Replying to Avatar Final

This just means we won't submit vulnerability reports or upstream fixes.

We've reported many serious vulnerabilities in Android upstream and gotten them fixed, but we gradually reduced how many of the vulnerabilities we report to them after our security partner access was revoked in the past.

There are a growing number of serious Android vulnerabilities currently only fixed in GrapheneOS because of them revoking our security partner access. They're hurting themselves more than they're hurting us with their approach. We can get partner access via an OEM.

We successfully helped them block Magnet Forensics (Graykey) and MSAB (XRY Pro) from doing AFU exploits on Pixels in 2024 when they shipped a feature we proposed in January 2024 in April 2024. We've helped get a lot of other vulnerabilities closed since we started in 2024 along with some major privacy and security improvements landed. Contributing to AOSP has been a poor experience so them breaking that is fine. We'll focus 100% on defending our users, not Android users.
Avatar
ChirpChop 9mo ago

Thanks for your explanations!

Reply to this note

Please Login to reply.

Discussion

Avatar
Final 9mo ago

Should also have clarified that when GrapheneOS do backports for fixes in Beta Android builds, those Android beta builds are already closed source excluding GPL licensed components.

We decompile the shipped code from the beta builds and port fixes ourselves. This won't change getting backports from such versions, nor would it affect us.