it on a device you carry with you everywhere which is equipped with internet, camera, microphone, and GPS. You're welcome!"

The GrapheneOS setup seems a lot better (though it has more limited support).

[DANmode]

They reduce their need for involvement by being very opinionated about what the project offers.

More projects should strive to establish a culture like GrapheneOS has.

[red-iron-pine]

currently on GraphineOS for those very reasons. There is some amazing stuff in XDA forums but ultimately it's just some random guy posting some random ROM.

Only way I was able to get Cyanogenmod on stuff back in the day, was to use shady hacks from XDA, but man it was super slow and seemed to use a ton of bandwidth...

[bentcorner]

xda is older than github and has a lot of institutional inertia. Also I get the impression that many of the people involved in the xda ecosystem are hobbyists that just kind of learn things as they go along and have less exposure to bigco software engineering practices.

[fg137]

You talk as if github is a daunting service only meant for enterprise customers.

When in reality it's easy to sign up and used by almost every kind of project you can think of, including someone's 100 line random bash script with a single sentence README, a tiny embedded device hobby project all the way to a vibe coded project, from people who know nothing about software engineering. Issues are PRs are regularly used for all those projects. You almost need to go extra mile to not put your stuff on github.

I don't think there is any reasonable excuse/explanation other than "inertia".