I’d revert it so we can work in the proper fix without hurry. But up to you

Anyway I’ll be focus on this during the weekend

valldrac: could you maybe figure out which processes this is used in

and we can just disable SLOT_RANDOMIZE for those as a quick workaround

SLOT_RANDOMIZE is not important

woohoo, coral support soon?

renlord: don't think so just added some empty repos

someone did some work on it but there are major issues

and I don't own the devices to do releases

strcat[m]: do you think it'll be appropriate to include the mocked gapi for cam provider?

don't want to do stuff like that atm

got a lot of issues that need to be addressed and the Android 11 migration not that far away

I think emulating Google Play needs to have a per-app toggle and should be a separate project we can rely on that's focused on minimalism / security

not microG

off by default and not the way they do it

just stub things out, pretend services aren't available, all of it

stub out all the APIs

and must be opted into per app

the mocked gapi is not microg

so it doesn't trigger apps like Signal to try using GCM instead of their own push

its actually stubbing out the API

lulz

renlord: well that makes more sense just not ready to do this atm and needs to be optional / opt-in

> 17:09 <strcat[m]> I think emulating Google Play needs to have a per-app toggle and should be a separate project we can rely on that's focused on minimalism / security

Agreed

valldrac: try to figure out which process this happens in tho so we can just disable SLOT_RANDOMIZE there

so I can just put this into the next release

revert your attempted fix + work around it like that

okay, I’ll tell you

I just want it to work for now like stock

if they removed it in master we don't even need to ever fix it

hopefully gone in ANdroid 11

I'll work on the hardened_malloc change

valldrac: GrapheneOS/hardened_malloc c525803

just need exe path to plug into to that

> I think emulating Google Play needs to have a per-app toggle and should be a separate project we can rely on that's focused on minimalism / security

Microg does have a per-app toggle for gcm registration allow

nickcalyx[m]: I think he's talking for more then just that

nickcalyx: want more than just for that tho

nickcalyx: and also an app can decide to use GCM just because it sees Playu

* nickcalyx: and also an app can decide to use GCM just because it sees Play

I've noticed that oo

nickcalyx: usually what will happen

nickcalyx: so for example if Signal sees Play

I think it will try to use GCM

as a permission toggle?

I don't think it will fall back if GCM doesn't work

like Network?

they have Play and non-Play paths, they don't handle GCM being unavailable

Makes sense, why would they

nickcalyx: and we never want to actually have GCM in GrapheneOS just fake always down GCM

we just want a toggle to enable stubbed out Play Services where it pretends everything is down / unavailable

so instead of app not running it's just like it can't connect to Google services

so some won't work still

but many will work

with partial functionality

mostly just push notifications missing, etc.

unless they use Google for login or w/e

then it just won't work but w/e

strcat[m]: libaudiopolicyservice.so, and is loaded by audioserver, let me search the full path

valldrac: need the executable not the library

so audioserver

path to audioserver

SLOT_RANDOMIZE is really unimportant so it's not a big deal to temporarily disable it for a process

probably easiest way to deal with this if it works around the problem enough to wait for their upstream fix

strcat[m]: /system/bin/audioserver

valldrac: try pulling the frameworks/av and external/hardened_malloc changes

and just trying with that workaround

not pretty but...

it is what it is

maybe I'll do a release tomorrow with this

valldrac: okay, but let me check the fix first

yeah

valldrac: also could try working around camera bugs with more nonsense like this

there's already an attempt

C++ is such a shit language

layer on all this complexity and nonsense abstraction while it still being totally unsafe everywhere

not good

legacy codebase, what do?

cant just ask everyone to upgrade to c++14 today.

C++14 isn't any safer tho

they just add more

and people just abstract more and more

but it can't do safety

so you have this mix of layers and layers of weird abstractions, using a fucked up type system that's not based on actual type theory stuff

with unsafety everywhere

also class inheritance is a horrifying thing

it's hard to unravel what code is being called and what's happening

hard to debug this crap

you have gripes with runtime vtable resolutions

renlord: mostly just class inheritance

it doesn't make sense

if it can be resolved statically in compile-time, class inheritance is OK imo

I think it's a weird, illogical thing

and hard to follow or do correctly

strcat[m]: the problem with the camera is that there are some proprietary libraries in place, with no source code

valldrac: yeah but they have symbols at least

strcat[m]: so it's even harder

and we can just work around bugs and report upstream

don't really feel like trying to fix device-specific bugs all the time rather than just reporting them

valldrac: going to start building a release

needs to be tested first ofc

but this workaround + revert of the attempted fix is progress

as long as it's for the right process and works

building now

can use beta to test

<strcat[m] "don't really feel like trying to"> its hard for you to do it all, it might be the best option right now with how the little contribution is coming in

strcat[m]: my build is sooo slow

dont know if relevant, but encountering camera error on gcam is significantly less of an occurance compared to opencam

valldrac: what sort of HW spec?

question for the group:

should we be testing with the beta when strcat makes a new release?

renlord: one thinkpad with external hdd

valldrac: compiling using external hdd?

thats a very huge io penalty hit

renlord: I know, but the internal ssd is not big enough

renlord: I plan to upgrade soon

are you using a vm valldrac?

and pay hypervisor penalty on top of io?

lol

aeonsolution[m]: no way! xD

how much memory you got on your main? maybe try 7zips some files

> <@aeonsolution:matrix.org> question for the group:

> should we be testing with the beta when strcat makes a new release?

I am always on beta

i still havent received my refund for spectre mitigation on intel machines

they should at least refund me 30% of the price of the CPU I paid for.

you can turn the mitigations off?

amd too

travankor_: then what? leave my front door open?

that's not a very reasonable thing to do

I have Intel something or another

how many real world spectre exploits are there?

<cn3m[m] "> <@aeonsolution:matrix.org> que"> thanks

renlord: no worries, we won't tell anyone, try make-linux-fast-again.com

its analagous to a builder giving you a broken toilet installation with untinted bathroom windows.

travankor: hey I have some beachfront property in Arizona to sell you. I will throw a librem 13 in with it

and builder just asks you to shower naked exposed to everyone, refusing to replace the window.

cn3m[m]: lol

maybe an airgapped computer can run with those mitigations off

its not a realistic option for me right now, since i have multi-use purposes for my pC.

I run Windows 10 Enterprise now. I love all the VMs

It is like Qubes with anti exploitation

you should also disable hyperthreading if you want to pedantic with the mitigations but w/e

to be*

good point, but at that point, i really need a 50% refund or more.

should just use an ARM SBC as my main computer at that point

<renlord "should just use an ARM SBC as my"> 2021 macbook

<strcat[m] "not microG"> how would that work? isn't that a huge project

no

just stubbing out all the APIs

not implementing them

valldrac: initial build seems fine but I can't test much

don't have BT audio devices

just other BT devices

strcat: is the build in beta chan by chance?

not yet

takes a while to get it rdy

only 3a build is done

Are there any plans to support Pixel 4 or future 5 devices? I'm aware that Daniel Micay doesn't want to add more devices, but maybe when Pixel 2 support is dropped it could be replaced with newer Pixels? Personally I was thinking about buying a Pixel 3 (3a is only like 20€ cheaper), but only one year of support (October 2021, considering it's release date) is not enough for such an expensive phone (compared to e.g.

Xiaomi devices). Speaking of Xiaomi: I think I read that Xiaomi Mi A2 support was considered at some point. What about supporting a newer Mi A model (Mi A4?). It would probably expand Graphene's userbase, as Mi A devices are much more affordable than Pixels.

* Are there any plans to support Pixel 4 or future 5 devices? I'm aware that Daniel Micay doesn't want to add more devices at the moment, but maybe when Pixel 2 support is dropped it could be replaced with newer Pixels? Personally I was thinking about buying a Pixel 3 (3a is only like 20€ cheaper), but only one year of support (October 2021, considering it's release date) is not enough for such an expensive phone

(compared to e.g. Xiaomi devices). Speaking of Xiaomi: I think I read that Xiaomi Mi A2 support was considered at some point. What about supporting a newer Mi A model (Mi A4?). It would probably expand Graphene's userbase, as Mi A devices are much more affordable than Pixels.

from what i understood of the post about new devices: developers need to sign on as maintainers for each device tree

No, there is a lack of community support at he moment

the*

highupper: the Mi A2 was a viable device, but they dropped verified boot support for alternative OS

daniel is doing most of the work by himself so any chance of other devices getting supported would require the help of the community

When they moved from Oreo

<RageLtMan "from what i understood of the po"> Yeah, I think the reason behind this is that Daniel can't maintain lots of devices alone. But when Pixel 2 support is dropped isn't there room for a new device?

The pixel 3a is currently on sale at least in the US for 279

Is there any appetite in the community to do something like kickstarters or bounties of some sort to compensate would-be developers for the work required?

