Using GrapheneOS on a pixel 8 pro bought for this. Never used the stock OS. Coming from iOS it is a breeze of fresh air to feel “private”. I tried lineage some times ago but it isn’t as polished as graphene, and it feels like a classic android OS, I didn’t feel " private".
I totally agree. Used pixels are superb with grapheneos. Syncthing is what i use ad a backup. I think the problemi is that google stops releasing updates after 5 yearss old units don’t get updates I think. I have the 5th June build and it reports a security update of December 2023.
If you don’t live in the EU. Here you get a better new phone from xiaomi/motorola/oneplus than a pixel for the same price. Yes, I get grapheneos and relockable bootloader, but used things are too expensive here. If you need a cheap phone, buy a cheap phone (fuck EU’s import regulations).
I don’t know what you are on about, but if brand-new Pixels are too expensive for you (although their price is uniformed to the US one), you can easily find them second-hand.
For example at a time where my Pixel 7 was available for 500$ (466€) in the USA + 100$ trade in (93€) for my Galaxy S8 = 400$ = 373€ it still was 620€ in Austria on Amazon, the only way to buy it because Google did not offer it through their Google store here and normal stores didn’t go below 650€. I could’ve gotten 20€ trade in for my old phone = 600€. 60% more than in the USA at the same time.
Used market basically didn’t exist because Pixels generally were a bit overpriced
That’s the point. You can’t import anything to EU without paying a 20% import tax ±5€ depending on the import. This makes the used device market prices in EU inflated.
Genuinely feels great to be hopeful about some parts of technology/software like this. I eagerly look forward to an update from KDE and sometimes GNOME.
Compare that to Google, Microsoft, any other public big tech, I start to just question why I’m not living in the forest as a new member of a Bigfoot extended family.
Lineage is kinda bad privacy and security wise, from the little I know its not fully degoogled
My understanding is kinda the opposite:
GrapheneOS ships with a sandboxed, FOSS Google Play Services which can optionally do a bunch of Google things (use their APIs, login to Google etc.) plus they have some hosted services that can substitute Google services (like geolocation).
LineageOS basically doesn’t ship with any Google Play style API/frameworks at all. It’s a pure AOSP experience. Any apps on F-Droid work but third party apps (like ones found on Google Play) are hit and miss. If you can just use F-Droid for all of your apps then LineageOS is probably a much more private and secure offering.
LineageOS for microG is an unofficial fork of LineageOS which includes a FOSS Google Play Services compatibility layer, a bit like GrapheneOS. As far as I know it doesn’t have the same level of sandboxing as Sandboxed Google Play on GrapheneOS.
Both GrapheneOS and LineageOS publish monthly updates with upstream security patches for all supported devices.
Both GrapheneOS use network-provided DNS by default.
Apparently both GrapheneOS and LineageOS connect to connectivitytest.gstatic.com via http as a Captive Portal test by default,althoughh this was as of 2019-2020 and both might have changed since then.
Most of this is right, but needs some things corrected.
LOS is kept up by individual maintainers of the devices, and so it can cover more of them. But that also means you expand your attack surface to lineage, maintainer, microg, etc. And that’s just on supported devices. Unofficial devices are even more wild-west, having much delayed releases, OS updates, security updates, everything.
Not only that, but Lineage requires that you unlock your bootloader and often have your phone rooted to be able to do everything. This introduces special points of insecurity and possible issues in the future.
GOS is from a single source, for a single line of phones, and uses a designed method to load cryptographically signed ROMs onto the device, and then validate updates using the same method. The Play Services are sandboxed and disabled by default, so you can just never use them if you want. Overall, this makes for a more cohesive device. One that is more private and more secure. Especially so, when you can buy a new Pixel device and have guaranteed updates for as long as Google will do so for the same device.
GrapheneOS ships with a sandboxed, FOSS Google Play Services which can optionally do a bunch of Google things (use their APIs, login to Google etc.) plus they have some hosted services that can substitute Google services (like geolocation).
