Hacker News
points by glenstein 2 days ago | 0 comments
As some who also just so happens to have a Pixel 8 (well 8a) 2nd hand phone with Graphene I think an underappreciated point here is access to older hardware with current software. Whether intended or not, a second life for hardware is another way GrapheneOS insulates from control of first party vendors.
[–] grapheneos 2 days ago
Pixel 8 and later have 7 years of support from launch and so does the Motorola Signature 27. It isn't GrapheneOS extending the life of the devices but rather GrapheneOS only using devices with long term security updates. We do greatly improve the security updates during the lifetime of the device but it stops being safe to use devices without firmware updates after end-of-life. Official GrapheneOS releases are for devices which aren't end-of-life. We provide extended support releases for devices past end-of-life as harm reduction, but we don't do it indefinitely. We've found providing extended support releases can be quite counterproductive since people won't listen to us and will continue using or even buying the devices despite growing insecurity. It's going to be a lot worse now with AI models able to help anyone develop exploits.
[–] mixtureoftakes 2 days ago
Hey just curious, to what extent you using ai to help with proactive exploit discovery?
[–] grapheneos 2 days ago
We use frontier AI models to review all our code but it hasn't replaced human review and humans need to review the output from it. It adds significantly more work and has resulted in a lot of issues being fixed.

We're not currently putting a large amount of resources into finding Linux, AOSP or Chromium vulnerabilities this way because many others are doing it with far more resources including Google. There are much higher impact things for us to focus on instead. Our focus remains systemic privacy and security improvement rather than case-by-case fixing of bugs. We definitely do that much better through shipping Linux and Android patches much faster than the Pixel OS along with fixing many issues ourselves but it's not our priority for the most part. Certain parts of it are priorities such as finding and fixing VPN leaks because Google doesn't consider it to be a relevant security issue.

[–] charcircuit 2 days ago
GrapheneOS limits their support length to the original device so that it's always possible for new security updates to be available.