<dazinism "highupper: the Mi A2 was a viabl"> Oh ok. Maybe we can reconsider it when the Mi A4 is released.

when you say "room for a new device," you realize that the statement expands to "an entirely new set of software and hardware problems to address" compared to maintenance functions for a legacy device

please read up on daniel's past reddit comment

Which one?

Also Daniel wants to stop, maintaining devices. The project needs other people to do this.

<RageLtMan "when you say "room for a new dev"> Well yes, but I don't think the Pixel 2 will be supported forever (it'll run out of vendor updates). And supporting a new (series) of device(s) always requires work (so did the Pixel 3 series).

When the Pixel2 devices are dropped, I dont imagine he will take on new devices. Needs other people doing that work

Yes, requires work, and there being only one guy doing ALL of the work, means burdening him more

use reddit comment search type in his name and Pixel 4

that should answer most of your questions

he mainly needs development help at the moment

Is there some sort of documentation which hardware features are required for GrapheneOS to use it's full potential? Also is there a documentation on which device specific changes need to be done to Graphene's source code?

Right, but if nobody is stepping up to do that gratis, are there financial incentives that the community could provide to hire them? I'm in no position time-wise to get spun up and consistently maintain a tree

its on grapeheneOS's github/ website

<RageLtMan "Right, but if nobody is stepping"> you will have to talk to the mods for that

<fujita_[m] "its on grapeheneOS's github/ web"> Well he mainly talks about IOMMU in the FAQ page, but I'm looking for more specific stuff like Titan M requirements etc.

RageLtMan: Daniel accepts donations, but doesnt want all to take on the task of finding and employing devs

is there anyone on the moderation team who functions as a community coordinator? Who would be the person to talk to about trying to set up a non-corporate funding model (bypass any pitfalls of prior endeavors) to help offload Daniel and ensure some longevity to the project by reducing rate of roast for the most valuable developer?

The community could take that all on though

RageLtMan: just donate directly using paypal/bitcoin

or github sponsors

i do the paypal bit, but i cant fund a TEAM of developers without having to underwrite it somehow, and this isnt tax deductible

you fund daniel, daniel can decide how to spend the project monies

he knows what's best for the project.

Daniels has said he doesnt want to take on the task of hiring devs

renlord, as stated above, this is a staffing issue, and i get the sense that daniel has had more than his share of dealing with humans

strcat[m]: the patch looks good, I cannot reproduce the BT audio issues, so go ahead with the release

ok. Alternatively, you can sponsor a talented contributor on the side.

thats why i was asking if there's anyone officially responsible for community coordination

it does not necessarily have to concern Daniel personally

talented contributor. have you ever hired developers?

RageLtMan: nope

yeah, I also accept donations to break the releases lol

Sounds good valldrac (pun intended)

try it for a C/C++ project nowadays

valldrac: thanks for contributing in the first place. breakage is just another form of incremental progress :)

RageLtMan: does it sound like you want to volunteer to be in that position ;)

(i'm sempervictus on gh by the way, so one of the affected)

the project is missing many things, but nothing proper funding cannot fix

renlord: many moons ago i fell into a similar role in the metasploit world. i now run two companies and currently operate as head of security for a healthcare co in a psuedo-consulting role. literally 16h days, 6-7 days a week.

hence almost no time on IRC, my github looks like a warmed over corpse, and i'm behind on bassically all open source projects i touch

RageLtMan: keeping busy, i like it

infosec people are in high demand right now. unfortunately a lot of that demand is utterly frivlous crap where they just want a consult to tell them that all their problems are actually N/A and its totally fine to vent all your healthcare data to the wind

likes like management consulting.

basically just finding a 3rd party to blame when shit hits the fan

so if there isnt really someone running the show as a community coordinator, then is there appetite to delegate such function to someone who's done it for lineage or whatever other popular roms out there? (sorry, i've been on copperhead/graphene for ages, not up to date on what the cool kids use these days to get data-slurped)

renlord: in the current situation with covid, its the wirld west for liability, indemnification, surcharges, rate hikes, and other bad behavior in a time of need. You'd expect force majeure clauses to come into effect right now, but there are so many having nothing to do with this where people just want to reneg a contract on favorable terms and see that they can squeeze people suffering from liquidity or supply issues

we kinda experimented that with reddit didnt we? and the conclusion was that there was too much misinformation occuring and moderation deprived a lot of time from actual technical work.,

> 01:45 <RageLtMan> renlord: many moons ago i fell into a similar role in the metasploit world. i now run two companies and currently operate as head of security for a healthcare co in a psuedo-consulting role. literally 16h days, 6-7 days a week.

Interesting background :)

for instance: a lot of HC firms did an "emergency term change" on contracts from net30->net90 for consultants who had already invoiced. For places which sub out at high rates, thats deadly. One of our co's had to take a PPP loan to pay subs to cover "the spread" on their randomly modified terms. The co is an f500, in the media daily right now

JTL: got lucky - started in the digital world in the 90s, security happened to be what i found interest in, and the rest is sorta history. been very lucky to find people who know more and are willing to teach (Daniel being one of them)

Of course

RageLtMan: as I guess you know GrapheneOS is mainly Daniels work. Hes suggested that due to past problems he wouldnt be quick to delegate significant 'official' power

So on the topic of getting some sort of delegation and non-voting-rights-hierarchy going (my personal take is that Daniel always remain tyranical overlord of all project direction, we saw what happens when other people have their own ideas about how to subvert his efforts)

RageLtMan: also suggested that theres nothing to stop another (sister?) project funding dev work on GrapheneOS

so as long as community does not get in the way of technical work or misrepresent/misinform about the technical work. They can be separate responsibilities

And... will Daniel trust in what other developers will do, or he'll need to check all the code made too?

the problem arises when people misinform about technical details without a good understanding of the technical work.

That would probably require someone working full time for a bit to set up the organization which would deal with device support, non-security features which Daniel doesnt want to touch, etc

and there are not many people qualified to moderate these items.

which is why i'm suggesting we leverage the standard method for acquiring talent: money

for example, I'm not entirely across the full android ecosystem, I can probably comment on very specific things I personally have touched on.

that would require pledges or lump sum donations

so the role would require community management + project management tier2 with all the tier1 priorities still being defined by Daniel?

everyone i know with those qualifications is paid a decent salary with benefits, and even though it may not be an FT role once the org is "configured" and set to run smoothly, it still requires a talented person just to coordinate it all for some amount of time every day

i need deeper pockets, or we need to identify users who depend on this technology for their privacy with reasonably deep pockets and pool our efforts. this project dies and anyone using this for any finserv/pii access could stand to lose far more by theft from their next insecure device than donating to this project

i guess that was kinda what copperheados was setup to do

but it just imploded.

heh

that was human element, greed, stupidity

I've been wondering if could maybe facilitate the fundraising and contracting (rather than direct hire) through a third party org. To avoid a load of admin/bureaucracy

As it doesnt need to be a for-profit corp different channels are open

Semper Victus (my co) works on the contractor-per-project semantic already, we could technically be the vehicle for it, but the problem we'd all have it taxable overhead. in the US anyway, it would ideally be done through a proper non-profit. not sure how canada works in this regard

people can always just start a foundation

that's dedicated to grapheneos

starting a non-prof in the US is not easy

foundation member can write up a constitution that defines how funds get solicited and spent.

it does not have to concern/trouble daniel

it needs to involve him to delegate all "final say" rights to him and him alone

kinda like how bitcoin foundation and actual bitcoin technical work has nothing to do with each other. Though, arguably you can also say taht model does not work since the foundation is more or less useless now

this effort can't fragment, just like grsec couldnt, because it is pinned to the talent pool contained in one man's head. Since the actual effort is technical, the architect needs to be at the head of decision making.

Can find an org with somewhat aligned aims to act as fiscal sponsor for the project. To avoid having to set up a not for profit corporate.

otherwise, other infosec people can license grapheneos from Daniel and then rebrand it as a commercial product to sell (maybe a more "supportive" version of the OS on top of the base graphene os)

then follow the red hat model to contribute back upstream -- graphene os

dont go there, will put us all in the x-hairs of law enforcement who have to deal with such things being sold to serious asshats

A side note - is tax an issue if you are spending all your income?

yes, income tax, property tax, etc

RageLtMan: why is it us all though, the Graphene OS license makes clear you cannot hold any contributor/daniel responsible

a commerical entity might want to go a bit further than the project's license

but the liability is on them wholely

the FBI has some really misinformed notions about criminal responsibility when it comes to who wrote code

if red hat explodes, you sue red hat, you dont complain to the fedora project

or you dont complain to Linus

umm

A: i complain to linus as required, B: fedora is derived from RHEL, C: this isn't about civil liability, this is about handcuffs and a human booster shot from a guy named molly

:)

but we're not even doing anythign criminal?