GrapheneOS doesn’t ship with any Google services by default. We do provide an easy and safe way to install the Google Play components if desired, they are run under the same sandbox and constraints as any other ordinary app you install. Because they expect privileged access that they don’t get on GrapheneOS, we add a compatibility layer that essentially teaches them to work under the normal circumstances that is the sandbox. If you don’t want them you don’t have to do anything, they are not present in that case.
LineageOS basically doesn’t ship with any Google Play style API/frameworks at all. It’s a pure AOSP experience. Any apps on F-Droid work but third party apps (like ones found on Google Play) are hit and miss. If you can just use F-Droid for all of your apps then LineageOS is probably a much more private and secure offering.
LineageOS does make connections to Google by default, as does AOSP. GrapheneOS changes those connections while LineageOS doesn’t. They can be viewed here:
Keep in mind, that table isn’t exhaustive. It lists the regular connections AOSP makes and how each OS handles them, but doesn’t include information on any additional connections that occur.
You can absolutely download apps from F-Droid on GrapheneOS, what makes you think you can’t, and how did you conclude that LineageOS is more private and secure?
Both GrapheneOS and LineageOS publish monthly updates with upstream security patches for all supported devices.
LineageOS is pretty commonly behind on updates. As an example, it seems that LineageOS 21 (based on Android 14 QPR1) came out in February of this year.
You cannot ship the full security patches without being on the latest version of Android, which is Android 14 QPR3 now. Of course, if the device is EOL, that’s doubtly the case, and no OS can fix that.
Apparently both GrapheneOS and LineageOS connect to connectivitytest.gstatic.com via http as a Captive Portal test by default,althoughh this was as of 2019-2020 and both might have changed since then.
I don’t know if this was the case in 2019, but it certainly isn’t the case now. On GrapheneOS, you have the choice of using the GrapheneOS server for the internet connectivity check, changing it to Google’s server or even disabling it altogether.
You can absolutely download apps from F-Droid on GrapheneOS, what makes you think you can’t, and how did you conclude that LineageOS is more private and secure?
I never said that GrapheneOS couldn’t download apps from F-Droid. I didn’t mention GrapheneOS being able to use F-Droid in my dot points but that was just an oversight, not intenttional.
GrapheneOS doesn’t ship with any Google services by default. We do provide an easy and safe way to install the Google Play components if desired, they are run under the same sandbox and constraints as any other ordinary app you install.
The problem with this is that so many apps use Google Play Services. If I didn’t want a phone that used Google, I wouldn’t use an OS that bent backwards to make it work.
The sandbox model is OK in theory, except when your bank app asks for permissions for microphone, camera, contacts and files, and refuses to start without them.
The app model is a bit broken IMO and GrapheneOS both enables and perpetuates it.
LineageOS is pretty commonly behind on updates. As an example, it seems that LineageOS 21 (based on Android 14 QPR1) came out in February of this year. You cannot ship the full security patches without being on the latest version of Android, which is Android 14 QPR3 now.
I might be being a bit naïve here, but Android 14 came out in October, 4 months prior to LOS 21, which is not particularly long. Android 13 is still supported by upstream. This sounds a bit like running RHEL or Debian vs bleeding edge Arch, no? It’s a common debate whether RHEL systems are constantly out of date, the counterargument being that vulnerabilities are often found in new software versions. Without real statistics about security vulnerabilities over time it’s difficult to make an informed decision about software version policies.
LineageOS does make connections to Google by default, as does AOSP. GrapheneOS changes those connections while LineageOS doesn’t.
That is excellent, I’m glad to hear GrapheneOS is changing some of the defaults to be a bit better.
The problem with this is that so many apps use Google Play Services. If I didn’t want a phone that used Google, I wouldn’t use an OS that bent backwards to make it work.
GrapheneOS doesn’t “bend backwards” to make apps relying on Play Services work. Sandboxed Google Play is highly compatible and all you need to do is install the apps, just like you would any other apps. The argument that since many apps require Google Play Services, you should use stock OS where they have privileged access rather than being sandboxed doesn’t make a lot of sense.
