722 comments

wps12 days ago
The amount of roadblocks Google is putting up for GrapheneOS is just ridiculous. None of their decisions make any sense, from the delayed source patches upstream, to the embargos, attestation issues, etc. Google simply regrets android being open source.
godelski12 days ago
I hope people remember this when advocating for chromium. Just because it is open source doesn't mean they don't control it. We need to start the long process of hard forking now or turn to alternatives like Firefox as a new foundation.

  > Google simply regrets android being open source.
Android wouldn't be what it is if it wasn't open source. With all the work from outside Google. The same is true chrome.

But they won't learn that on their own. They are breaking the deals. So we move. We force their hand

saghm12 days ago
> But they won't learn that on their own

I think they're fully aware of this. They just don't care, because the goal of "get market share super high" has been reached, so now they have no need for it to continue being open.

I don't disagree about what that means we should do; I just don't think we should assume they're being naive here. It's like writing a program to play chess; you should select your move assuming the opponent is smart and will make the optimal counterplay rather than assuming weakness, and then if they end up being less smart than that, you're still in a good place.

StilesCrisis12 days ago
Hard forking doesn't solve the problem of closed source.

If the goal of a hard fork is "the community will invest equal resources that Google does today" then you wildly underestimate how many engineers work on Chrome.

arcanemachiner12 days ago
> Android wouldn't be what it is if it wasn't open source.

Yes, and now that they've achieved market saturation, it's time to pull up the ladder.

Thanks for all the free work, suckers!

cecexacjrgec12 days ago
> or turn to alternatives like Firefox as a new foundation.

With the way Firefox is heading, that might not be the best idea. Nowadays Mozilla seem more focused on riding the AI-hype wave than actually making an excellent browser people want to actually use.

faust20111 days ago
> I hope people remember this when advocating for chromium. Just because it is open source doesn't mean they don't control it. We need to start the long process of hard forking now or turn to alternatives like Firefox as a new foundation.

This is correct but rarely in practiced.

During firefox DRM/HTML5 issue, I know many people from Free software foundation Europe absolutely telling in their blogs, talks etc please stop Mozilla from implementing this DRM or that... but finally when I spoke to these in private they told --- ya, whatever - I need to see this series in netflix etc- so I have another device with chrome etc to watch it. (Indeed Firefox did implement it)

This behavior is the reason average Joe gives up...

773412812 days ago
It's not a regret. Android would never have been popular in the first place if it had not been open source. If phone makers had been able to anticipate how much the demons at Google would be able to lock down the Android then they would never had used the OS back in ~2009.
thevillagechief12 days ago
I don't think this is actually true. Phone makers seem happy to have the platform locked down even further. They're putting even more roadblocks, as evidenced by most of them making bootloaders unlockable.
sublinear12 days ago
No, everyone knew what they were getting into with Android. It wasn't taken lightly by the power users of the time either. I still have a phone somewhere with Ubuntu Touch on it. I really was hoping that would be my phone OS by now. Not that Canonical isn't capable of similar, but that it would bring about acceptance of Linux phones.

I think we're all more surprised by how long it took for Google to make these bad moves. For a period of time in the 2010s we actually started thinking maybe Google was alright.

mrpippy12 days ago
That’s possible (never underestimate the bad decision-making of phone makers), but what would they have done instead? Windows Mobile 6 was the only licensable alternative, but it was a known quantity and obviously a generation behind Android and iOS.
alightsoul12 days ago
Phone manufacturers had Symbian which became open source
ikiris12 days ago
It didn't become a major regret really until the antitrust treated android as a competitive space and iphone separate. That decision led to a lot of wtf and tactics changing. Because the platform had been made open it was then an issue of tying vs if it had just been closed like apple there wouldn't have been an issue was a pretty stupid take if you ever want to see an open platform again.
Retr0id12 days ago
Google is also seriously dropping the ball in terms of security. The CVE-2026-43499 root LPE (aka ghostlock) is still unpatched across all Pixel devices, on the latest """security""" update, despite weaponized exploits being public for months.
grapheneos12 days ago
Pixels used to have far better updates than any other Android devices but they stopped improving it years ago. It should have kept improving because it's not at all adequate. They need to be able to release OS updates more than once per month and it shouldn't take months for patches to make it into the OS. It currently takes them at least around 2 months to get even the most urgent patches into the OS. They could fix emergency calls being broken if the patch was made around 3 weeks before an OS release, but that's about as quick as they can go. It's not at all adequate for security and is a complete joke compared to Chromium's release cycle. They can get an emergency Chrome update released within a couple days. They should at least be able to do it for the Pixel OS in a week.