@_@

hutchins (SP?) got arrested for code he wrote and put on a forum which bad people incorporated into their malware

is there somewhere i can read more to get context?

this is a more salient issue for people on the red-side of the field, but given that i've seen accusations of CH being sold to the mob and such, and i dont have a real social media presence or read anything but whats pertinent to my tasking most of the time, i imagine LEOs have too.

the point is tangential: there are added considerations when having for-profit functions which might upset the powers that be.

regardless of modality, if an effort to offload Daniel does materialize, we can provide some amount of funding, some resources in our private clouds for builds and such, and hopefully as we cycle talent and tasking, some actual development work down the line

if it can be built in a manner where donations are tax deductible, we can donate more, and can probably get a bunch of our clients to donate as well

One point. I think strcat wants to use local hardware under his physical control for production builds.

RageLtMan: thats nice to hear

Also he (and a bunch of other people) are in Canada, so in the case of a Canadian non profit/foundation, how that would affect things.

by all means, zero trust is a concept i fully support. Theres a lot of builds which never hit release though, and should be built with their own signing keys specifically to avoid accidental release

Of course

the foundation needs to be incorporated in literally every jurisdiction for it to be tax-deductible

yike

for example, i cant get a tax-deduction when donating to a canadian non-profit

it needs to be specifically an Australian Registered Non Profit

that's just not an optimisation that's viable at this point

Anyone connected to the EFF or other global orgs with a potential interest in having some semblance of privacy and security on their mobile device?

EFF is mainly US focused

balls

As I know off the top of my head, the canadian equivalents are either very small (think underfunded academic type orgs) or "abandoned"

JTL: there's the vancouver privacy thingy

open privacy initiative?

That's a more recent development

and I think their funding is a bit shakey atm

sarah's work on the swiss voting stuff was a good read

I'm aware she did some work in that area, but haven't read it

in collaboration with an academic from my instiution

neat

swiss? about the voting stuff?

many problems

right

at the end, they gave up on evoting

llol

and the company went bankrupt

just recently

LOL

*sad trombone noises*

dazinism: you inspired me GrapheneOS/os_issue_tracker #217#issuecomment-635874702

valldrac: always available for bad puns

valldrac: is it still a problem?

i can build and test on the 3a

with 2 BT audio devices

the more tests, the better, try pulling frameworks/av and external/hardened_malloc changes

or apply commit ac26b532 to frameworks/av and ce6a2122 to hardened_malloc

well lets see if the hardened_malloc changes break anything on Linux, our CI should pick that up in ~16m

so "if (strcmp(audio_service, path) == 0)" can be expanded to handle an array of these things to provide built-in exclusions, possibly even passed as an env var at compile time

break anything in userland?

what applications do you run against?

its a bit scattershot: CI will build it, then push it to a current Arch linux instance in the cloud, set it up for ld preload system wide, and reboot

it'll then start nginx, php, ruby with passenger, and i think a couple other things

right now its only wired to a grsec test image, CI actually builds our linux-hardened kernels for places where we cant use grsec, so i should wire that in too

F droid just popped up with a warning about it being made for an older version of android etc, normally an update follows straight away after refreshing the app but it is not happening now for some reason.

Is anyone else having the same issue?

neothechosenone: that warning was added for apps with a target apk earlier than 28

neothechosenone: hub.libranet.de/wiki/graphene-os/wiki/Apps#Target_SDK

Think you'll see this warning first time you run any app (after latest GrapheneOS update) with an older target SDK

If Fdroid isnt updating their list of apps, thats something else.

Worth noting that Aurora Droid (an alternative app client for accessing Fdroid apps) targets APK29

Made by the same dev as Aurora Store

Must be an f droid issue I just read on calyx room someone having issues with f droid today ..

Aurora droid is a safer app store than F droid then?

Noticed that it still makes loads of non-tor connections if you use the proxy settings in Aurora Droid. May be worth considering for some people.

neothechosenone: maybe there just hasnt been any apps updated on Fdroid since last you checked? Or you dont see any apps?

I see loads of apps just no update for f droid initially after downloading the apk..

Thanks for the info though aurora droid sounds good.

Sometimes Newpipe breaks because if changes Google makes. The Newpipe devs have to work around the changes.

Thanks a lot I'm sure they will sort it.

If you dont see an update for Fdroid, it just means that they have updated their website so that you've downloaded the latest version

Thats a good thing

But the warning saying f droid was built for an older version of android etc must mean their latest version is still behind ?

I understand

> Aurora droid is a safer app store than F droid then?

Hard to say for sure. There is a lot to consider. Its probably a fair choice though. Possibly even more so if you already use Aurora Store

neothechosenone: yeah the Fdroid app targets SDK25

<dazinism "pravez: I think most things here"> thank you :)

It doesnt use all the security / privacy features added in the latest versions of android

Thanks for the info..

pravez: pleasure

strcat: I can´t test remote attestation with a debug build, can I?

Regarding the Bluetooth problems, I enabled the "Disable bluetooth A2DP hardware offload" from the Developer options and is all working nice and fine on all of my devices (even in my car)

renor, interesting...

It's disabled in my smartphone

Maybe that's why it doesn't work

Comes disabled by default

Oh yeah

Try it out enabling the option

I mean, enabling the option. Which results in disabling Bluetooth A2DP hardware offload

But someone said that sometimes some people has problem with it and rebooting more than 1 time it worked

IDN

renor: ok, thanks

If it's the only problem with Bluetooth driver then it works ok...

Maybe all devices could try it

I'll try when I can

renor, yes, it worked for me in my car when I tested it enabling this option. It wasn't working before and the sound was only received from the smartphone and not the speakers

Now it works ok, thanks! :)

strcat[m], did you read this?, could this be the problem?

By default GOS comes with this option disabled

cg_droid: thats been known about as a long time, and does fix things for some.

*for a long

dazinism, ok

THanks

So, some other people, with this option enabled, continue with the problem

Theres been work recently to try and fix the problem properly. Its proven to be a complex problem (actually possibly a number of issues)

dazinism, I thought that maybe the people with the problem has the option disabled like me

I"ll try anyway

cg_droid: yeah possibly, enabling it has been known to sort out problems for quite some time. Its been spoken about here and on the GrapheneOS reddit for months. It doesnt fix the underlying issue that causes the problems though.

dazinism, thanks

Anyway I´ll post here when I test it with my Pixel 3a

If I'm following along properly the problem is due to GrapheneOS hardening hitting problems due to poorly written code in AOSP

it works ok 🙂

The hardening is going to be disabled. And the problematic code will be replaced in Android R

Enabling that option renor posted in my Pixel 3a

dazinism, good move

Maybe it's only in Pixels 3a, IDN

So questionable if its worth spending loads of time trying to fix it properly when theres so much else to do.

Yes..

No it effects other phoned also.

I enabled a2dp on pixel 3 and restarted. Bluetooth headset still isnt working during calls

kernelpaniker[m], ok... so, the problem persists

spaceinfinite[m], and using ORbot in vpn mode?, it must work

Choose this app and that's it

Not on vpn mode

It has a socks option

Ah ok

And it doesnt work

You could use it in vpn mode

If it doesn't work with socks

I have vpn

Oh ok

AT least you are using it through a VPN if you want to hide your ip

Why Tor?

Cos vpn for specific apps and orbot for very few selection

And the rest normal traffic

ok

And AuroraDroid?

Have you tried it?

Ah sorry

It's like F-droid

Not to install from Google apps

My bad

Aurora store works via orbot

Auroradroid doesnt

Fdroid works

I get it

Must be a bug

spaceinfinite: yeah, I noticed that.

And they dont have a room here to report to them

I love grapheneos.

cg_droid: A2DP offload is not the issue

we're working on an actual solution

please be patient

Thanks for spending time digging into this, strcat and valldrac - I do not use, but, know it's super important to a lot of Graphene's user base

strcat[m], no problem, it works fine in my smartphone, I was only trying to help from the renor comment ;)

furofuro_01: Someone can correct me if I'm wrong, but, pretty sure Verizon's the only ones locking these things, right?

