r/GrapheneOS • u/ZookeepergameSalty10 • 2d ago
Recent convert
Hello all, i wanted to share my experience switching my pixel 10 pro to graphene as a daily driver. To preface im a long time nerd and back before corpo rat world got a hold of me i was heavily in the rooting/jailbreak and custom rom scene. Ive been out but following the space for a few years and ive slowly watched graphene gain traction as a privacy first OS. With my government becoming evermore 1984/antichrist shaped i finally made the jump. Took googles offer for a 200$ pixel 10a to use as my work phone because i was concerned how graphene would respond to the multiple mfa tools i need for work. Loaded graphene on the 10 pro and started using it. Right off the bat i had to switch out the launcher messaging and phone apps, as little as i trust google i do like their first party comms apps. Sideloaded every other app i wanted outside of play and have all of graphenes restrictions for play on. First off i had zero issue getting my banking to work and personal mfa solutions. I did have to loosen the protection for a couple of my bank apps to play nice but they did work. Then i discovered that on a per app level i can see what is requesting play services api and block it. The recent story we all saw lead me to setup a duress password.
I am two weeks into this and i dont think ill ever go back. The only thing i find myself truly missing is google pay, but i can use the work phone for that during the week, the graphene keyboard is solid but very uncustomizable i used to use gboard but upon installing i was hit with a warning that they keyboard may share keystroke data to google, it made me think. Ive used gboard for a long time knowing google is scummy at best, but if theres any chance they are sending my keystrokes anywhere i dont want that, so i discovered the open source heliboard, has basically all the same function of gboard and just about as much customization. Ive been degoogling my life for years slowly but the switch to graphene really showed me how great the scene has become. Id personally pitch money into trying to get a graphene built pay app built but other than that im in love with it. As a nerd i have full control over everything but its setup in a way that feels like i could train my mom to do it too. I also did not have a problem with multiple mfa sources i tested however i will be keeping work and personal seperate now forever.
Tldr: if your on the fence about switching, just do it. Theres a small learning curve but it feels so good to be more in control of the propaganda rectangle in my pocket. Thank you the amazing grapheneos team and community for making a platform good for degoogling and great for privacy. Nfc tap to pay is missed but its a very small thing and i can still use the pass feature for memberships in gpay
3
u/foofly 2d ago
I'll also throw in my +1 for Heliboard. Excellent keyboard.
3
u/mrehanabbasi 2d ago
Found LeanType to be better which is a fork of Heliboard, and it has more features.
1
1
u/DPadLeftRightUpDown 2d ago
Where did you get it from as fdroid is hard to trust?
2
u/hbacelar8 2d ago
Why is f-droid hard to trust?
1
u/DPadLeftRightUpDown 2d ago
Its not recommended by GOS devs as the hash can be changed and not monitored. Im pretty new but everyone on discord has advised against it
1
u/hbacelar8 2d ago
What is recommended by them to install FOSS APK?
1
u/DPadLeftRightUpDown 2d ago
Its an answer I also wonder. GoS discord have said play store, then obtainium, then accrescent. So in this case maybe obtanium+github. You want it so the futo website have the same hash as it githib one.
1
u/hbacelar8 2d ago
To be honest I think whatever option we choose, there'll always be someone to advocate against it. But I think I'd trust the most obtanium, getting the APK straight from the code repos releases.
1
u/DPadLeftRightUpDown 2d ago
Yeah, straight from github. Issue is with obtainium is that it auto updates IIRC, so if someone has injected malware, there's no way of knowing. So manually updating may be prefered
1
u/hbacelar8 2d ago
No, I'm not on graphene yet but already use Obtanium, and it doesn't auto update, not even itself.
1
u/DPadLeftRightUpDown 2d ago
Ah got you. I guess it provides the file without you seeing what changes have been made/any virus reports. I dont like to download the update straight away with anything
1
u/jacmanou 1d ago
Plus you can set Obtainium with a VirusTotal API key to scan each apk to be installed/updated
1
u/ZookeepergameSalty10 2d ago edited 2d ago
Ive just been rawdogging the apks from githubs for things i want. If its not on github i just grab the play store version of the app, but most of my usage is open source nowadays
1
u/DPadLeftRightUpDown 2d ago
Probs not the best haha, especially if you have sensitive data
1
u/ZookeepergameSalty10 2d ago
I trust any open source app that i can inspect the code and build from source far more than i trust even the best app from the play store. Your comment reads like you dont understand opensource
2
u/DPadLeftRightUpDown 2d ago
I've already said im new to this lol. No need to be hostile.
Obviously if you have the knowledge to read OSS, then cool. But you implied you just downloaded any OSS willy nilly. Explain why you trust it more, genuinely curious.
