Custom ROMs have had just about enough of being Android's second-class citizens

Kushan , 2 hours ago

I feel like a huge aspect that this article and the GrapheneOS developers are overlooking is DRM content.

They’re focusing on user security for a user’s own data, but there’s a whole other side to it with companies wanting to protect their own data - think Netflix and the like who use the same systems to ensure that nobody’s been tampering with the device as a way of bypassing the copy protection of their media.

Now I’m not saying I support DRM at all, I’m very firmly in the camp of being able to own the media you purchase without restriction, but my point is that it’s not as simple as Google being dismissive, lazy or ignorant but rather there’s a lot of commercial sensitivity at play and if Google fucks it up, they could potentially lose certification of the entire android ecosystem.

skullgiver , 31 minutes ago

GrapheneOS specifically is probably fine when it comes to DRM. They sign their builds with keys that only they posses, so any custom forks would not get the advantages running an official version of GrapheneOS would gain if they were to pass the hardware verification API.

News outlets like to group projects like GrapheneOS and LineageOS together as “custom ROMs”, but GrapheneOS is much more than that. And in all honesty, some of the stuff LineageOS pulls to get their software working on some models shouldn’t be passing any checks. The projects released on forums like XDA are particularly bad, some of those will even disable Android’s security sandbox all together because it’s hard to make that work as intended.

Obviously, custom ROMs should not be trusted by apps where hardware security is essential. However, in cases like GrapheneOS, it’s hard to defend putting hashes of old, abandoned firmware with dozens of kernel exploits on the whitelist, but refusing to put GrapheneOS on there as well. Especially as GrapheneOS is more secure than Google’s own ROM, according to forensic hacking company Cellebrite, which can’t hack Google’s phones with Graphene but can get in with Google’s original software.

polyduekes , 4 minutes ago

i don’t think what grapheneOS wants is to be able to spoof or bypass play integrity, they just wanna be able to implement it as well just like oems do so if someone will tamper the system in graphene as well, play integrity should blow off and drm content will be safe

absquatulate , 4 hours ago

The Play Integrity API was never meant to detect fraudulent apps, but to make it easy for google to become the arbiter of what’s trustworthy and what’s not. They knew this of course, but this lawsuit indicates they might have something solid to stand on. Good luck GrapheneOS!