Hacker Newsnew | past | comments | ask | show | jobs | submit | noirscape's commentslogin

Oh that's awesome. Finally the contradiction of buying Google to avoid Google has been resolved for GOS.

I am curious to know how Motorola intents to deal with Google's policies surrounding Android forks, but I'm sure that's a hurdle they know how to cross.


Nobody, because no company is actually pro-customer. Which is fine, the customer and the company's goals don't align beyond "want product" and "supplies product".

The problem is that Amazon abuses it's market position as being the search engine for customer products to unfairly prevent anyone from competing with them. Being "better than Amazon" as a seller in the margins is completely impossible, because Amazon demands sellers price match them.

Let's say you're a seller who wants to make 7$ from each sale as revenue (your actual margins from making the product aren't relevant to this estimate). If you list this product on the Amazon store, Amazon is going to take your listed price and apply their own price cut on top of this (although it's usually framed the other way around, so you list the final sale price and Amazon then says how much they take). For simplicity's sake, we'll go with a 30% cut, so they list it for 10$. Now let's say there's a second storefront you want to sell to, we'll call it Bamazon. Bamazon has a lower cut than Amazon does, let's say it's 10%. So the final product would then be listed for 8$ (taking into account customer psychology on price listings), making Bamazon the better seller, right? The smart customer gets a better deal, Amazon is incentivized to improve their margins if they don't want to lose market share and everybody's happy.

Wrong. What happens instead is that Bamazon will now also list the product for 10$ (because if it's listed lower, Amazon screws the seller by delisting them from Amazon, which is unacceptable for the seller because Amazon is the one with the monopoly position, so the seller then can sell absolutely nothing), making the product equally expensive for the customer and making Bamazon's deal only an improvement for the seller, who now gets higher profits from their sales, screwing the customer. Meanwhile Bamazon is rendered unable to compete with Amazon on their better margins since Amazon is the assumed default. Any benefit of a different store having better margins is fully masked by this approach, only benefiting Amazon.

It's a Most Favored Nations clause and their use on online platforms is both ubiquitous, scummy and makes things more expensive for the customer while also entrenching Amazon's monopoly position. This crap is usually couched as pro-customer rethoric, but it really isn't. It mostly serves to entrench monopolies not on their quality, but through their existing market share. (Valve also famously does this by the way.)


Just a heads up, since no company is pro-consumer, and I assume you know what it is to be pro-consumer, if you started a truly pro-consumer business, you would put all the others out of business.

Just think about that.

Ironically, a large part of Amazon's rise was on the back of their very pro-consumer policies. Not many companies would tolerate large scale GPU return fraud (among other items) for those many years for example.


That's a very simplistic take because it assumes full transparency for all consumers - all while advertising, one of the biggest industries in our society, explicitly allows companies to turn the money they make from consumer-hostile behavior into additional reach, and even worse: all while large companies and VCs keep buying up pro-consumer businesses and enshittifying them.

Trust me, the simplistic take is "All company's are bad, and have ill intent"

Their take is simplistic, but yours is worse.

Some companies have good intent. Public benefit corporations are a thing. They aren't really relevant, because unscrupulous companies outcompete them.

Your assertion that pro-consumer companies would outcompete unscrupulous ones depends on consumers and regulators holding them accountable. So why are you arguing against being suspicious of companies?

Obviously the best strategy for companies is to appear to be pro-consumer, but "cheat" (meaning price fixing but also things like advertising and buying up competitors) as much as possible. In that context, "all companies are anti-consumer" is a decent shorthand for "you should assume every company is anti-consumer because the regulatory environment favors it, even if there are exceptions."


Well for one, Servo isn't just JavaScript, it's an entire engine. Closer to Blink & Gecko.

Secondly, Ladybird wants to be a fourth implementor in the web browsers we have today. Right now there's pretty much three browser engines: Blink, Gecko and WebKit (or alternatively, every browser is either Chrome, Firefox or Safari). Ladybird wants to be the fourth engine and browser in that list.