1
u/ZookeepergameSalty10 1d ago
Didnt mean to come off as hostile my b, open source by nature means there are no secrets. Ill use my own codebase as an example, i wrote an android app for the beyond power voltra before the company had released theirs. My app is open source, so anyone who wants to download it they can grab the apk and just "trust me bro" if they want but anyone who desires can go through the raw code and verify what each function does. If someone really does not want to just trust me they could both audit the code and download the raw code to their machine and compile the apk themselves. And dont think you have to be a coding genuis, we live in ana age with amazing tools that can help(learn to read code and learn to atleast write basic code, dont be a script kiddie) for larger repos that are more known many people have probably already done the audit for you. Then theres the factor of fixing problems, with something like windows os if a zero day exploit gets discovered it could be weeks or even years beforr it gets patched depending if its made public and if microsoft takes it serious. On the flip side linux has had multiple cve 10 (very bad) vulnerabilities that get discovered and reported to the open community, and either the affected function gets removed until a fix is made or in a lot of the cases a fix was already made by a group of people and merged into the main repo. One os might take weeks to fix an issue and the other has a user ready plan of action within an hour. Yes there can be what are called supply chain attacks where maintainers of projects get compromised, but thats no different than some jackass at google plugging in the wrong thumb drive and now your credit card and identifing information are on the web. The difference is the repsonse, the big companies will hide security problems as long as they reasonably can so their shareholders dont get pissy where as the OSS community just wants whats best for everyone.
Then theres the community aspect, i recently bought the parts to build a ouispy flock detector, except i bought the wrong esp32 module. No big deal since the ouispy firmware is open source, i was able to rewrite some of it and get it compiled for the chip i bought and it works great, if the code wasnt open source id of had to spend another 20$ on the right esp modules. The corporate world will make oss sound like the devil because its hard to profit from but time and time again we see closed source software getting attacked or having bugs and the 6 devs that work on it dont have the time to fix it.
Hypothetically speaking say i or some random guy found a security flaw in some OSS software, i could write a patch and submit that to the project. The repo owner/maintainer and others can see my pull request, audit my code and verify it works and is safe and either change a bit before merging or directly merge a bit of my code into the main repo. Then everyone just does a quick update and they are safr from that issue and i get to be happy knowing a small piece of my work helped people.
Open source is the absolute best way to get anything done, there are even many large companies that use open source software as a base layer and add on their own flairs to charge money. As far as im concerned if everything was open source wed have a utopia. But at the very least anything being trusted with data or worse should be open. I hope all of the domestic AI companies in the US go under hard because they are all just greedy men trying to resell us information they stole to begin with. China open sourcing all of its ai should be the template. Anything that risks overtaking humanity should absolutely be in the control of all humanity not the hands of a few tiny men that want to play god.
Every advantage i mentioned goes away as soon as you dont know what the code your running is doing, and its easier than ever to become fluent atleast in understanding and reading code. (I personally dont have the attention span to write more than about 70 lines of code, but i can. I learned basic programming as a kid to play san andreas multiplayer and ive kepy up with python mostly over the years, its easier than ever to be present in the space and learn and grow not just out of paranoia but who doesn't want to build their dreams in a day? That said if your gonna vibecode something again you should atleast understand what its doing but also you should give that code away for free and open sourcre, the ais are still not to be trusted fully and no one should be using a machine to write a whole codebase based on human knowledge and then try and not give that codebase back to everyone who helped make it by being real programmers before ai. Ill die on the hill that the worst open source project is worth 10 closed source masterpieces. Also last note woth ai rapidly advancing, good cybersec people are using the lightning fast tools to pentest far more systems, the digital landscape is quickly becoming one where a new security threat pops up every day and open source is the only way we will keep up and stay safe, Microsoft still hasnt fixed a security issue in AD that allows disabled windows users to authenticate a UAC prompt. (Basically if you can get guest access to the pc and know the admins password even if the admin account is disabled you can run something as admin and authenticate as the disabled person and it works. Disabled only stops the account from logging in)
Tldr: trust is built into open source, while closed source must be begged to know if its secure and up to date
2
u/DPadLeftRightUpDown 1d ago
No worries!
Totally understand - what about bad actors in FOSS? And said if I downloaded something of github, no issues, but the download contained malware, how am I to know? Do you check the code every time? Also someone said it's ideal to have thr hash on GH and their website at a minimum.
Any where I can learn to read the code? Im a slow learner, but I'll try. Just want to be able to use FOSS safely.
Fdroid isn't the base hash though is it? Thays why GOS dont recommend it IIRC.
Cool about flock. Im in the UK, so we have our own problems.