The sandbox model is OK in theory, except when your bank app asks for permissions for microphone, camera, contacts and files, and refuses to start without them.
The app model is a bit broken IMO and GrapheneOS both enables and perpetuates it.
Apps installed on operating systems that don’t have a sandbox and thus a permission model get access to straight up everything. Your scenario is exactly why GrapheneOS features contact and storage scopes; as an alternative to the regular permissions for more granular control. You can grant an app only a subset of contacts/files or nothing at all, the app won’t complain since on its end, everything’s been supposedly granted. There are more planned features to address other permissions in a similar way. Furthermore you could put it in its own little box via a secondary profile (you can have up to 32), and have that only run when you need it.
I might be being a bit naïve here, but Android 14 came out in October, 4 months prior to LOS 21, which is not particularly long. Android 13 is still supported by upstream. This sounds a bit like running RHEL or Debian vs bleeding edge Arch, no? It’s a common debate whether RHEL systems are constantly out of date, the counterargument being that vulnerabilities are often found in new software versions. Without real statistics about security vulnerabilities over time it’s difficult to make an informed decision about software version policies.
4 months without proper patches to known vulnerabilities is very long. Previous versions of Android aren’t properly supported; they only receive a subset of patches, not nearly everything. In fact, not even Android 14 is currently getting full patches. At the time of writing, for a device to be properly patched, it must be on Android 14 QPR3. It’s why we put great care in porting everything over as quickly as possible. You don’t have to make guesses about vulnerabilities, you can simply look at all of the known vulnerabilities that haven’t been patched yet, or will never be patched, in previous Android versions. It’s not a matter of “what if”, it’s what’s actually happening.
While I love KDE, why do we have to have this mentality? I don’t care how much of a joke it is or not, just let people use what they want to use. I’ve never used GNOME and I’m not about to start commenting about it but I do know there are a ton of people who use it and love it as much as I love KDE. It’s like the whole Android vs iPhone debate; who fucking cares?
IMO being part of a community and watching a project evolve is fun, e.g. using Plasma over the years and seeing it grow. I just don’t get the point of bashing another project on the merits of “it’s not the thing I use so it’s inherently bad”. Different strokes for different folks I suppose.
I actually use Gnome, because I’m forced to use Ubuntu LTS at work. Having to use GNOME 9-5 every fucking day is torturous. That’s why I hate it with so much with a passion. They won’t let me use anything else. GNOME is the worst thing ever created! It’s an abomination of all software, there’s literally nothing nothing as garbage as GNOME. It’s incredible how it only gets worse. At this point I’m about to find GNOME developers and explode their computers so they cannot continue polluting this world with hot garbage. I’ll hack all GNOME repos and delete GNOME from existence.
KDE Chad draggy stomps GNOME dirty feet so much it’s not even fun.
While there’s something to be said for Android vs iPhone from an ideological standpoint, that also doesn’t apply for KDE and Gnome, both of which are OSS, bay-bee
Why tho? I mean I love KDE and it’s my daily driver DE but I also like Gnome it’s modern sleek and actually original from other DE which is just Windows Explorer/Mac DE that’s also include KDE
I can be mistaken, but maybe he does not mean the quality and usability of Gnome desktop environment itself. I had to guess if I say he means the way it is organized and the decisions are made, which is totally different from the more free approach of KDE. Maybe I am reading too much into it, but that is what I think, maybe because that is the problems I personally have.
In my opinion the title of best desktop is a tie between Plasma, GNOME, and NsCDE. They are all amazing in their own ways and I switch between them all the time.
(Hyprland would be in there if the developer wasn’t a jerk but I’m not willing to use it anymore because he is stupid)
Graphene OS users, what options are available for backing up your phone? I tried looking for an answer but wasn’t able to find anything recent on this topic.
I want to try it but this is the one thing holding me back.
I just use nextcloud as a target for backups (Aegis, Signal, QkSMS). Apps such as KeePassDX I have load the file via nextcloud. My contacts and calendar go through it as well, photos are just set to auto upload along with a few other directories.