Servo also wants to be the fourth engine in that list, although the original goal was to remove Gecko and replace it with Servo (which effectively wouldn't change the fact there's only three browsers/three engines). Then Mozilla lost track of what it was doing[0] and discarded the entire Servo team. Nowadays Servo isn't part of Mozilla anymore, but they're clearly much more strapped for resources and don't seem to be too interested in setting up all the work to make a Servo-based browser.

The question of "why not use Servo" kinda has the same tone as "why are people contributing to BSD, can't they just use Linux?". It's a different tool that happens to be in the same category.

[0]: Or in a less positive sense, went evil.


> Well for one, Servo isn't just JavaScript, it's an entire engine.

Notably Servo doesn't have it's own JS engine at all. It uses Rust bindings to SpiderMonkey.


It's not related to Chinese in specific, but in civilian air traffic, the lingua franca is specifically English[0]. The reason for this is because other languages leave too much room for interpretation. One incident not mentioned in that page that's worth bringing up is Korean Air Flight 801; the crew recognized an issue with the instruments quite a bit before the crash, but because the flight crew essentially was too polite in notifying the captain of the issue, the captain instead asserted authority with incomplete information, leading to the plane crashing[1].

Language specificity and cultural encoding in those languages can have a pretty major impact on its clarity, especially in critical situation. Speaking a secondary language instead can avoid that sort of thing simply because being a non-native speaker, you'll be a good deal more blunt in that language.

[0]: https://en.wikipedia.org/wiki/Aviation_English

[1]: https://en.wikipedia.org/wiki/Korean_Air_Flight_801


Malcolm Gladwell's description of that accident and amplification is simplistic and not very accurate. There were many errors made that caused that accident, including ATC failing to follow protocol.

English is the language of aviation because in 1951 the countries with the most living pilots and aircraft spoke English. It is not because of any trait particular to English.


But that's more psychological than linguistic: The Korean language could certainly express, "we're about to crash"; and a foreigner in that cockpit would certainly have found a way to be more direct. It's much easier to break social restrictions in another language.

It's just that pilots have no capacity left to be fluent in every languages everywhere. You don't avoid ambiguity speaking in the second language in a critical situation, you just incur significant responsiveness plus bandwidth penalty.

There are few recordings of aircraft emergencies over Japan on YouTube. Two obvious things in those recordings are that local pilots drop pretense of speaking Engurish in almost any non-normal conditions, and that local ATCs are dangerously useless outside of normal conditions. There's nothing visibly helpful from using English in there.


Oh that's really cool! I hope it alleviates some pressure on the DERP servers, whenever I notice the connection on tailscale is bad, it's usually because the device is connecting over DERP.


GOS creates a complete bunker of a phone that can provide defense against pretty much all but the most dedicated state level actors. If you're worried that someone would steal your phone specifically to target you, Graphene will protect against that. Securitywise it's hard to argue against them, although GOS tends to sacrifice usability in favor of security, which leads to odd decisions. Their device depreciation timeline is also pretty aggressive and really just matches that of the Pixel. (You're also buying the Google phone... to not want Google in your life; this bizarre paradox will always be strange). It's not exactly a recommendation for long-term support. Worth noting however is that usage of GOS is also seen as a signal in and of itself for the authorities that you may have something unsavory to hide, so using it stands out in that regard; some law enforcement officers (I think it was in Spain?) have said that the OS is popular with organized crime. GOS obviously denies the connection and they're probably honest in that the OS isn't deliberately designed for criminals, but it's worth noting at the very least. (Basically GOS is the paradox where someone trying their hardest to be anonymous ends up standing out way too much from the crowd and drawing attention to themselves.)

/e/OS (and similar "non-LineageOS" ROMs really) instead focus more on de-Googling. They're still generally security focused, but the priority is less "someone's after you" and more "corporate surveillance is kinda scary innit". The aim is less to avoid someone actively trying to drain your phone of data and more to prevent your phone from passively sending everything it can possibly find to the Big G's ad machine (as well as whatever other trackers get snuck into apps.) Because of this, they usually have better depreciation timelines and support a lot more devices compared to GOS who only support the Pixel line (which is an increasingly awful set of phones truth be told); their scope is much smaller.