<furofuro_01[m] "Hello. I am interested on gettin"> Aliexpress has them for 240€

A basic question but difficult for me: pixel3a+graphene or librem?

see past posts

yes you can look at past posts on the subreddit

<furofuro_01[m] "Hello. I am interested on gettin"> Not sure where you need them to be shipped to but clevertronic.de has a good selection refurbished phones some even with 12-24 months warranty.

wasn't in response to you

<fluoridatedsheeple[m] "ah"> You can read the history log of thus channel. Watch the description of the channel

* You can read the history log of this channel. Watch the description of the channel

<fluoridatedsheeple[m] "bc im not trying to end up with "> I heard that Verizon pixel's imei starts with 34..something

<fluoridatedsheeple[m] "Ah, i was hoping to not have to "> You just search factory unlocked pixels or if youre buying used one, ask to screenshot the developer options page in setting

* You just search factory unlocked pixels or if youre buying used one, ask to screenshot the developer options page in settings

Yes, and then scroll to OEM unlocking toggle

Then you should check if it is possible to turn on like this

Yes

just note it can be greyed out because it hasn't been connected to the internet or w/e

from the factory reset protection feature in the stock OS

Do you know if some webview browser like "Privacy Browser" uses Vanadium webview in GOS and also some protection from it?

damn, so thats not even a solid indicator..

@freenode_cg_droid:matrix.org yes it's mixed

cn3m[m], thanks

Bromite vs Vandium webview has a lot of security trade-offs

Vanadium has better hardening for the whole Trichrome

WebView has one sandbox and no site isolation

So, Vanadium browser has isolation and another browser using Vanadium webview doesn't

Vanadium browser has some more security included

yes Bromite has better isolation and WebView anti exploit

Vanadium mixes both and is recommended

Ok, interesting

Thanks

you're welcome it's all covered on the new web browsing section

Yes, I read about it but I have these doubts yet

Yes, I read about it but I had these doubts yet

I also read Daniel posts in Twitter

I am was ad developer I know a lot about privacy especially on mobile. Madaidan knows a lot about security he works on Whonix development and research. Two very smart people and Daniel we both would admit knows more than our respective field

he's really a diamond in the rough a genius who shares his opinions and an excellent free project. Trust him if you can find him talking about it

Daniel is a genius in security and privacy

Yes, I know

I also search in reddit and follow in Twitter Grapheneos and his profile

I was reading post cn3m and you mentioned that you didn't use a sim card, how do you contact your friends and family

Did you manage to convince them all to switch?

@freenode_cg_droid:matrix.org redditcommentsearch.com

@fujita_:matrix.org I currently use VoIP

yes, that link

Today I was reading about LineageOS and DanielMicay

And also about verified boot

Some people says it's not a problem using a non verified boot because it's only a issue with a local attacker

I said it was also with remote attacks

that's categorically false

So, I found about it

here's a deeper dive on Lineage issues btw

<cg_droid "So, I found about it"> good work

Thanks

<fujita_[m] "I was reading post cn3m and you "> I don't use SIM either

Thanks for the response (currently looking at them)

cn3m[m], hub.libranet.de/wiki/and-priv-sec/wiki/verified-boot

> > <@fujita_:matrix.org> I was reading post cn3m and you mentioned that you didn't use a sim card, how do you contact your friends and family

> I don't use SIM either

Same here but its not by choice, I PUKed my sim and I can't unlock it atm. I was looking to port the number over another carrier but I don't have enough documents to sign up for one at the moment

I have fully adjusted to not having a sim but I think I will still need it since where I live WhatsApp is the main form of communication for everything even for work

<JanPenfrat[m] "Not sure where you need them to "> Somewhere around Philippines btw

josh.man: how do you get around not having mobile data and a phone number for daily use

fujita_ why do you need sim for WhatsApp. You communicate on wifi just fine

Sign in process

Same with signal

fujita_ traditional calls are long gone for me. I don't need not want to call anyone using GSM from early 1980s. Texts is even worse. I hate traditional texts. Super insecure and old

* fujita_ traditional calls are long gone for me. I don't need nor want to call anyone using GSM from early 1980s. Texts is even worse. I hate traditional texts. Super insecure and old

Does anyone have a preferred VOIP provider? I've been looking into going the no SIM route just unsure how it will play with GOS

Same here

Jitsi?

I received signup text on another device the. Threw that Sim in the waste. I would never use same number for Signal and GSM

* I received signup text on another device then threw that Sim in the waste. I would never use same number for Signal and GSM

Oh, you no SIM folks don't have a phone number you consistently use?

I was looking at trying to get a twilio number and using Linphone but don't know if it'll work

By phone number you mean 2G calls from 1980s? No. Trully hate that technology

I guess I was thinking of something a la google voice

Ok. That is a tiny bit better. There's hundreds of services providing you phone number. Skype, Viber, Linphone. I personally don't use either

<fluoridatedsheep "im finding cheaper than that on "> Unfortunately it is somehow unavailable on my country

But thanks for the suggestion still

need people to step up as device maintainers for existing devices and to develop and maintain Pixel 4 and 4 XL support

it's important to support the 4 and 4 XL so that the 4a can be added later (which would share a lot of the work) and to move things forward to current generation device support code

very problematic to not have support for it

the project needs help in a lot of different areas, device support is one crucial area

need to get these basic reference devices supported to enable other things

Pixels are the AOSP reference devices

if we don't support the current reference devices, GrapheneOS is not in a good position to be ported to other devices

Argh. Trying >_<.

I am working on helping out with Pixel 3a. I am going to volunteer to be a device maintainer for that so if there are others in the channel that need help getting started please reach out. I also ordered a Pixel 4 to help with porting. I can't help those with Pixel 4 already because porting is very new to me and I am going to be learning it as a I go.

<aeonsolution[m] "I am working on helping out with"> I know this is not helpful now but I'm very interested in gettkng set up to help. Zero development experience but would love to learn anything I can to at least contribute to the issue trackers

If you are building the development branch, learning the steps is very important-and I will help you out with that. Everything is clearly spelled out by strcat on the website <grapheneos.org/build> and it is very counter-productive to ask for advice when you did not follow the steps.

That being said, learning from your mistakes is a big part of the process.

fomijafi: reach out to me in a message and I'll try to give you advice on where to start

@fujita_:matrix.org WhatsApp and Signal don't care what number you use. you can even use one of those free services.

porting your number over is an option too

aeonsolution: nice one on stepping up maintaining the 3a :-)

*for maintaining

Signal says they'll be supporting non-phone-number identifiers soon

I hope they fix the new PIN feature to let you set a registration lock without enabling recovery of your profile/contacts though

old way was better

I'm hoping to follow in aeonsolution[m]'s steps as the maintainer for Blueline. I'll order a new phone for it soon.

<strcat[m] "I hope they fix the new PIN feat"> I use Molly with GrapheneOS.

Hey nuttso[m]!

Would also recommend it to everyone

Hi

Roger

I contribute to Signal as a translator. As far as I know Registration PIN will restore user profile 😕

Hey nuttso[m]! Sorry about the debugging cables >_<. Turns out I've been lower on stock than I normally am. I'm still waiting for the serial TTL cables to arrive but they haven't yet.

The border is closed, which may explain the delays.

> I'm hoping to follow in aeonsolution[m]'s steps as the maintainer for Blueline.

Nice TheJollyRoger

It's all good man

nuttso[m], what is Molly?

Hey strcat can we have a private irc room only for beta testers

Valldrac has an fork with true password encryption

Thanks

He also started contributing here but needs more resources

I've uh... got another IRC channel parked.

I'll maintain the other IRC room.

strcat[m]: Signal's PIN feature will also support multi-device sync. I don't think they will make it optional

basically it'll become a core feature

<valldrac "strcat: Signal's PIN feature wil"> I'm think he told me he will make it optional

Will ask him.again

nuttso[m]: who?

Hey valldrac

Not sure though you once said in our group it would become optionally

Ah! I was talking about the PIN reminder. And actually, now it's optional

Ah ok

PIN is mandatory. Reminder is optional

PAIN is mandatory. Suffering is optional

<cn3m[m] "I am was ad developer I know a l"> Curious to know your phone setup and how you deal with ads.

endless attempts to spread misinformation about all kinds of topics by that moose guy and his sockpuppets

look at all the BS he keeps posting

he clearly lacks an understanding of most of what he tries to talk about too and he suddenly changes the topic

and can't follow a consistent thread of conversation

Rrrgh.

I talk about the monolithic design of the Linux kernel and he interprets that as a criticism of the desktop Linux stack and replies with some nonsense wrongly comparing sudo / su transitions from a user account to ADB

these people just know how to write a whole bunch of nonsense / bullshitting that makes it seem like there is some kind of debate or that something is rebuted

they are just dishonest charlatans writing nonsense and tricking non-technical people

really, look at his posts

what is that BS

reddit is infested with this and they just make echo chambers of bullshitting

such a terrible platform

Fuck.

I think reddit is even worse than facebook

some 60 year old qanon supporter saying 5g is giving people coronavirus and bill gates wants to microchip them with a fake vaccine is basically on the same level as discourse on subreddits like this

people are so easily fooled by people bullshitting like this

just depressing

never ends

Yeah...

