Linux-fueled Thoughts Unhinged

Some ideas from the GrapheneOS account on Twitter were interesting to look at (whenever it's not Daniel Micay railing against CalyxOS, F-Droid, and anyone else related to CalyxOS).

Trezor hardware wallet

The following is a matter of trust, not a technical analysis.

Allegedly, according to this tweet,

Trezor's board design, firmware and software are all open source.

So, I may consider using the Trezor hardware wallet with the officially supported Trezor Suite application... whenever I get to using actual cryptocurrencies (which will not come for some time).

Support for Monero is on the project's radar, but is still not here yet.

I was hoping that Kastelo would take off, but considering that its homepage has an outdated certificate that is not valid anymore for HTTPS and its last date of copyright is in 2018, I am not too optimistic anything will happen soon. Also, the latest commit to the master branch of Kastelo on GitHub (as of the time I am writing this) is from January 2020.

Pixel hardware is good for GrapheneOS's purposes

The Pixel lineup from Google is actually pretty based, compared to most other Android hardware manufacturers in 2022.

This paradigm shift happened when the Pixel 1 and Pixel 2 started out with hardware based security improvements. I do not recall what the specific details were, but Google is definitely starting to show its prowess with respect to hardware security.

Nobody can seem to articulate this point (not even Michael Bazzell, Henry from Techlore, or Nate from The New Oil), but this is the summary of my one sentence TED talk: using the Drakeposting meme, caption the top rejection half with “Google, the privacy violating spyware cloud service provider” and the bottom approval half with “Google, the locally secure hardware manufacturer”.

Anyways, for whatever reason, Google allowed alternative OS's to be installed onto the Pixels, starting with the Pixel 2 line, while still preserving the security model of Verified Boot. If you ask me, this is a technical misstep of Google to becoming unstoppable as a Big Tech giant... but then again, I would not be surprised if Google did this so that the non-tech literate masses that mostly comprise of the legal system cannot definitely and without a doubt charge Google under the current (albeit already broken) U.S. legal system of being a monopoly.

C.f. part 1 and part 2 of this tweet thread to see the qualitative conclusions (because Nitter cut off this long branch of this tweet thread).

Small lesson on discussing the Linux kernel

According to this tweet, Google's own silicon (a.k.a., custom semiconductor/processor in the Pixel line, starting with the Pixel 6) will allow Google to guarantee 5 years of OEM security, Android OS, and firmware updates. Part of this promise will be upheld and achieved by moving the “LTS” Linux kernel that Android is based on from one LTS version to the latest LTS version. Currently the latest LTS or “long term” version is 5.15 and the prior version is 5.10 (as of the time of writing this).

(For reference, Qubes OS is based on the Xen hypervisor, but still needs the Linux kernel to run Linux-based qubes. Currently, Qubes OS 4.1.1 is using Linux kernel 5.15.)

This has been pretty much unheard of from even a high level technical overview, since most Android devices basically come with a fixed Linux kernel and are never given any OEM updates after 2-3 years — let alone an entire LTS Linux kernel upgrade. Do not even go to the topic of Android fragmentation if you are going to have a naïve opinion, like a “(consumer) tech journalist” from The Verge, then please educate yourself on how an out-of-date Android device from a convenience store could be accidentally and ironically more secure than an iPhone for targeted attacks, which Snowden briefly mentioned after the NSO's Pegasus malware story broke in mid 2021.

In a way that iPhone midwits will never understand, Android's fragmentation ironically makes Android devices overall slightly more secure than the iOS monoculture that is susceptible to a central point of failure — sort of like GMO monoculture crops or how royal families with very little genetic diversity are susceptible to recessive genetic disorders.

(Firmware and OS updates are much more intertwined on a qualitative standpoint for ARM and other system-on-chip/SoC systems than X86_64/amd64 processors used for personal computing devices.)

Arch Linux tries to stay as close to the latest/current “stable” release of the Linux kernel.

Finally, do not be objectively insane and attempt to use the “mainline” kernel, which is version 6.0, or linux-next, which could be similar to using a *-git VCS package from the AUR.

GrapheneOS for the Pixel Tablet?

GrapheneOS could be coming to the Pixel Tablet.

• Tweet 1, indicating that earlier version of the Android Hardening Project supported the Nexus 9
  • Do not believe Micay when he says that GrapheneOS was started in 2014 — that project was actually CopperheadOS. I do not recall seeing anything mentioning the Nexus 9 when I first started looking into GrapheneOS during late 2019 — the Pixel 2 is the oldest device I remember being mentioned on the GrapheneOS website.
• There used to not be any advantage that Google's hardware offered compared to OnePlus devices — but that was before GrapheneOS took off. Since then, OnePlus has become “just another ripoff phone company” and Google started putting the Titan security chip in its phones (and now all of the Pixels after the Pixel 6 series come with the Tensor SoC). Yes, the hardware designers never had any sort of microSD card slot, but there's literally no hope for the long-term future of the Pixel line, since now the Pixel 6a has no headphone jack anymore. This move is as tragic as IBM selling the ThinkPad line to Lenovo.
• Tweet 2 indicates that GrapheneOS is not likely going to support the Pixel Watch, since a smartwatch OS is designed very differently than a smartphone or tablet OS.