Finally, it's worth noting that the GOS community is absurdly toxic to anyone doing anything privacy-related that isn't under the banner of GOS. It's extremely maximalist, tends to get very upset at other projects whenever they get attention (see sibling reply to this, where they pretty much melted down because an outlet dared to recommend a Fair phone+/e/OS) and the projects official channels have generally encouraged this sort of behavior. It doesn't really damage the software itself, but it's worth considering.


I have been a user of /e/OS for 5 years, and also of GOS and would like to share my opinion on this:

> it's worth noting that the GOS community is absurdly toxic to anyone doing anything privacy-related that isn't under the banner of GOS

What I have seen (and I am not involved in any of those projects) is that GOS does care a lot about security, has a higher quality in that regard than anything else, and tends to be blunt about "inferior" projects communicating about security.

Not that they couldn't improve their communication style, but usually when they call out technical limitations of other projects (e.g. /e/OS), they are right. And I mean the technical arguments. Then I have seen a bunch of drama, but to be fair I have seen those other communities show toxic behaviour towards GOS just as much as the opposite.

It feels like it is GOS vs "the others", because the others don't criticise each other, and GOS bluntly criticises when they see claims they find are wrong (I have seen claims by /e/OS going from misleading to downright wrong).

On my particular phone, after 5 years with /e/OS, the Fairphone updates were outdated by 4 years. In terms of security I would have been better with the Stock Android. It depends on the phone of course, because /e/OS tends to claim that they support everything and they just can't. Even on a phone that /e/OS supports well, GrapheneOS is superior, period.

But I agree, I could do without all the drama. I guess my point is that it goes both ways.


I'm also not involved with any mobile privacy/security project, unless OpenStreetMap data and self-hosting can be said to be such

> GOS does care a lot about security, has a higher quality in that regard than anything else, and tends to be blunt about "inferior" projects communicating about security.

Two remarks:

- There's a difference between "blunt" and hostile or misleading. GOS (owners) are often the latter two from what I read, where by misleading I mean distorting reality about whom you should be protecting from and recommending you should never use anything else to reach your goals (as opposed to GOS' goals)

- They also reply when privacy comes up in other projects, not just security, but they treat it as though it's essential for privacy. Not everyone is running from an intelligence agency or cellebrite border checkpoints, some people just want a phone with as many open components as possible or want to lie to Facebook about which contacts are on their device. You don't need a locked bootloader and be prevented from accessing your own data for that (can't access /data on your own device on any official GrapheneOS build; which is fine if that's what you want, but not everyone's goals are the same)


>Not everyone is running from an intelligence agency or cellebrite border checkpoints

OK, but would it be such a bad thing if most people's personal devices were pretty damn resilient to mercenary spyware by default? I really don't think the standards GrapheneOS are aspiring to are the problem with this picture.


Certainly not, but there's more goals than singular security from government agents at all cost

With the current mobile OS landscape, getting away from ubiquitous overseas dependencies, constant tracking, and closed-source mandatory apps is, to me, much more direct-impact than protecting against this extremely remote chance of having an exploit, customised to my software stack, finding its way onto my device somehow. I'd much rather have the freedom to do with my hardware what I wish

Some people will prefer one thing, and other people another. Neither is a bad choice if it fits your goals and you know the risks of each one. So what I'm saying (and seem to be repeating over and over and over in any graphene fanboy thread) is that it's a choice, not a one-size-fits-all, and not a foregone conclusion (as GOS authors pretend it is, which this subthread started with)


/e/OS/ was bad with updates for a long time (I had to switch 2022). IodéOS is very good at it, in my experience (I have used all three)


> /e/OS/ was bad with updates for a long time (I had to switch 2022).

