Technology

hideshow 4 child comments

parent

[–] matlag@sh.itjust.works 19 points 8 months ago

No. As long as the base remains opensource (AOSP), they can remove the bad parts. Graphene has made numerous contributions to AOSP, I'm confident they can manage that. And if the user base growths, I hope their fundings will follow.

It would be a good thing for the world if AOSP was forked with big resources behind an open project with an open governance. But that needs lot of resources.

parent

[–] cecilkorik@piefed.ca 20 points 8 months ago (2 children)

Neither is true, that's not how forking works. But there is some truth to it in that it can start to become significantly more difficult to keep in sync as time goes on, depending on how obnoxious the security becomes and how many places they have to remove it.

Consider the trivially naive case where Google implements this feature in a single function: "function app_is_signed() -> bool" then the fork just adds "return true;" to the beginning of that function, and happily merges every other update Google makes from then on with zero issues. Even if the code for "app_is_signed" itself changes, nobody cares, because the first thing it does is return true and everything else Google ever tells it to check or do is ignored, the function can still be used everywhere throughout the code, it just no longer actually checks anything in Graphene, whereas it does check things in Google's Android.

Of course the reality is much more complicated than that, but the principle is the same. It's only a question of how obnoxious and difficult Google chooses to be about it. They could move the function around every update, or use many different functions, make a whole system out of it, make it do crazy cryptographic validations and checksums in various different places of the code, have watchdog tasks that are checking that the validation code is getting used. They could be really, really obnoxious about it, if they want to be, and they have more resources than the Graphene OS developers probably do to undo and keep undoing all these obstacles, so if they really want to devote that much time and energy to making Graphene's position untenable, they can. But they could also be doing that now, and they're not. Crackers have been fighting these sort of battles against copy-protected software for ages, it's the same principles, and much of the same economic choices go into it. How much does Google want Graphene OS to go away? How much is it worth to them? It has to have a dollar value to them, and that dollar value might be significantly higher than they're willing to bother with.

hideshow 2 child comments

parent

[–] asdfasdfasdf@lemmy.world 2 points 8 months ago (1 child)

Worst case scenario where Google makes it extremely difficult going forward, what is the hard part about just never rebasing onto future work from Google?

From what I've seen there hasn't been significant core work on Android for a long time. It's been mostly changing from rounded corners to square corners to rounded corners, or shoving AI into every nook and cranny.

I'd think a small dev team like Graphene could maintain their AOSP fork moving forward.

parent

hideshow 1 child comment

[–] cecilkorik@piefed.ca 2 points 8 months ago

I absolutely agree they can maintain an AOSP fork going forward, and I think that's completely realistic and I would be surprised if that is not the case.

But I was answering OP from a strictly technical perspective about the potential difficulties they could, theoretically face while doing that. Since you asked what is the hard part, I'll answer along those lines (again, with the caveat that I don't think these are going to pose realistic obstacles for the GrapheneOS team in the near term) My point is not to say it's impossible but I think it's important for people to be aware that this approach comes with risks, and those risks will grow over time especially when you're up against a non-cooperative upstream that is one of the largest and richest tech companies in the world.

For one thing you're never going to support any new phones without either pulling driver support from AOSP or reverse-engineering the hardware and drivers yourselves, or accepting that some parts will just... not work. So you get stuck on older and less capable hardware. Maybe you don't care about that too much, and that works fine for awhile, but eventually the cracks start to show. Now you have to either start figuring out how to get into the newer hardware, or you have to start getting custom newer hardware of your own, which is $$$.

Using closed hardware this way as leverage is a pretty common way of getting in the way of open source development, and Android hardware is very closed. Similar tactics are already even being used against x86 PCs now with things like TPM and Secure Boot. It doesn't completely brick your system on day one of course, but the erosion of support begins when they start writing software that intentionally relies on these features to say "oh, sorry, this software you want to use? it won't actually work on the open source OS/open source client because they don't have access to this hardware... what a shame." One or two pieces of software, no big deal. But they won't stop there, eventually it'll be like half the software, then over time it'll become 90% of the software, you won't be able to find alternatives. They can often afford to be more patient and relentless about this shit than we are. The battle will continue, and there's no sure path to victory. Forking is one tool we have, and that's great, but we also have to remember that it's not a flawless, unstoppable long-term solution that we can play as a trump card whenever corporate interests do something bad. They don't just give up. They have other means of getting their way.