Smear Campaign Towards GrapheneOS | Hacker News Reader

Smear Campaign Towards GrapheneOS

grapheneos.social

77 pointsmonneyboi17 comments

/e/OS user here. I regularly receive the latest Android and LineageOS security patches. Much more consistently than I did back then on a stock Android phone. I don't really know what these guys' (Murena and GrapheneOS devs) problems are with each other, but they really should stop, it isn't good for anyone.

> I don't really know what these guys' (Murena and GrapheneOS devs) problems are with each other

https://news.ycombinator.com/item?id=50173902

https://news.ycombinator.com/item?id=49355370

https://news.ycombinator.com/item?id=49363163

https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

The founder of Murena strongly implies that the difference between /e/ and GrapheneOS is that GrapheneOS is designed to protect pedos, for example. I think that explains a lot.

https://www.clubic.com/actualite-604786-murena-e-os-intervie...

Did you actually check what your device is getting updates for, if they contain latest firmware, kernel, drivers etc or do you rely on recurring OTA appearing?

Also GrapheneOS can't be compared to other privacy/de-googled roms because none other are as deeply tied to the security/isolation/memory protection features shipping on pre-11 Pixels and 2027+ Motorola flagships.

/e/OS rarely updates Linux kernels or firmware, even though they have a continuous stream of CVEs. For instance on Fairphone 6 (which is one of the better /e/OS devices when it comes to updates) is still on Linux 6.1.138 from May 2025. The firmware blobs, including Qualcomm firmware blobs are from April 2026, so missing six months of fixes for high/critical vulnerabilities:

https://docs.qualcomm.com/securitybulletin/october-2026-bull...

Then, they only roll out ASBs, which fixes vulnerabilities that have been known for up for six months, because they don't roll out embargoed patches like e.g. GrapheneOS does (and these vulnerabilities have been known for months through reverse engineering).

If that wasn't bad enough, ASBs only fix vulnerabilities high/critical, for all other fixes you need QPRs and major releases, but /e/OS is behind major releases. If you are still running Android 16, your phone has vulnerabilities that are known for up to two years. Yes, they are low/medium, but they are used in exploit chains. This recently got worse, because Google recently started only rolling out some high/critical fixes to Android 17 and not older Android versions.

Then there is all the shady stuff that Murena doesn't tell you about, like running Google's proprietary DroidGuard blobs in a privileged process on Play Integrity requests. Giving certain Google apps higher privileges than the normal Android app sandbox. Installing F-Droid packages through a proxy (CleanAPK), that they do not want to reveal the owner or purpose of, etc.

Why don't the GrapheneOS developers like Murena? Because Murena often instigates in interviews that GrapheneOS is for criminals, etc.

If you care about security (or privacy) at all, don't use /e/OS.

Disclaimer: I am not affiliated with the GrapheneOS project in any way. If you don't like GrapheneOS but care about having some basic security, then get an iPhone.

Any revolution without the privacy available at the time would have never succeeded. The ability for people to communicate without the state being able to listen presents too much of a danger to be allowed. This is true in every kind of state, democracy, theocracy, authoritarian, doesnt matter.

Those who give up their freedom and privacy for security will find themselves with neither security nor privacy...

All the signs are there that this is a multinational police operation.

Likely intended to promote the less secure devices and get them in the hands of those the state would like to target. If it were actually limited to drug traffickers, dangerous criminals and terrorists I'd have much less of an issue with it.

But there are several groups that will likely be targets that should not be. Catalonian independence activists (spain), Abortion/reproductive rights activitsts (US), Palestinian advocacy groups, depending on how the politics in each of these countries goes, LGBT and especially trans activists could be targeted also...

Likely intended to promote the less secure devices and get them in the hands of those the state would like to target.

I think the whole thread misses the mark a bit, because the source that the GrapheneOS account used (Algemeen Dagblad) did not properly research this. For Dutch readers, this is not really surprising, since the AD is not known as a quality newspaper and tends to go for sensationalism (though slightly less bad than De Telegraaf). Other sources are much more detailed:

According to our information, the reseller did not distribute official GrapheneOS. Using AI tools, he had built his own fork and added mobile device management (MDM) for remote administration. The result was a separate operating system that lacked, among other things, the security updates of the original project.

His signing keys for that system were probably compromised. Anyone holding those keys can build an update that the phones accept as genuine. Such an update was apparently installed on seized phones via ADB (Android Debug Bridge), an interface that requires a USB cable connection, and probably removed the screen lock. The phones could then be examined forensically. On our information, the authorities again needed the phone in their hands. On official GrapheneOS, the same approach would require the project's own signing keys.

https://www.joint-defense-team.com/post/grapheneos-cracked-p...

AD could have written something similar if they did their homework in understanding the case.

tl;dr mostly shoddy journalism from AD.

I'm a bit surprised. I like GrapheneOS, but also e/Os, lineage,... Why this bashing? To me they're all on the good side. And I can't find evidence that it's a state sponsored effort, anyone?

It's a psychology thing I admit, but having the post spilt up across Mastodon posts immediately makes this take a hit to their ability to speak with authority.

It might just be due to my age but constraining their writing to the post limits also hurts the statements. It makes the whole segment seem reactionary in an internet drama kind of way on one end, or conspiracy theorist writing on the other.

I hope someone in tech journalism picks up the story so we get a proper article on this. Right now it's just a "they said" and "they did" without supporting substance.

running this the other direction it seems a touch odd to suggest my own instance's 6969 character limit is capable of conferring some amount of authority, but hey i'll take it

It also doesn't help that in the Mastodon website styling, threads segue pretty much straight into comments, and one of the first comments to appear is by an obviously mentally ill person. Posting on social media like this just makes one susceptible to other content appearing next to yours that undermines your message. A blog post on their own site would have allowed them to control their message better.

Surely Graphene could admit that people with a love for privacy happen to have a something in common with all of organized crime?

For me, privacy is a strong human right, so I look kindly on people taking that ultra-seriously. They help the rest of us by extension. But what Graphene here calls a smear campaign directed at Graphene is mostly directed at criminals using privacy tools. Those are not the same, so don’t take it personal.

graphene OS is bullshit big money play acting as an 'alternative' there is NO clear identity or core team, just the standard trust us because we say so, and the tedium of another big company that will inevitably walk back whatever freedoms THEY GRANT is such a tired trope that people are of course alert to the clear signs comming from the money, like oooooh look 13 fucking banks just jumped on board, and all your apps will work, and something something, all that traffic to google servers is 'obfusicated', trust us.

> Claude clone the source code of this open source project and then lets compile it with debug mode and then install it on my device and log everything that it connects to and every message that it sends.

We live in 2026 where every open source project is being scrutinized endlessly by thousands of agents to try to find vulnerabilities anywhere and everywhere, and you can do it yourself with just a prompt and a spare laptop and phone.

open, I mean closed sesame. open source means nothing, except, trust us and come work for free.

you just sound like a moron

Reply on news.ycombinator.com