In my case, it was a few months ago, so end of 2025.

I think it's just that they can't possibly support thousands of Android devices. I just don't like that they are not being very clear about it. You would think that buying a phone through Murena would guarantee some kind of support, but it actually doesn't.


iodéOS lags far behind on Android, Linux kernel, browser engine and other updates too. It's much less behind than /e/ and misleads users less but they still do. They set an inaccurate Android security patch level which misleads users just as /e/ does.


I didn't know. Do you have a link to one specific announcement where they mislead people about the patch level? It would help to start a conversation to change that.

The patch level they set in the operating system is consistently inaccurate. They raise the patch level based on applying a subset of the AOSP patches without the full set of patches including being missing kernel, driver and firmware patches.

I guess on /e/OS you can just run Google Maps in a browser if you really want Google Maps features (like searching for a restaurant). Organicmaps works fine if you just need to get from A to B. It does lack live traffic, but you'll have to live with fewer features if you really want to not use Google for most stuff.


> Organicmaps

I would suggest having a look at CoMaps, a recent fork of OrganicMaps :-).


The founder and CEO of /e/ and Murena openly spreads content from Kiwi Farms and neo-nazi sites. He directly engages in harassment towards the GrapheneOS team. Here's him supporting authoritarians smearing GrapheneOS by replying to threads about it linking to harassment content based on fabrications on a neo-nazi conspiracy site:

https://archive.is/SWXPJ https://archive.is/n4yTO

The communities of several projects including /e/ have heavily engaged in spreading misinformation about GrapheneOS including fabricated stories about our team. They've even taken it to the point of repeated swatting attacks aimed at killing our team members. There are relentless raids on the GrapheneOS community platforms including our chat rooms where Child Sex Abuse Material, gore and endless harassment towards our team members including fabricated stories and harassment content from Kiwi Farms and elsewhere is posted.


Extraordinary claims require extraordinary evidence.

I find it very hard to reconcile claims like "repeated swatting attacks aimed at killing our team members...Child Sex Abuse Material..." with the proof offered being a blog post that makes the fairly anodyne (especially read in light of this comment) case that you are an extremely paranoid person whose paranoia leads you to extreme judgements that may harm users. If you are the target of extreme attacks, it seems far more plausible to me that those originate from state actors and security adversaries, rather than from erstwhile allies also trying to build better mobile OSes.

Rather than reading this as "harassment", I would suggest you should try to take it as constructive feedback: You do not play well with others and your prickly interpersonal demeanor hampers the adoption of what is (by all accounts) technically strong software.


> Extraordinary claims require extraordinary evidence.

It's your claims which are extraordinarily and have been thoroughly debunked. You're directly engaging in bullying with baseless personal attacks. You make false accusations about us while you're actively engaging in those things.

> I find it very hard to reconcile claims like "repeated swatting attacks aimed at killing our team members...Child Sex Abuse Material..." with the proof offered being a blog post that makes the fairly anodyne (especially read in light of this comment) case that you are an extremely paranoid person whose paranoia leads you to extreme judgements that may harm users. If you are the target of extreme attacks, it seems far more plausible to me that those originate from state actors and security adversaries, rather than from erstwhile allies also trying to build better mobile OSes.

It's very easy to see that the site which was linked is a neo-nazi conspiracy site. Gaël Duval knew that when linking to it. Gaël Duval has repeatedly spread harassment and libel content from Kiwi Farms and elsewhere. He has linked to the same harassment content linked in the post. Both of those videos are from Kiwi Farmers and one of them participates on the site with an account in their real name which received identity verification. They openly use the site as their personal army and were the one to involve them.

Duval very clearly knows that he's directing his community to target our team with harassment by spreading fabricated stories about us. Anyone can take a look around the site which was linked and see a whole lot of the paranoia and delusion you falsely attribute to me with no basis. Duval is opportunistically spreading harassment content to benefit his for-profit business for the same reason he has heavily invested in spreading misinformation about GrapheneOS.