GrapheneOS is often around 4 to 6 months ahead on merging Linux kernel LTS releases. We used to handle this ourselves but switched to the Android GKI LTS branch maintained by Greg KH. Unfortunately, it was often struggling to keep up even before the absolutely massive increase in Linux kernel security patches this year. AI models have rapidly accelerated vulnerability discovery and it's an ongoing crisis for the Linux kernel. We want to be on the latest LTS revision within days and want to be using the latest LTS branch within months of it being released. We're not at all happy with how Android is handling things and plan to fix that ourselves. We'll get things back to how they should be.

We also ship all the AOSP userspace patches months before Pixels due to shipping all of the security preview patches as soon as possible. There are sometimes minor regressions but we find and fix them ourselves downstream. The security preview system has a terrible design especially considering that frontier AI models can reverse engineer the patches. There should at least only be a source embargo for around 24 to 72 hours rather than pretending as if it can work with the patches available 2 to 6 months in advance.

jeroenhd12 days ago
I just ran https://github.com/CakesTwix/Android-CVE-2026-43499 on my Pixel 9 Pro and it seems to have been patched. I did get a system update not long ago, though.
lenerdenator12 days ago
There's "dropping the ball" and then there's "not reaching out your glove to catch it to begin with".

It'd be interesting to see which one is happening here.

Telaneo12 days ago
I'm convinced Android being open source is just an accident of history. It's been somewhat useful for Google to be able to ride on that goodwill, but they're not actually invested in open source beyond the ways it directly benefits them (or at least they haven't been in the last 10 years). Thus they're happy to throw the baby out with the bathwater if they believe they need the bathtub for anything that will earn them 0.1 cent more than that baby would.
Ritewut12 days ago
It's like PC parts being modular. IBMs greatest mistake and the industry wants to make sure it never happens again.
ikiris12 days ago
Its more a reflection of the vastly different internal culture of the time (and different executive leadership).

When Patrick Pichette left and Sundar became CEO both led to massive culture shifts.

monomania12 days ago
There's a non-zero chance that three-letter agencies are lobbying for at least some of this.
jasonfarnon12 days ago
Yeah. Which doesn't mean Google isn't happy to comply for its own profit motivations.
bri3d12 days ago
So, the real thing that's happening here is:

* Google drop "real" Android source-code updates to OEMs _and_ the public every half.

* But they ship four Pixel updates, including documentation + SDKs.

* Now they added new APIs in a Pixel-only update.

* Google also drop security update backports to "trusted" OEMs monthly (which GrapheneOS have had access to for years).

So, there are now Pixel-exclusive app features on the Pixel SDK version which isn't available to OEMs - but, it's highly unlikely any app developer would actually depend on these new APIs, since Pixel marketshare is tiny to begin with. This in essence just makes Pixels a weird beta-testing device for what will come out a quarter later to "normal" devices, which is sort of an odd business decision, but also a weird thing to get really mad about, in my opinion (I do see what GrapheneOS are trying to do, with having OEMs saber-rattle about not getting features on the same cadence as Pixels, it just doesn't resonate very loudly for me).

However, the API headline seems to bury a deeper lede; in the thread, GrapheneOS also claim that the quarterly Pixel releases contain security content which is not appearing in the monthly backports. This is quite bad and very sloppy if true, since the Pixel releases can easily be patch-diffed and exploits backed out of them. I'd be interested in seeing this enumerated in more depth.

mdwrigh212 days ago
> * Google drop "real" Android source-code updates to OEMs _and_ the public every half.