<strcat[m] "some 60 year old qanon supporter"> Lol Nice comparison

got some people incredibly obsessed with me and just going on and on with their bullshitting

Saw a weird article on Forbes yesterday that, kind of, claimed "Chrome bad cuz c++, Firefox good cuz rust"

yet Firefox is like 8% Rust

and that brings in the whole rust compiler / stdlib as added unsafe / trusted TCB

and their C++ is objectively much less audited / fuzzed / hardened and in a code style more prone to vulnerabilities

safe rust code relies on the compiler and unsafe rust code - of which they have written a ton

and unsafe rust code relies on safe rust code for correctness

Wow. What a dirty secret.

Yeah, it was a total BS article posted in a local security group on Facebook.

not clear that they reduced the amount of code that needs to be trusted to assure memory safety even for those components yet

exactly I was just writing about the libraries yesterday

rust doesn't help much if it is calling untrusted non hardened libraries

Even claimed that Firefox has a "3 year headstart"

cn3m: when you expose C APIs from a rust library

that is an unsafe API

<cn3m[m] "exactly I was just writing about"> Can you give a link please?

and you're building backwards from an unsafe API

and on the other end is more unsafe code (compiler, stdlib, etc.)

there is still plenty of unsafe code trusted to assure memory safety

Firefox has done good work with rust and the PDF Viewer. I'm not going to dismiss that, but 92% of the browser is unhardened and Chrome is 100% hardened

relatively speaking

the PDF viewer works just as well elsewhere and honestly it is pretty fucked up how it has like 600 dependencies

@essentialchaos:tchncs.de I'll check it was a huge comment

and is incompatible with sane Content Security Policy

The main take away from the article imo is that Google is looking to use more memory safe languages going forward

I do trust the Firefox PDF viewer more than the Chrome one personally. I don't like either.

look at how much of the Android Chromium is already written in Java

however the Chrome one is much safer through other measures

cn3m: pdf.js works fine in Chrome

you have the choice

on mobile they don't include pdfium

anyway

true, but I'm grasping at straws for nice things to say about Firefox

pdf.js is a distinct project that Firefox bundles

there's not much good there

it is by Mozilla sure but I don't think it makes sense to consider it part of Firefox just like Rust is not part of Firefox just used by it

others are just as capable of using both

@strcat:matrix.org right

you know what would be nice is if someone forked pdf.js and made it sane

and threw substantial development resources into it

I don't really think it has a long term value though

there are other approaches now

like compiling a native renderer to wasm

and then you don't need to use JS or the npm ecosystem

cn3m: so for example pdfium can be compiled to wasm

there are some projects doing that

That is the way forward for sure

thanks for the explanation

pdf.js is not just about running it in the web env but is based around the concept that writing that kind of code in JS actually makes sense

and I don't think it makes much sense

it is useful not a fundamentally good approach

you would ideally be writing that in a saner, typed language with solid type system, not relying on CSP to disable dynamic code eval (especially when the pdf.js devs actually like it and basically oppose using CSP that way), etc.

cn3m: pdf.js is useful since it's around right now and mostly works

cn3m: easy to deploy it in a web context

easier than using something via wasm atm unless someone makes a good project for that

Thanks that is helpful

just got an update will be back

#betatest

<strcat[m] "people are so easily fooled by p"> Isn't it more rational just to ignore these incompetent kind of posters?

Your energy and health costs more that trying to convince him

@kernelpaniker:matrix.org we as a community need to be active on Reddit educating

I do this for hours a day I'll help anyone who needs help getting started

security and privacy snake oil salesmen rule the web, but it's not hard to educate them

But strcat says that reddit is trash, so why try to work in this field?

Interesting blog that explains security changes in upstream linux kernel versions: outflux.net/blog

<cn3m[m] "I do this for hours a day I'll h"> And that is why good will triumph over evil

Although there's not much we can do about the actively malicious people, we /can/ do a lot about the people they con into absorbing their nonsense and then repeating it as "fact" ad populum, or whatever I think it's called.

@kernelpaniker:matrix.org Reddit is where the misinfo starts

Yarr, thank ye cn3m[m]!

it's worth my time to improve it

PTIO is improving a lot

PTIO?

privacytoolsio Reddit

they have real conversations about issues with lineage and Firefox now

\o/

<kernelpaniker[m] "Isn't it more rational just to i"> The problem is, it’s easy to label OP incompetent. Indeed, they either likely are, or are trolling/trawling. BUt it’s the user that tomes for information that is likely not incompetent, and it’s imperative to stop the spread of either intentional or unintentional information

that's the only place I have time to work

Can Anyone tell me if the Riotx dbg is the same as normal riotx?

2-6 hours a day

I asked on riot room but no one seems to respond

I could spend my time coding open source projects, yet I am the only one on every discussion on Reddit I can. I need help if you can't code this is the best way to help the project

I've said many times if people replace my work on Reddit I'll code more on related projects. Especially for privacy areas which is my forte. I think misinform is more of an issue right now

I can't work, fight misinformation, and contribute to open source projects

<kernelpaniker[m] "Isn't it more rational just to i"> It's the only way. Hope strcat understands this one day. What a waste of energy

strcat time is too valuable

it has to be us

I'll roleplay debates with me playing the malicious person to teach the community

nuttso: no because people follow / believe them and they cause immense harm

<cn3m[m] "that's the only place I have tim"> This community is really great, if a person doesn't recognize it and trying to troll/spread shitthoughts, so be it. I don't think you can change his mind. And the others...they'll understand who is right and who is wrong, if they gave at least minimum education

I'll help people do what I do

<strcat[m] "nuttso: no because people follow"> This is a battle that can't be won. Impossible. Even with 1000 people just dedicated to that

I've received dozens of threatening emails because of what this person and a couple others are doing posting threads aimed at directing harassment / attacks at me

<nuttso[m] "This is a battle that can't be w"> Agreed

@kernelpaniker:matrix.org I'll convinced an adversarial person this stuff matters and now they are working on GlassROM

anything is possible if you are clear and persistent

they turn people away from the project and cause very real harm

I'll keep doing what I do

they are actively waging a war against it and myself for unclear reasons

* This community is really great, if a person doesn't recognize it and trying to troll/spread shitthoughts, so be it. I don't think you can change his mind. And the others...they'll understand who is right and who is wrong, if they have at least minimum education

it is a huge problem

that's why education matters

that's our job

<strcat[m] "they turn people away from the p"> Uneducated for us uninteresting people

and they build on what the others do, you can see they create mountains and bullshit and then link back to it etc

and claim stuff has been refuting or whatever because they posted a pile of false claims / spin before

* and claim stuff has been refuted or whatever because they posted a pile of false claims / spin before

non-technical people are very easily tricked by them

they are actively tricking lots of people

<strcat[m] "non-technical people are very ea"> And this is something that we can't change

No matter whaz

most people are not technical enough to see that these people have no clue what they're talking about and are just BSing

<strcat[m] "most people are not technical en"> Bingo

nuttso: the harm they are doing can be greatly reduced

these bad people educate the community which doesn't research. we need active knowledgeable people here

active in the community

once the thread reaches the point that it's super deep into threads

it isn't important anymore

at that point can stop dealing with them and they can't do anything else relevant

but until then they are successfully causing harm

and letting them do that enables them to do more harm

I'd love to mind my own business and be able to work on projects and not get harassed for it. I know how Daniel feels. His work is more valuable than mine

<strcat[m] "nuttso: the harm they are doing "> Only by educating the sheep's. Lol I know people paying 1200 ever 6 months to companies that claim signal shares data with police. Tell me how to stop them. Educate the fools?

I don't want him to deal with that

Reddit matters an educated reader base helps

<nuttso[m] "Only by educating the sheep's. L"> Thats not why people pay that !

privacy/security companies, advice, guides, etc. is largely a scam by people trying to make money, promote themselves or things they support

it is a problem

and it's a problem that they start trying to harm people creating things that aren't scams like accurate documentation

People need to be educated or they will keep attacking serious projects

look at how well received that guy's bullshit guide was received on /r/privacy

and even the main moderator treats him as if he's an 'expert' for some reason, lol

just sad

<spaceinfinite[m] "Thats not why people pay that !"> No they pay them because they believe the nonsense they talk. If you try to convince such a guy that gos with signal is more secure than anything else the tell u know it doesn't cost money. Can't be. If you try to explain it technically after 20 seconds they don't listen

yeah /r/privacy is bad I can't operate there alone. I haven't even tried much

<strcat[m] "look at how well received that g"> Can you give the link?

they want to be scammed

@kernelpaniker:matrix.org it's bullshit about Huawei is the ideal phone

this guy pushes insecure Android devices and claims iPhones are bad

it's of no consequence

<nuttso[m] "No they pay them because they be"> Its a different market and different purpose

I need help with this stuff

before it's an issue

I've been offering to help people learn how to study what Daniel has written and start fighting this, but almost no one took me up on it and all start drifting

nuttso: cn3m reduces my workload and what I have to worry about

it helps in a tangible way

It's not fun, but the more people doing it the easier it is

if a bunch more people became as educated on the topics and did that kind of work

<spaceinfinite[m] "Its a different market and diffe"> Bullshit. Seems you know who I'm talking about. Encrochat and skyecc.