Duval is not an ally. He's a grifter selling phony privacy products with dramatically worse privacy and security than an iPhone. They're scamming people with false marketing for their products. The supposedly private speech-to-text service from Murena actually just sends user data to an OpenAI service vs. iOS and GrapheneOS doing it locally which is very representative of their overall approach to the apps, services and OS.

https://community.e.foundation/t/voice-to-text-feature-using...

https://discuss.grapheneos.org/d/24134-devices-lacking-stand...

GrapheneOS is the only open source privacy and security hardened mobile OS based on AOSP in practice. Products using privacywashing for marketing aren't in the same space. They're not allies but rather the misinformation they propagate and the attacks they make on our team are extremely harmful to us. They're the main adversaries. Companies like Microsoft tend to be very friendly to us and open to collaboration vs. these small companies building a business around false marketing who feel very threatened by us so they engage in spreading misinformation and personal attacks on us. Claiming that it's state sponsored is ridiculous. It has been ongoing since long before GrapheneOS had significant adoption and has always been primarily caused by companies who feel threatened by GrapheneOS trying to harm it. Multiple companies have engaged in it because it's very convenient for them to hop onto the existing bandwagon of fabrications/harassment started in 2018. The privacy and security industries are filled with charlatans and scams. We have good relationships with a bunch of legitimate privacy and security projects including QubesOS, secureblue, Molly, Accrescent and MANY others. It's these companies selling supposedly private/secure phones which are in reality not very private and extraordinarily insecure where nearly all the attacks originate from.

> Rather than reading this as "harassment", I would suggest you should try to take it as constructive feedback: You do not play well with others and your prickly interpersonal demeanor hampers the adoption of what is (by all accounts) technically strong software.

It's libelous harassment content based on fabricated stories. You're claiming it's not happening while directly engaging in it. You're making the ridiculous claim that it's from state actors while the actual perpetrators are plainly visible and include yourself. It's the community around /e/ and several other projects which are extraordinarily toxic and engaging in harassment. Our community and project doesn't do it. You folks cross-reference your libel, bullying and harassment content entirely based on making up stories, personal insults, etc. while claiming a bunch of fabrications referencing each other is evidence. Calling me paranoid, delusional, etc. with no basis is nothing more than sociopathic bullying. Hacker News moderators shouldn't be allowing it.


Please print out this comment and the one that preceded it and show it to a friend you trust to be honest. You should seek therapy, and it will make you a more effective technical leader.


I'm surprised Graphene foundation haven't banned or heavily restricted Daniel Micay from publicly representing GOS. He's fine when he's providing product updates and technical information but he absolutely needs to see a therapist. I know he's been told this a million times and I'm not sure if he takes it serious enough. If he doesn't do something about this behaviour, his spiraling will be the downfall of GOS.

> /e/OS (and similar "non-LineageOS" ROMs really)

LineageOS is degoogled unless you install google apps as a deliberate choice, so I don't really see any advantage or /e/OS or Murena over it.


It's a misconception that GrapheneOS is focused on security over everything else. It's a privacy project and privacy depends on security so it heavily focuses on both. It also provides major privacy improvements on a technical level rather than only avoiding privacy invasive apps and services. Privacy involves a lot more than which apps and services are bundled with the OS, contrary to how most supposedly private phone options are marketed.

> Securitywise it's hard to argue against them, although GOS tends to sacrifice usability in favor of security, which leads to odd decisions.

GrapheneOS doesn't make any major usability sacrifices for security. Privacy or security features with usability compromises are either opt-in or opt-out.

> Worth noting however is that usage of GOS is also seen as a signal in and of itself for the authorities that you may have something unsavory to hide

GrapheneOS is far more widely used than most alternate mobile operating systems and there's a lack of basis to claim that it's widely seen in the way you're describing in a way that other operating systems are not. In fact, they're largely conflating other operating systems with GrapheneOS because it's the most widely talked about and known about. They're calling devices GrapheneOS devices which aren't running it. In many cases it's not even a fork of it.