All of the major OEM shave access to the internal source with a _very_ small delay. OEMs don't ship these intermediate releases because they choose not to, not because Google witholds the source for them.

bri3d12 days ago
Oh! I had thought they stopped at the same time they closed off AOSP commits - that makes this entire rabble-rousing effort _exceptionally_ silly, then; I can't see the angle GrapheneOS are trying to push at all in that case (like, I get their side of the _concern_, but "Google are shipping features to Pixels that you don't get" becomes... quite a poor argument indeed in that scenario).
boredhedgehog11 days ago
> which is sort of an odd business decision

It's probably no decision at all, but merely poor coordination between separate departments.

Once a bureaucracy surpasses a certain size, odd side effects accumulate on their own, and the growing number of people affected by them seek to cast blame where no purpose ever existed.

bri3d11 days ago
I felt compelled to reply to this because I agree with it so strongly (which is also why I phrased my initial post as "sort of odd" rather than "some evil anti-consumer monopoly volcano lair conspiracy"); so many corporate oddity theories are easily caused by dysfunction that I wonder how many of their proponents have ever really been exposed to a corporate job.
fluidcruft12 days ago
I don't really see what the Pixel-only early API releases achieve except for allowing developers to work on Pixels ahead of time, but Pixels are such a small sliver of the universe that it basically just gives Google a leg up, I would assume. And if you're on Graphene why would you care about Google's beta edge apps?
grapheneos12 days ago
Exclusive access to QPR1 and QPR3 releases gives Pixels an unfair advantage over other Android OEMs. They get an extra 2 major updates per year. Introducing new APIs for third party app developers as part of these updates means third party apps will now run best on the Pixel OS. Google apps already run best on the Pixel OS due to many exclusive features. It's Google's standard overall approach to propping up parts of their business with their monopolies in other markets. It's not legal.
teekert12 days ago
The rattling is because of the security patches of course.
publlus_enigma12 days ago
As someone who went through similar challenges with Google making it impossibly hard for BlackBerry to provide an Android runtime on BBOS10, and now running GrapheneOS, I trust Google exactly zero to do the right thing by any open source project it stewards. Combined with their other practices, and lack of ongoing support for their commercial offerings, means that my perception of them is irreparably damaged and I minimise my usage of their products as much as practicably possible.
GranPC11 days ago
Did you work on BB10?
publlus_enigma11 days ago
No, I was a lowly consumer who still laments the demise of BB10. It was one of the best mobile operating systems I have ever used. Fast, stable, with a refined UI that prioritised efficiency.
largbae12 days ago
Alright AI maximalists, what's the estimated token budget to remove the Google dependency?

GrapheneOS has the bootable AOSP and will have Google-alternative device support.

We probably need an equivalent to Play Services, app signing/porting/publishing tools.

With these in hand could we talk Valve into providing the scalable alternative to the play store?

aesh2Xa112 days ago
GrapheneOS accepts donations and, to my knowledge, they spend it in hiring full time engineers.

They have replacement portions for Play Services already (attestation, an app store, and location), but it'd be interesting if they also offered something for push notifications.

If you have it to give you can spend your budget on a donation and fund the effort directly.

ninjasmosa12 days ago
I believe GrapheneOS talked about hosting their own unifiedpush server and baking it into the OS not long ago
nextaccountic12 days ago
The trouble is that banking apps will not work if you degoogle your phone. GrapheneOS was an attempt to make this sort of thing work, in a phone OS more secure than stock Android

But to be honest, many banking apps randomly stop working with GrapheneOS anyway. So if you see this...

https://privsec.dev/posts/android/banking-applications-compa...

https://github.com/PrivSec-dev/banking-apps-compat-report

And check the issues, it's unpredictable whether a bank will continue to work with GrapheneOS

So.. if you accept GrapheneOS might not be reliable for this use case, and decide have two phones (one just for banking stuff, another for.. using), then degoogling is fine.