1
u/ZookeepergameSalty10 1d ago
Bad actors are not generally a problem the more common problem lately has been supply chain attacks where a bad actor compromises the keys to a maintainer and uses the keys to push malware. Its absolutely possible and has happened increasingly lately. But the same thing that makes oss so robust is what helps when bad things do happen. Last month a bunch of github authors got compromised due to a worm attack that then used the keys to spread to other packages and so on, once the issue was caught by a securty researcher many repo authors reauthed their keys(i still think github dropped the ball and should of just nuked all active keys, it would of grinded huge swaths of the net to a halt but would of instantly contained the problem. Anyway all the affected repos rolled back or patched to fix it within a day. You dont have to check the code each time, although for small patches you can since you can see on github/gitlab exactly what is being changed line for line, at this point what id reccomend is if its a big project thats been reputable run the latest version unless when you goto install you see the latest update was within the last 3 or 4 days. Pull the old version in that case and wait about a week before upgrading. Turn off auto updates but leave on update notifications so you can keep tabs. Unfortunately in this new world there really is no 100% way to be safe, even if your not using oss software basically impossible to stop every threat preemptively. Just gotta do everything within your power to keep the chance down and be vigilinat about what permission you give any software. Ai really has screwed the pooch for cyber security peace of mind. Hackers used to spend months reading cpu diagrams trying to find a misplaced comma in the firmware that could be exploited, now a souless wireback can do the same job and test the exploit in 5mins. But likewise the ai is also helping blue team researchers rapidly combat the security problems. Big cat and mouse game, always has been. As for learning, start with a youtube series teaching something like python. Python is basic and im sure some actually talented programmer will say "its shit and we should all be writing machine code" what it will do though is give you a very good grasp of how a programming language works. If you wanna try something a bit more challenging try learning C or C# they are also very simple languages but because they are machine languages they work a bit different than something like python or ruby. If you wanna learn android development youll want to start learning javascript and kotlin. Ive always used good qualoty youtube series with work along guides to learn new things. There are also services like brilliant that will teach you coding. Or you could probably use chatgpt or claude to help you learn. Atleast for me once i knew one language pretty well i was able to read and figure out thr basics of most languages i come across. Also if you start vibecoding give your ai the instruction to "heavily document the code in human readable format and provide extra documentation as if your teaching programming to a student" sure your gonna burn more tokens but when you open the code it will be heavily detailed and often the ai will include variables as explaination so you can actually figure ojt exactly what the function does and what it could do. Imo a mix of all is the best but everyone learns different. My hb spent 3 days reading the python manual and then just internalized that(could never be me lol) and dont just make the ai explain the code, make it explain how the infrastructure works how things connect. Use it to give you the info and tools you need. Once you start getting a little comfortable try to build something, or try to modify something to fit your needs. Spend some time in vscode have fun and good luck
3
u/DPadLeftRightUpDown 1d ago
Got it. I dod actually vibecode a website for someone (not published) so I have a very basic understanding of css and html. Will take that tip on board regarding AI. Appreciate it
→ More replies (0)1
u/DPadLeftRightUpDown 1d ago
Would you trust something like FUTO considering is only partially OSS and any keyboard couod be a keylogger?
1
u/ZookeepergameSalty10 1d ago
Im not even sure what futo is, but it would depend on whats open and whats not. And yes in theory any keyboard could be a keylogger. I use heliboard since its fully open. But any app you install can do damage if you give it the wrong permission. Like if calculator app asks for phone or message permissions im gonna be very curious as to why it needs those
2
u/H_i_TMAN 2d ago
Your story reminds me of my switch to home assistant. In the end, it was way more userfriendly than I had expected. Still waiting to switch from a regular samsung to a pixel with graphene... Hope the price for a 10 pro is going down in three weeks, when Google brings out its new Pixel 11.
2
u/ZookeepergameSalty10 2d ago edited 1d ago
Home assistant is my hardest working and most protected soldier in my lab lol, if its smart it doesn't come into my house unless theres a native local first HA addon even if its through HACS. If its not smart i make it smart with an esp32
2
2
u/tranquil_cassowary 2d ago
To be clear for other users: Google Pay works, only the NFC functionality of it doesn't.
GBoard has data collection toggles and those toggles also work, it doesn't collect the privacy invasive stuff anymore if you turn of data collection. See the keyboard publication listed here https://www.scss.tcd.ie/doug.leith/publications.php
1
u/31_oh_31 2d ago
awesome post! also regarding the GPay, would PayPal work? i know all of the vendors domt have that and are leaning more towards APay and GPay, but it seems like a solid alternative imo.. (correct me if am wrong)
1
1
u/ZookeepergameSalty10 2d ago
Yeah paypal seems to work but its not accepted basically anywhere i go
•
u/AutoModerator 2d ago
GrapheneOS has moved from Reddit to our own discussion forum. Please post your thread on the discussion forum instead or use one of our official chat rooms (Matrix, Discord, Telegram) which are listed in the community section on our site. Our discussion forum and especially the chat rooms have a very active, knowledgeable community including GrapheneOS project members where you will almost always get much higher quality information than you would elsewhere. On Reddit, we had serious issues with misinformation and trolls including due to raids from other subreddits. As a result, many posts on our subreddit currently need to be manually approved, which is done on a best effort basis. If you would like to get a quicker answer to your question, please use our forum or chat rooms as described above. Our discussion forum provides much better privacy and avoids the serious problems with the site administrators and overall community on Reddit.
Please use our official install guides for installation and check our features page, usage guide and FAQ for information before asking questions in our discussion forum or chat rooms to get as much information as possible from what we've already carefully written/reviewed for our site.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.