> have said that the OS is popular with organized crime

This is completely unsubstantiated and not evidence has ever been provided. On the other hand, it's known that law enforcement in Europe has widely sold devices to organized crime which they marketed by claiming they were based on GrapheneOS:

https://darknetdiaries.com/episode/146/

Using portions of our code doesn't make something GrapheneOS and marketing is also a different thing than reality. Most of what's claimed to be GrapheneOS in this context is not GrapheneOS but rather trademark infringement by forks or even non-forks.

> /e/OS (and similar "non-LineageOS" ROMs really) instead focus more on de-Googling.

Nope, /e/ always connects to multiple Google services regardless of configuration and gives highly privileged access to them. GrapheneOS doesn't connect to Google servers by default and avoids giving privileged access to installed Google apps via our sandboxed Google Play compatibility layer.

> They're still generally security focused.

No, that's definitely not the case. /e/ has absolutely atrocious security and fails to provide even basic security patches and protections. This is also part of why it provides poor privacy due to lagging far behind on privacy patches in addition to security patches along with being missing important standard Android privacy and security protections due to being far behind and not having it all set up. /e/ doesn't provide comparable privacy features to GrapheneOS Storage Scopes, Contact Scopes, Sensors toggle and far more not only the security features. /e/ isn't just not a security hardened OS, it's also not a privacy hardened OS. LineageOS has better privacy and security than /e/. AOSP has better privacy and security than LineageOS.

> Because of this, they usually have better depreciation timelines

/e/ doesn't provide proper updates for any devices. Many of the devices they support aren't getting driver and firmware updates from them even when they're available. They lag far behind on kernel, Android, Chromium (including WebView) and other updates too. They support many devices without kernel, driver and firmware updates available but they're usually way behind even when they are. /e/ simply doesn't care about providing basic privacy and security so they continue having people buy and use highly non-private and insecure devices lacking basic patches.

> Finally, it's worth noting that the GOS community is absurdly toxic to anyone doing anything privacy-related that isn't under the banner of GOS. It's extremely maximalist, tends to get very upset at other projects whenever they get attention (see sibling reply to this, where they pretty much melted down because an outlet dared to recommend a Fair phone+/e/OS) and the projects official channels have generally encouraged this sort of behavior. It doesn't really damage the software itself, but it's worth considering.

No, completely backwards. The massive amount of false marketing, misinformation and harassment engaged in by the /e/ project and community is what's toxic. The founder and CEO of /e/ and Murena openly spreads content from Kiwi Farms and neo-nazi sites. He directly engages in harassment towards the GrapheneOS team. Here's him supporting authoritarians smearing GrapheneOS by replying to threads about it linking to harassment content based on fabrications on a neo-nazi conspiracy site:

https://archive.is/SWXPJ https://archive.is/n4yTO

The communities of several projects including /e/ have heavily engaged in spreading misinformation about GrapheneOS including fabricated stories about our team. They've even taken it to the point of repeated swatting attacks aimed at killing our team members. There are relentless raids on the GrapheneOS community platforms including our chat rooms where Child Sex Abuse Material, gore and endless harassment towards our team members including fabricated stories and harassment content from Kiwi Farms and elsewhere is posted.

People should review https://eylenburg.github.io/android_comparison.htm which is a third party maintained comparison between AOSP-based operating systems which addresses many of the misconceptions you have about how GrapheneOS compares to AOSP, /e/ and other operating systems. You're not at all correct about what's provided by /e/ which fails to keep up with basic updates or provide the standard protections.

We can provide large amounts of further examples of the founder and CEO of /e/ and Murena participating in this harassment.

The attacks towards us including your libelous claims about us here are what's absurdly toxic.

> It's extremely maximalist

It isn't but rather is very pragmatic and focused on usability, robustness and compatibility alongside the major focus on privacy. The focus on security is to protect privacy because it depends on it.