I would not have to deal with it much

<cn3m[m] "I need help with this stuff"> I'd love to be helpful for the project, but my language is bad

> <@nuttso:matrix.org> Bullshit. Seems you know who I'm talking about. Encrochat and skyecc.

> Skyecc talks about 521 bits of ecc to separate them from signal..lol. ecc is broken with quantum no matter what

Of course i know who you talking about but its a different market like i said

Message me if you want to help I'll teach everything I know

if I have to spend 10 hours teaching you and then you do a few hours a week that pays off

nuttso: you cant talk to juan pablo on signal though.there is a market and everyone is on that market

this is open to anyone who is willing to learn and follow through

<strcat[m] "if a bunch more people became as"> I follow you since the beginning. Research and check everything you write before accepting it. Not following blindly.

the way I see things atm

<spaceinfinite[m] "nuttso: you cant talk to juan pa"> Because he is fooled b such companies

is that due to the current environment with James Donaldson attacking the project

@nuttso:matrix.org Practice it's in the way you deliver it

along with people like these

I was downvoted a lot in the beginning

it's a fact of life

and tons of other bad things that have happened / are happening

it is just not possible to accomplish all that much right now

I learned and didn't give up

I am not too worried about it anymore

I am perfectly capable of just taking something else as the base at any point and starting over again too

<cn3m[m] "Message me if you want to help I"> Just write it somewhere, some blog, that way instead of spending 10 hours teaching some one person you can spend 10 hours writing and teach many more

strcat's time is worth 10x as much as mine that's means any time I can save him is worth it

trying to build a community of developers and other people who care about these things and want to do stuff right

that is priority #1 right now

building support for the concept

of actual privacy and security

<nuttso[m] "Because he is fooled b such comp"> Im noy saying that you are wrong, i too believe what you say and that signal and threema are way more secure.But skyecc and encrochat have a specific customers and its like people from whatsapp to change to threema.its hard

making it possible to actually do things right

@boniek:matrix.org people want easy that's why I write long posts and have chat conversations

make hardware actually aimed at providing privacy/security

I need to make this easy

@boniek:matrix.org I'm not going to make some blog

rather than yet another kickstarter scam

that doesn't help

imagine if just one of those kickstarter things had actually been interested in truly making a more private / secure phone for real

and putting in the work to actually do that

my dms are always open, but I've spent too much time here and no one really seems interested I need to go back to reddit

<spaceinfinite[m] "Im noy saying that you are wrong"> I know the CEO over at encro. We had a bad clinch. He threatened me with murder. Lol fool

IME those companies are actually heavily involved with criminals and organized crime

that is essentially the path James wanted to take while pretending otherwise

<strcat[m] "IME those companies are actually"> They are. Don't estimate gos isn't used by more educated criminals

he signed deals with criminals who were later arrested / shut down and tried to make deals with others

On beta, wired audio is working again

Also what is a criminal is country depending in some cases

On 3xl

nuttso: I'm saying it to mean organized crime type stuff

<strcat[m] "nuttso: I'm saying it to mean or"> Even better for us if organized crime uses the os. We can see what forensic is capable to do

Possibly better behavior on plugging / unplugging headphones than before when it recently broke

it should havei mprovements over before when it broke

for bluetooth etc

from the new workaround

the previous attempt at truly fixing it just didn't pan out

it made some things better but broke others

valldrac found what was wrong with bluetooth, etc. tho

and that led to this new workaround

nuttso[m]: speaking as a non-technical "sheep" myself, education is possible. it's also true that the sea of contradicting information on reddit isn't helpful, particularly when it's over the head of the average user

just a bumpy road to it

and it's not really fixed

<strcat[m] "IME those companies are actually"> Those companies have moved over to iphone now

apparently the code goes away in master tho

spaceinfinite: encrochat etc.?

<spaceinfinite[m] "Those companies have moved over "> With mdm based on blackberry

at least they don't try to provide their own OS anymore then

<strcat[m] "at least they don't try to provi"> Haha

<strcat[m] "spaceinfinite: encrochat etc.?"> Yes, skyecc etc

<nuttso[m] "With mdm based on blackberry"> Yes

I know them all. The only company that really does what they promise and is more advanced than what we have here is GSMK

<nuttso[m] "I know them all. The only compan"> I personally believe they sell the server i dont believe their encryption is any thing special than lets sat threema

Gsmk?

I know Karsten Nohl and Frank Rieger personally. Lately I talked to srlabs about snoopsnitch and this is here

Gsmk hardens the device and lately produced their own

<strcat[m] "it should havei mprovements over"> I've not got any Bluetooth devices to test, but wired appears good

@freenode_chani1:matrix.org that's not true. There's a monoculture of privacy and security theater right now

if we push good ideas that helps GrapheneOS

when I started everyone in PTIO thought Lineage was more secure now. Now PTIO is researching modifications to the listing

<nuttso[m] "I know Karsten Nohl and Frank Ri"> You seem to know the right people.i read a bit about Nohl

<spaceinfinite[m] "Gsmk?"> cryptophone.de

there's posts everyday discussinh these security issues

I grew up with them

it can be fixed and it directly helps

if you can't or don't want to code this is the way to make a difference

Hey all. I'm trying to install GOS on a new Pixel 3a XL and have some issues unlocking the bootloader. I've enabled OEM unlocking in the system settings and I can boot into fastboot mode, but when I type "fastboot flashing unlock" nothing happens. Any ideas?

<nuttso[m] "I grew up with them"> Nohl is the guy who did the experiment on ss7 with that goverment guy?

I love how strcat makes massive walls of text ripping any argument the other guy had to shreds

Nohl is big player over at chaos Computer Club. He is a genius at mobile security

It's refreshing

Sadly they don't have time to dedicate here. He is aware of the project.

<nuttso[m] "Nohl is big player over at chaos"> He'd a legend i know. Good for you that you can learn from him

<spaceinfinite[m] "He'd a legend i know. Good for y"> Both these companies are in Berlin. I visit them a lot

ducky2: perhaps a permission issue - which OS are you flashing from

ducky2: make sure to try the troubleshooting advice about USB ports, cables, etc.

<nuttso[m] "Both these companies are in Berl"> So you are german ?

ducky2: and note what it says about udev rules - i.e. that Linux distributions specifically don't allow access to local USB devices that don't fit into some narrow classes of devices

I'm trying very hard to find someone to sponsor gos. I'm close to accomplish this

ducky2: without root access, or udev rules set up for each additional class of device

<spaceinfinite[m] "So you are german ?"> No. But I live there

nuttso: the ideal would be a company that wanted to make hardware

nuttso: that's private/secure

<strcat[m] "nuttso: the ideal would be a com"> Htc

nuttso: and they want to ship a fork of GrapheneOS as their OS

and make it available to us

for our use

Only company I would go with

nuttso: was contacted by them before but they wanted too much from me without giving anything

I'm running fedora 32. Connected to a USB 3 port on the mother board. The cable... well, it's the only one I have at the moment.

nuttso: potentially still on the table

Wow

requires having people willing / able to deal with them

to write proposals and so on

I'm not really interested in jumping through any hoops

others have to do it

<strcat[m] "nuttso: was contacted by them be"> Afaik they are the only company that can guarantee the integrity of the supply chain

I just want to work on the project and manage the technical aspects of it

<strcat[m] "requires having people willing /"> I read somewhere they ate about yo comeback into market with new phone

if you need an Enterprise phone buy a Pixel or iPhone and use their support

secure and privacy focused devices are a sham

<nuttso[m] "Htc"> Aren't they half-dead?

partnerships with companies, etc. require having people to work on that

<strcat[m] "I just want to work on the proje"> I know. I listen to what I write

they take old features from Google, Apple, and GrapheneOS and sell them as the big new thing for much more

<cn3m[m] "secure and privacy focused devic"> 🍎

ducky2: try unplugging the cable and connecting it back again

<EssentialChaos[m "Aren't they half-dead?"> No

nuttso: I know just saying that the problem ends up being these companies just message me

and they misunderstand GrapheneOs

* and they misunderstand GrapheneOS

it's an open source project / community

not a company

exactly

I want to collaborate, they want to pay for something / license something

so requires people who understand and support the project

to deal with this aspect of it

already tried reconnecting the cable several times.