As for the home screen layouts, I just take screenshots once I have it how I like and try to remember to take them again if I change stuff.
It’s not a full backup but I’m back up and running fairly quickly (Pixel 5A died on me 3 times in under a one year lifespan per device).
Syncthing is my answer though I appreciate it doesn’t get to the root of your question.
There are local backups that include your system settings, text messages, contacts, call history and (optionally) apps. The one thing I want is the ability to pick a directory for the local backup so I can make it work with syncthing without jumping through hoops.
It’s also compatible with Nextcloud and WebDAV if those are options for you.
I have never used the Steam beta or Proton-GE or whatever information is spreading out there to noobs about what they should do, and I’ve been gaming exclusively on Linux for more than 20 years. Only do this beta or bleeding edge stuff if you have a problem, and a good reason to believe that will help (like people reporting your specific issue is fixed in beta). Or I guess if you’re bored out of your mind. And expect other issues since it’s fucking beta.
I think this is an issue in using the updated version with the graphics overhaul. You can change that in the launcher. But if you found Something that works then you rock it.
If GE received a Cease and Desist, that would be frustrating, but linux gaming would go on. If Proton got a Cease and Desist, that could be catastrophic to linux gaming. Valve could even theoretically get banned from working on linux gaming (like the Yuzu devs got banned from working on emulation). It’s just not worth the risk for compatibility/performance for a smaller proportion of games.
Well, sometimes Windows games depend on propietary codecs, and until Valve can get the devs to make adjustments so the codecs aren’t needed, the games aren’t going to work properly in regular Proton.
If there is a free codec alternative I assume they can use that when the game calls for that codec? Perhaps I don’t know enough that that’s harder than replacing DirectX calls with Vulkan.
The issue is one of licensing, not technology. There’s all kinds of patents in the space, and using free codecs could still infringe them. DirectX doesn’t have the same patent protection. I believe in theory you could make a fully open source Linux native version of DirectX.
For more info from someone who knows more than me, see here.
One thing often useful (particularly for older games) is support for more video codecs. Due to licensing, valves proton supports less video codecs, which can sometimes cause cutscenes to be played as test-images instead.
GloriousEggroll among a few others, and Valve of course, are the main reasons Linux gaming is now effectively solved (aside from anti-cheats where there’s nothing to do if some developers don’t want to support Linux).
I haven’t yet watched the video, but I agree I’ve not needed to use Steam beta at all. While it’s around 70% of tracked games being labeled Gold or higher on protondb, I have found that with proton-ge, 100% of the games I’ve tried have worked without issue (on the order of 30ish games thus far).
I won’t be going back to Windows, ever. So it kinda stinks that some devs just won’t support Linux for anti-cheat (like Lost Ark, etc). But it’s a price I’m willing to pay to not be spied on.
I put lineageos on my old OnePlus, which had started to lag so much that even the password prompt would take a minute to register my key presses. The moment I put lineage on it, it started working as if it was new and finally had security updates for the first time in 2 or so years. I now use it as a backup device, and also as a webcam for my pc using scrcpy.
You need to use the official way of unlocking (official Windows app and phone number). There are no other ways of unlocking I’m familiar with. I believe in the past you could unlock it via EDL testpoint but now it somehow only makes the device think it’s unlocked but you still can’t install anything. Buy a Pixel for easy unlocking.
Tip: Both GDM and SDDM have startup scripts that are executed when X is initiated. For GDM, these are in /etc/gdm/, while for SDDM this is done at /usr/share/sddm/scripts/Xsetup. This method requires root access and mucking around in system configuration files, but will take effect earlier in the startup process than using xprofile.
I know it’s not the answer you’re looking for but IMO you should consider selling the device and getting a (perhaps used, depending on personal situation) Pixel a-series device instead. If you’re using some brute force method, you may be ending up with a bricked device.
linux
Oldest
This magazine is from a federated server and may be incomplete. Browse more on the original instance.