Given I don't disagree with you about GOS being the best on security, I think there's only one thing really worth mentioning:

> The attacks towards us including your libelous claims about us here are what's absurdly toxic.

I want to make this clear upfront: I have no connection to /e/, Calyx, DivestOS or whatever other projects you've had issues with over the years. If you've had trouble with them I find that very unfortunate for you, but they are entirely unrelated to this conclusion. I do not consider these claims to be libelous when they're fairly easy to check:

The reason I consider GOS' community to be extremely toxic and find official channels enabling this is for a few very simple reasons:

1. I've seen several incidents of GOS users coming into adjacent Android communities to start beef with those communities while giving off the attitude of zealots. For a concrete example, the F-Droid forums have a thread about Googles impending changes to letting users install their own software ( https://web.archive.org/web/20250903081432/https://forum.f-d... ). The original OP for this thread has a pointless attack on the F-Droid project, declaring GOS to be superior. Moderators eventually changed this to be more mild (but it's why the first replies are snarking on low-hanging fruit about GOS), but I've seen similar behavior in other places - there's a reason that a lot of Android communities generally respond with trepidation and annoyance whenever the project is brought up and it's because of this behavior from the userbase.

2. I can read the GrapheneOS forums; they're public. Nearly every issue I've seen people have with GOS on the forums is effectively met by a "you're holding it wrong". This sets a tone for the community that makes it come across as extremely hostile to potentially interested users.

3. In the same sense, it's trivial to notice that the official GrapheneOS account on this forum is a frequent participant in these discussions, generally backing up the hostility on the virtue of technical accuracy. This to me suggests endorsement of this attitude. (See a sibling to my initial comment where the official account makes a post on the GOS forums about an unrelated blog for daring to recommend a different ROM/phone combo. This to me is not indicative of healthy communications, but rather of an obsession to promote GrapheneOS at every corner.)

4. I remember, as a Bromite user, the futzing with the Vanadium license in order to prevent other Android Chromium forks from making use of it's patches for the crime of... considering a contribution from someone the GOS project has beef with. That to me is the most telling thing really. The goal with that license futzing was never to actually help advance privacy/security or anything like that. It was to try and force a different project to conform to GrapheneOS' demands over something extremely minor and GOS went ballistic and threatened license changes (which they eventually did) the moment the maintainer asked for a bit more information because "GOS doesn't like this person" isn't enough to immediately warrant kicking someone off a project. Cromite (the fork of Bromite, as Bromite's maintainer went AWOL) still doesn't include Vanadiums hardening patches because of this. It's fucking absurd.

4 is the big one for me. It is absolutely unacceptable, unbecoming and to put it plainly: toxic behavior from an official voice in the project. It's fucking rich and borderline hypocritical to talk about GOS' consistent upstreaming of Android hardening patches while making it impossible through a license change for other projects to share it's contributions.

(Here's a source for that btw; https://github.com/bromite/bromite/issues/2141 and https://github.com/bromite/bromite/pull/2102 for the original incident. csagan5 essentially got jumped with extreme hostility for something they couldn't have been aware of and was very reasonable about, and all they got in response was more threats and hostility.)


It should be possible to redact names from cases for that purpose.


I think a product focus does exist: Element seems to be a genuine attempt to fully assemble Matrix as one full project. The problem is that it feels like the Element devs are stuck wanting to have their cake and eat it too.

There's some design choices in Matrix that don't really "fit" with what modern messaging infrastructure looks like. (Which to summarize it pretty quickly is a Slack/Discord-esque model, where non-sysadmin users get to fully administer their own spaces, with an expectation for multiple different channels, control over user permissions and user access and so on and so forth.)

Some of these come from the fact that Matrix is pretty blatantly just designed as "what if IRC, but slightly more modern". It's main unit for non-sysadmin moderation is a single channel, with the expectation that one instance of Matrix will never have two channels named #general (as an example). Similarly, it's entirely possible to kick users from a channel... but then have that exact same channel continue independently on a different instance, but under a different label. This makes sense if you look at it as "supercharged IRC", but becomes a complete and utter mess when you factor in things like the encryption between two servers suddenly disagreeing with each other (leading to a bunch of old messages becoming unreadable), content moderation (barely an issue on IRC because message retention is expected to be almost entirely clientside) and so on and so forth.