Nutsso can be the middleman

ducky2: if you're on a linux distribution it probably just doesn't allow you to use USB devices as non-root

Inb4 "what about Purism"

<madaidan[m] "Inb4 "what about Purism""> Bad, bad company

<madaidan[m] "Inb4 "what about Purism""> No

madaidan.: btw I have personal experience of trying to get them to fix things, etc. and all they wanted was to get me to give my name to be used to claim I was a partner

to push their stuff

hm... it should. I just sideloaded the latest update of android 10 without any issues.

madaidan.: they reach out to ppl to get them to say they are partners and make it seem like there's all this collaboration, etc. that there isn't

ducky2: try the `fastboot devices` once you sort out what strcat is asking you to do. if at that point it doesn't work, your cable is unfortunately the issue.

ducky2: fastboot is different than adb

different class of USB device

so you may have udev rules that work for adb but not fastboot

Hmmm, HTC could market this as a secure OS for government organizations...

the udev rules are just to make it work as non-root

<strcat[m] "madaidan.: they reach out to ppl"> I didn't know that. That's even more shitty.

madaidan.: I spend substantial time trying to talk with them, raising concerns, suggesting things, telling them what would be needed to support the device

all they wanted to do is sweet talk + convince me to let them use the name of the project / my name to promote their product

Btw that anonymousejoker guy is on his last chance in r/privacy. That recent discussion might get him banned.

He probably fucked himself over by pinging the mods

fuck

I don't want him banned

his name is known to be bs

fuck

cn3m: doesn't seem that way

cn3m: Don't worry, he'll make a new account

ok, "fastboot devices" says I've got no permissions. Any way to change that?

people seem to support him even though he's clearly a bullshitter

on PTIO at least he's known as a clown especially debating me

ducky2: use root or set up udev rules for it

either way requires using root

I will have to start all over on arguing with his alt

ducky2: just an issue on Linux distributions - they don't allow access to local USB devices from a local session without root unless they are within certain narrow classes

they need udev rules for each kind to make it work

I wish I could get on /r/privacy, but the site is too fast and has too much misinfo and misdirected paranoia

<cn3m[m] "I will have to start all over on"> Not really, because you already established a name for yourself

I need help

if I want to move to /r/privacy

ok, I'll look into the udev rules. New concept for me... thanks.

either help me maintain the grounds gained on ptio or help with /r/privacy

btw pls let me know if there are any issues with the beta releases

<strcat[m] "people seem to support him even "> He does have some supporters who are just as irritating. People like CDr0m, ubertr0_n etc. are all big supporters that I have past experience with.

ducky2: or just run fastboot as root - if you're using sudo from your account regularly it makes no real difference

All spread the same bullshit.

madaidan.: if they are really different people

strcat: that mouse guy is fucking annoying, just ask madaidan, cn3m, etc

I have experience with some of these people (not that one specifically) from before GrapheneOS

back in 2013

<strcat[m] "madaidan.: if they are really di"> I think the ones I listed are different people. They've been there for a long time and they act very differently.

u/Kyxrn has to be an alt though.

<strcat[m] "I have experience with some of t"> What do you mean?

spreads bullshit and retarded "rebuttals" all over, slanders others pointing out his logical inconsistencies / conspiratorial fearmongering, plays victim all the time, etc

madaidan.: I mean I dealt with the same kind of tactics when working on Rust

<strcat[m] "madaidan.: I mean I dealt with t"> Ah. Those type of people are common.

madaidan.: and I know their strategy of trying to ostracize someone, play the victim, take offense to being called out on dishonest / manipulative tactics

madaidan.: some of them are the *same people* now

He's one report away from a permanent ban from that particular subreddit though. I don't know if that's actually a good thing. He'll probably go on a vengeful crusade on other subreddits spreading more bullshit

I don't know what to do with that guy lol

<strcat[m] "madaidan.: some of them are the "> Some people are just forever lost causes :(

He's just parroting the same "rebuttals" over and over, along with promoting whatever shitty guides he has authored

<inquiree "He's one report away from a perm"> I expect a large post on r/privatelife once he's banned

It's his own personal echo chamber

<madaidan[m] "I expect a large post on r/priva"> "How r/Privacy censored my completely accurate guides"?

<EssentialChaos[m ""How r/Privacy censored my compl"> Probably something more flamboyant

Maybe "trai is a shill"

just look at this awesome post! old.reddit.com/r/privatelife/commen…s_indoctrination_bias_and_criticism

<inquiree "just look at this awesome post! "> I got banned because of that thread :(

The best we can do atm is to point out his BS on a more quantifiable scale

so it'll be evident that he's full of shit, even to casual subscribers

<spaceinfinite[m] "Nutsso can be the middleman"> I'm spending a lot of energy to promote and educate people about gos. I do this mainly because I have lots of respect for strcat. When he was the only developer at copperhead he still took the time to educate us in the channel. His answers where always on point and matched my own research. I really believe in him as a person. This work is important. I would only mess with

a company that could guarantee the whole supply chain. Which is not easy.

<inquiree "just look at this awesome post! "> > if you are from anywhere in the world except China, use:

As if China doesn't have allies...

if you think /r/privacy is bad, wait till you see /r/privatelife lol

it's really in a different league

This Joker guy is just an attention seeker bagging to be seen as someone who knows what he's talking about

Begging*

<spaceinfinite[m] "> <@nuttso:matrix.org> I'm spend"> I don't feel offended. just wanted to make clear why I spent my time with this. He deserves it

mxnorvak: yea, but unfortunate he's one of the most prolific individuals spreading misinformation against the project, and cannot be left unattended :(

Hi, i hope i don't disturb but i'm planning to sideload GrapheneOS on a Pixel 3a but in the installation guide it says to update to newer stock ROM before, but i fear becaue as far as i know graphene is Pie based and the latest Google ROM is android Q. Isn't there any anti roll back stuff ? Or is it as simple as update the stock rom from Pie to latest Q and then fallow the guide ? Thanks already

<nuttso[m] "I don't feel offended. just want"> I thought you took it the wrong way. All good then

But I still think arguing with uneducated sheep's is waste of time

nikoleos: graphene is on Android Q at the moment

<nuttso[m] "But I still think arguing with u"> We are all sheep one way or the other though

nikoleos: on a fresh supported pixel device, all you have to do is to follow grapheneos.org/install carefully

> nikoleos: graphene is on Android Q at the moment

Oh good news, i haven't know that untill now, i have missed this on the gos website

<spaceinfinite[m] "We are all sheep one way or the "> Yes. I know what u want to say. But educating the masses about mobile security is not possible. And this would be the only way to effectively stop misinformation

<inquiree "nikoleos: on a fresh supported p"> I have read carefully, thanks inquiree sounds clear now that i shall update to Q before sideloading grapheneOS

<nuttso[m] "Yes. I know what u want to say. "> In a way strcat is right there is so much missinformation out there

nikoleos: you may want to consult grapheneos.org/faq too

I really want this project to succeed and raise the bar for mobile security. And I think the only important people are the ones that can recognize it on their own.

<spaceinfinite[m] "In a way strcat is right there i"> So what? Like I said it can't be battled by the way it is approched now.

The future is bright the future is orange*

Graphene is definitely filling a void

I'll weep tears of blood if I ever had to go back to stock pixel

<inquiree "nikoleos: you may want to consul"> I will read it again

<nuttso[m] "So what? Like I said it can't be"> Exactly this

<inquiree "I'll weep tears of blood if I ev"> Same here. So please guys if you can't code help in what ever way is possible.

> need people to step up as device maintainers for existing devices and to develop and maintain Pixel 4 and 4 XL support

strcat (@strcat:matrix.org) recently I've sent email to contact⊙go with links to repos which I used to run GrapheneOS on Pixel 4 XL. Hope it helps.

paintedman: try to keep working towards resolving the issues + rebasing the changes to fit the same pattern of commits as the existing repos

noticed some were merged into a single one - try to match the existing split / order for the most part, meant to be a series of independent patches

we'll need to resolve issues like whatever the wifi problem is, etc.

