zlacker

>>pabs3+(OP)
I don't trust Graphene but I want to. Who are the devs and who are their sponsors? I worry about supply chain attacks. Why should I trust their supply chain and anon devs?

>>2OEH8e+Mf
You don't trust the devs, you trust the public code

>>kytazo+Ji
Unless you build it yourself you do trust the devs. You aren't running public code on your phone you're running compiled binaries. Compiled by who? How securely? Who has keys?

It's also a leap of faith to assume that public code is any safer.

>>2OEH8e+Vi
Graphene builds are verifiable, go build them yourself if you feel like.

Public code is definitely safer than binary blobs.