Element/synapse's people do try to provide for these cases, but you're effectively stuck trying to prod at admin API endpoints, bots to synchronize moderation decisions and they have like 3 different "channel grouping" that's supposed to be their version of the Slack workspace/Discord guild model.

Honestly though, I'm pretty sure that once XMPP gets a proper multi-user multi-channel XEP going (there's one in draft right now which specifically tries to provide workspace-esque support; it's possible to do this already but it's a sysadmin XEP, the proposal aims to give this capability to regular users), it'll just end up blowing Matrix out of the water entirely for most usecases. Unlike Matrix, it's a far more mature protocol that's a lot easier to work with and actually has many different implementations that you can choose from.


Room addresses/aliases (like #matrix:matrix.org) must point to a single room (in fact, they point to a room version, so when rooms are upgraded, addresses must be pointed towards the new room). But for communities, a better way to organize the rooms would be spaces. Spaces can be joined. Spaces can contain rooms and other spaces. Like discord "servers" (guilds), but more flexible.


Basically in the EU, you usually have an ID card (or a passport/driving license/visa card, they're recorded on all of those too) that has a combination of a citizen ID and a document ID. Both of these details are combined considered to be "you" for the purposes of anything to do with the government. The government has a registration of every citizen ID+document ID combination and knows as a result what documents are in circulation. They're technically not required in most of Europe, although you must be able to procure one at request for legal reasons (ie. getting your employment properly sorted, opening a bank account, or a law enforcement official asking for your identity). Revoking a combination is as easy as getting a new ID card/passport since the combination is what counts. ID documents also usually expire eventually, so there's also an inherent time limit to what a leaked combination can cause issues with.

They're also as I understand it, used to handle things like sending everyone voter IDs for elections in advance; this is how the government knows who to send the voting cards to.

Bafflingly, the US does NOT have a national identification method that works like this. There's no country-wide identity document that provides the same assurances. As a result, most US entities (government branches & corporations) have settled on a "closest possible"... which is the social security number. A number that's used to identify every person with attachment to the US in some form since social security is something every US citizen has to interact with. (It also includes a ton of non-citizens since as I understand it, social security is something foreign workers also have to interact with, but that's besides the point.) It's a 9 character long numeric string that identifies you as a person... and has almost no revocation mechanism, even if it ends up in a data breach.

Yet in spite of this, it's still used as a country-wide ID mechanism for a lot of different things and replacing it with a proper ID mechanism has as I understand it (not American) very poor support as it's a culture war issue.


Wrote about present day reasons to dislike systemd a few days ago on HN, which encompasses most arguments of actual substance[0] (tldr: Unix philosophy, it homogenizes distros and it may be too heavy for some low-resource environments).

Historic reasons mostly come down to systemds developers being abrasive jerks to people. Systemd has some weird behavior choices that only really make sense from the perspective where every computer is a desktop; ie. it terminates all processes spawned by a user when logging out unless they were made in a specific way with systemd-run. This makes sense on a desktop - users log out, you want everything they did to be cleaned up. On a server it makes less sense, since you probably want a tmux/screen session to keep running when you sign out of your ssh session (either by choice as a monitoring tool, or alternatively because you have an unstable connection and need a persistent shell).

Every downstream distro got surprised by this change[1] and nowadays just ships a default configuration that turns it off, because upstream systemd developers weren't interested in hearing the complaints.

Most of these footguns have been ironed out over the years though.

There's also some really dumb arguments to dislike systemd, most of which just can be summarized as "people have an axe to grind with Lennart Poettering for some reason".

[0]: https://news.ycombinator.com/item?id=46794562

[1]: It was always available, but suddenly turned on by default in an update.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: