zlacker

[return to "Graphene OS: a security-enhanced Android build"]
1. jrexil+LE[view] [source] 2025-07-25 03:17:46
>>madars+(OP)
I just installed Graphene on a new pixel. I've only used it for two days, but I got that same feeling of "finding buried treasure in your backyard" I got when I first installed Linux in 1999. I can't believe this amazing software is free in all senses of the word. It is a TON of work and they got so much right. The security and usability settings give all the grainular control I've known was possible and wanted for a long time.

I see some core team on this thread, so just wanted to say THANK YOU! Awesome job! Keep fighting for the users!

I'm totally the wrong person to offer recommendations on mobile, but so far it works very well for me, but then, I use almost no third party apps, and none of them are Play store only. My only complaint is the hardware (outside of their control).

◧◩
2. lrvick+K21[view] [source] 2025-07-25 07:49:31
>>jrexil+LE
> I can't believe this amazing software is free in all senses of the word.

I wish that were true, but if you delete the 100s of binary blobs (many with effectively root access) copied from a stock donor vendor partition the phone won't function at all.

There is no such thing as a fully open source and user controlled Android device today.

◧◩◪
3. cherry+Q51[view] [source] 2025-07-25 08:19:42
>>lrvick+K21
This is also the case with mainline linux though. Good luck using Nvidia graphics with only FOSS components.

Even more FOSS friendly graphics vendors like AMD and Intel rely on binary firmware.

◧◩◪◨
4. bowsam+me1[view] [source] 2025-07-25 09:53:49
>>cherry+Q51
Indeed, mainline linux distros aren't free software either
◧◩◪◨⬒
5. lrvick+DN1[view] [source] 2025-07-25 14:35:38
>>bowsam+me1
I have run nvidia cards without proprietary drivers for years. Nouveau.

With the right hardware choices running blob-free linux is pretty straightforward.

◧◩◪◨⬒⬓
6. Androm+I92[view] [source] 2025-07-25 16:25:14
>>lrvick+DN1
> Nouveau.

Which Nvidia card do you have, and at which clock speed does your GPU run?

> With the right hardware choices running blob-free linux is pretty straightforward.

Unfortunately no. Features like SSE are pretty amazing and have made CPUs really fast and efficient, but they're unfortunately also large attack vectors, so vulnerabilities like Spectre or Meltdown occur. You need proprietary microcode blobs to fix those security vulnerabilities in your CPU.

◧◩◪◨⬒⬓⬔
7. lrvick+rH2[view] [source] 2025-07-25 19:08:52
>>Androm+I92
An Nvidia GPU is never going to run at maximum clock speed etc on open drivers right now, but the point is if you prioritize security/privacy/freedom you have choices.

If you are not running games (which you should not on a system you need to be able to trust) maximum clock speed from a modern GPU is not needed for most workstation applications.

I generally choose AMD GPUs for the best experience with open drivers these days on systems I need high GPU performance from.

> You need proprietary microcode blobs to fix those security vulnerabilities in your CPU.

Really? Which blobs do I need on RISC-V FPGA enclaves or my PPC64le Talos II workstation which has a fully open hardware motherboard and open CPU architecture?

I make different tradeoffs on different hardware to be sure depending on the threat model of the task I am working on. x86_64 is a bit of a shit show, but you still only have to trust your CPU vendor even there, as it is possible to have FOSS firmware/software for everything else.

◧◩◪◨⬒⬓⬔⧯
8. Androm+gd3[view] [source] 2025-07-25 22:05:28
>>lrvick+rH2
> maximum clock speed from a modern GPU is not needed for most workstation applications

Well at that point buying a GPU is definitely not worth your money. You're better off using a CPU's integrated graphics unit.

> I generally choose AMD GPUs for the best experience with open drivers these days on systems I need high GPU performance from.

Yeah I agree on that, I also purchase AMD cards exclusively now.

> Which blobs do I need on RISC-V FPGA enclaves or my PPC64le Talos II workstation

I assumed we were only talking about x86. But I also believe that POWER9 CPUs don't have SSE, prove me wrong. I guess you're running Linux? I'd be very interested in looking at the output of lscpu from one of these machines.

> x86_64 is a bit of a shit show

I fully agree there

◧◩◪◨⬒⬓⬔⧯▣
9. lrvick+Iq3[view] [source] 2025-07-25 23:49:33
>>Androm+gd3
> Well at that point buying a GPU is definitely not worth your money. You're better off using a CPU's integrated graphics unit.

Yeah I only use dead simple workstation cards or integrated graphics on my workstations, and AMD GPUs on my gaming systems which I don't trust at all (but still prefer to support companies that use open drivers)

> But I also believe that POWER9 CPUs don't have SSE, prove me wrong.

POWER9 has its own SIMD system (AltiVec/VMX/VSX) instead of SSE which is entirely its own thing. I have no idea of the performance tradeoffs here though for various use cases, as freedom is biggest factor for me.

> I'd be very interested in looking at the output of lscpu from one of these machines.

Here is an lscpu from an 8 core Blackbird though it will probably render poorly on HN.

Architecture: ppc64le Byte Order: Little Endian CPU(s): 32 On-line CPU(s) list: 0-31 Model name: POWER9, altivec supported Model: 2.3 (pvr 004e 1203) Thread(s) per core: 4 Core(s) per socket: 8 Socket(s): 1 Frequency boost: enabled CPU(s) scaling MHz: 58% CPU max MHz: 3800.0000 CPU min MHz: 2166.0000 Caches (sum of all): L1d: 256 KiB (8 instances) L1i: 256 KiB (8 instances) L2: 4 MiB (8 instances) L3: 80 MiB (8 instances) NUMA: NUMA node(s): 1 NUMA node0 CPU(s): 0-31 Vulnerabilities: Gather data sampling: Not affected Itlb multihit: Not affected L1tf: Mitigation; RFI Flush, L1D private per thread Mds: Not affected Meltdown: Mitigation; RFI Flush, L1D private per thread Mmio stale data: Not affected Reg file data sampling: Not affected Retbleed: Not affected Spec rstack overflow: Not affected Spec store bypass: Mitigation; Kernel entry/exit barrier (eieio) Spectre v1: Mitigation; __user pointer sanitization, ori31 speculation b arrier enabled Spectre v2: Mitigation; Software count cache flush (hardware accelerated ), Software link stack flush Srbds: Not affected Tsx async abort: Not affected

[go to top]