Only thing is that the banking device probably needs to be a phone (or tablet I guess), I don't think you can emulate a real device good enough for it to work on something like Waydroid

muvlon12 days ago
Yes, if the banking app refuses to run on Graphene, you can forget about Waydroid completely. Hell will freeze over before Waydroid passes play integrity.
gonight12 days ago
My bank can support my phone or accept that I'm going to come waste their time in person, I'm not backing down here.
tEem2111 days ago
This is something that gets mentioned a lot, especially from people who don't use Graphene or other custom ROMs themselves. Personally, I have not had any issues using banking apps on Graphene without Play Services. While this is just anecdotal, even if apps required them, I use a separate "secure profile" where I dump all the fishy, but necessary apps that require Google. I used to run a separate Lineage phone with microG for this purpose, but it became too cumbersome
smolder11 days ago
My phone is not that old but it stopped getting OS updates and I stopped considering it a way to do anything banking related when my bank declared that my phone OS was too old to run the app.
hobo12312 days ago
Literally insane that banks will allow you to do banking on ancient phones with an unpatched Android full of CVEs, but won't allow you banking on a modern ungoogled OS.
alightsoul12 days ago
The token budget isn't to remove Google it's to create drivers for individual phone hardware, which phone and chip manufacturers keep closed source. Also it would be used to find exploits to unlock permanently locked bootloaders
MrDrMcCoy12 days ago
GrapheneOS won't be interested in other hardware support, since the only devices that meet their hardware security standards are Pixels and the upcoming Motorola phone.
crossroadsguy12 days ago
The answer to this is - the real world comes knocking. Govt, banking, investment, grocery, transport, even some mainstream social/communication apps, all stop working - yeah, kinda cold turkey. And if your, or someone else's, answer to them is: ".. well then don't use those apps.. or maybe in mobile or desktop browser.. " (this is usually the tone on those "privacy" guide forums), then yeah it will work and can be done in hours theoretically, or days max :)
spydum11 days ago
I think you could actually look at this via the OPPOSITE lense: OpenSource was good for companies before, because they got free code/bugfix/labor, which would have been expensive to produce themselves.

Now with LLM and agentic factories pumping out bugfixes/code, does the equation on opensource still look attractive to a for-profit company? Why give away that sweet source code?

Andrex11 days ago
AI is definitely going to cause a chilling effect for (human-written) code. Why connect with other young nerds to make something cool when an AI can make it for you? Why share code if you've never sought out shared code yourself?

Further contribution to the trend of humans becoming more capable but less social.

Ajedi3212 days ago
Important details further down: https://grapheneos.social/@GrapheneOS/117282129725629495

So it seems like the problem isn't that the new API is Pixel exclusive, but that the first and third quarterly release patches each year are Pixel exclusive?

Insimwytim12 days ago

  No, these are standard Android APIs included since Android 17 QPR1. These will be available through AOSP and other OEMs via Android 17 QPR2 in December 2026. It's currently exclusive to Pixels because it was released as part of Android 17 QPR1 since QPR1 and QPR3 releases are now Pixel exclusive since Android 16.
  This is simply the first time they've added APIs in a QPR1 or QPR3 release following no longer releasing QPR1 and QPR3 to AOSP after the release of Android 16.
grapheneos12 days ago
QPR1 and QPR3 are now Pixel exclusive since Android 16. That means the new APIs for app developers added in Android 17 QPR1 are Pixel exclusive until Android 17 QPR2. There hasn't been a case of new APIs for apps not being open source or not being available to every OEM since Android Honeycomb (3.x).
iAMkenough12 days ago
Seems like that's anti-competitive behavior, holding back security updates except for Google's own stock users.

https://grapheneos.social/@GrapheneOS/117282190165630051

> It would be interesting to know if Google's legal team is aware they're giving Pixels months of early access to new Android features and bug fixes including certain important security patches. Pixels being given this competitive edge over Google's OEM partners is very dubious.

Read the full thread on Hacker News →

Related stories