I remember strcat writing at least 5 times that he would end it. Always got a heart attack when reading this. In some way I can understand his frustration. Especially with James. But also lots of what James is capable to do know is strcats own fault. He should have be CEO of the company also. He trusted james with it. James fucked up and strcat lost his faith in humanity

there was an amazing opportunity

a much friendlier environment with far fewer scammers

<strcat[m] "noticed some were merged into a "> It's in kernel repo?

paintedman: I think so just try to have 1:1 commits lining up

other than things that must be different due to newer branch

atm most of the past kernel hardening, etc. is missing anyway

nuttso: I think there was an amazing opportunity then and we could have had our own custom hardware by now where we control far more of it and wouldn't be so screwed by stuff like a migration to a new major release

Who's behind the GrapheneOS account on reddit? Is it solely Daniel?

nuttso: the space was much less crowded by charlatans then

inquiree: it represents the project, not just me

inquiree: and it will probably be used more often now

because I am tired of being personally targeted / harassed

so especially when dealing with people like that guy

it makes sense to use a project account, he keeps wanting to go back to trying to target me as an individual over collaboratively written / edited content anyways though

like the docs on the site

which other people like TheJollyRoger have contributed to a lot

strcat: sorry for the confusion

I meant to ask if you're the only one with access to that account

nuttso: I feel the opportunity is fading away - the space is increasingly crowded with misinformation, scams, etc.

nuttso: and people can see that substance doesn't count for anything

<strcat[m] "nuttso: the space was much less "> Doubt so. It's not that James is only a charlatan. He has some kind of mental illness. Maybe narcissism. Such people exist since the first human. You were the leader for us as a community no matter if James was the CEO.

nuttso: we also largely lost the connections we had with AOSP, Pixels, etc.

nuttso: and connections that could have gotten custom hardware done for real

<strcat[m] "nuttso: we also largely lost the"> Can be recovered

James was screwing things up and sabotaging what I wanted to make long before he pushed me out

he got fed up of not being able to pursue totally unethical things totally outside what had been agreed upon

and just decided to pull a completely illegal and unethical takeover

<strcat[m] "James was screwing things up and"> I know. I talked to this guy one time via email in copperhead times. He is a joke. I can show the email.

he is actually a very evil person, and totally deluded

how did he think it would benefit himself to pull what he did

<strcat[m] "he is actually a very evil perso"> Narcissism. Read about it. More deeper. I had the same experience.

he totally fucked over my life and the work I put into this for years

it is totally screwed up now

I continue working on it but it's not the same

<strcat[m] "paintedman: I think so just try "> Ok, I got it

I don't have much hope about it now and am just not particularly motivated to pursue these partnerships with companies, etc.

been screwed over and used/manipulated too much by too many of these people

don't trust any of them

<strcat[m] "he totally fucked over my life a"> I offered you multiple times help with this. My only wish was to talk about it over a secure channel. You have my Signal number. Never reached out to me

nuttso: send me your number again in a PM

not promising to reach out

nuttso: I already tried to have 2 other people deal with the non-technical aspects of it and James drove one of them away and then ruinedi t all

* nuttso: I already tried to have 2 other people deal with the non-technical aspects of it and James drove the other away and then ruined it all

I need to be able to delegate all that stuff to someone else that I can trust while having more failsafes

<strcat[m] "not promising to reach out"> You see. You're not willing to try anything to end this. But at the same time you whine about his behavior.

how am I supposed to end it?

<strcat[m] "I need to be able to delegate al"> You don't trust anyone anymore

he is going to continue

nuttso: I trust TheJollyRoger

nuttso: what I really want is for other people to do stuff

I am working on an early stub implementation of Google Play Services based on some basic network failure data from Google Play Services for GrapheneOS. I am testing on a spare test system with signature spoofing enabled for development purposes right now. Is there any resources on how the project is looking to do this beside AndroidHardeningArchive/legacy_bugtracker #649 and

grapheneos.org/build#development-guidelines? I can use applications it should be tested with. Is there an applicable list or design goals? The project is a very early Kotlin mockup designed on a standard signature spoofing system. It needs a lot of work

Jollyroger asked me if I would go to court with my real name for u as a witness. I would.

He is a good guy

Is anyone else with newpipe having an issue with browsing files in the newpipe file browser?

But stop whining about James please if you don't take all opportunities available to u ending this

<radixed9[m] "I am working on an early stub im"> Nice

Just noticed with the newest version of Newpipe that the "Import history and settings" button that it defaults to folder "/storage/emulated/0" that shows up blank, possibly because the last / is missing at the end

<nuttso[m] "But stop whining about James ple"> why are you so aggressive?

doesn't seem to read the content in folders anymore in GrapheneOS, probably an app issue but just curious if anyone else has run into it

If I can receive any assistance on the specific goals of the implementation or if there is a more important first project I am open to exploring that information.

@nuttso:matrix.org chill the fuck out man. Daniel is doing what's best for his project. Don't be so pushy

my priority right now is just getting by

not really focused on the project

New update solved the issue with Bluetooth headset during calls. Well done, thank you so much

<cn3m[m] " @nuttso:matrix.org chill the fu"> Man I know. But I have to make him somehow stronger. He still gets his energy drained by this fool. I see Daniel as someone that has integrity. Having integrity means you are real. And not writing someone that offers u help with a problem woth somebody, but still writing that nobody helps is not integrity.

I need all the nonsense with James / Coppperhead resolved and out of the picture

Daniel is found a great job doing a lot of jobs let him speak his mind and work in the background. don't go around telling him why you should be in charge of stuff since you don't like how he's doing it

GrapheneOS succeeding doesn't get rid of James or repair my life

<cn3m[m] " @nuttso:matrix.org chill the fu"> Maybe it is nonsense what I have to offer maybe not. He doesn't know until he talks with me about it. Neglecting an offer for help and still stating nobody cares is not right.

<strcat[m] "GrapheneOS succeeding doesn't ge"> Only you can repair it

@nuttso:matrix.org what's nonsense is how hard you're pushing

make your case and take his response at face value

chill everyone

> GrapheneOS succeeding doesn't get rid of James or repair my life

It means that you are able to recover from shit situations, i think it s very positive

btw, how is copperhead still float?

afloat*

<cn3m[m] " @nuttso:matrix.org what's nonse"> No. Somebody presenting himself as a person with integrity will always be questioned

<inquiree "btw, how is copperhead still flo"> sick dishonest people

@nuttso:matrix.org This is his/our project and he's doing work. He doesn't have to trust or bend to your every whim when you want him too.

Training companies in security habits is a good bussiness idea, probably thats how it s still alive

if he wants your help he can get it. Criticizing the only person getting real work done on this project over BS is not helpful and you know it

shame they don't hold workshops on stealing donations :(

real full time work*

I solved the issue I had with unlocking the bootloader on fedora. Had to run the command in the fastboot folder (even though I added it to my PATH) like this: sudo ./fastboot flashing unlock

<cn3m[m] "if he wants your help he can get"> You don't get it. Criticism is a good thing as long as it is true. Sure if he wants my help he can get it.

@nuttso:matrix.org help in the ways he's already clearly said he is comfortable with

Just got another update, was that the Bluetooth fix by chance?

brenneke: it rolls back the previous bluetooth fix (which broke other things) and has a new approach

<cn3m[m] " @nuttso:matrix.org help in the "> We don't know if what I can offer as help he would be uncomfortable with. It never got to the point of evaluating this

@nuttso:matrix.org don't push him to accept your solution and criticize him for not wanting to rush into it

you can go to Twitter or new sites and check updates where there's misinformation

you can go to Reddit

Theres many ways to limit the damage James has done

You fixate on the one that puts you in a position of authority

the problem is he has bet everything on this takeover, pushing me out and ostracizing me

<cn3m[m] " @nuttso:matrix.org don't push h"> I don't push nobody. I don't criticize nobody for accepting a solution. I criticize for not taking all opportunities available. Not even hearing them

he is not going to stop

he has bet his whole life on this

he has no fallback plan

@nuttso:matrix.org he said he might reach out to you

end of story

he thought he would succeed at coercing me into giving over control and ownership of everything to him

be available if he wants it

and he has deluded himself into thinking he is some fancy CEO with business skills and capability to do more than scam people and stealing their money without delivering

* and he has deluded himself into thinking he is some fancy CEO with business skills and capability to do more than scam people and steal their money without delivering

I don't see any way he will stop

we need to get ahead of misinformation by propogating good information as a community

it's time intensive

roll up your sleeves this isn't a fair fight

we need to work harder then they do

<cn3m[m] " @nuttso:matrix.org he said he m"> Yes I can read thanks. I offered him this some time ago. And later I had to read on this channel statements like nobody helps. I don't care if you get the point I'm talking about.

Work on something else for him that he asks for

you are asking for him to trust you

<cn3m[m] "Work on something else for him t"> I do

More than other guys here

<cn3m[m] "you are asking for him to trust "> No

being aggressive isn't a good way to build trust

<cn3m[m] "you are asking for him to trust "> I'm asking him to keep his integrity

And would like to free I'm from james

U assume I have bad intentions

But this is not the case.

If you ask him something he has to think if he's comfortable with that's in his right to think about. That's not in scope of him turning it down help. He's not turning down simple things he's not turning down you at all

I don't know how you think about this. But when someone offers me help and I don't even listen to what he has to say but still make the statement nobody helps me, it's simply not the truth

That's not the situation and you know it

<cn3m[m] "That's not the situation and you"> That's the situation

What you're asking for is complicated

give him time

Wtf

He doesn't have the possibility to evaluate my solution without even knowing it. Lol what have you done hahahaha

You're talking about getting a bunch of outside involvement and money. He has to make a decision if he's comfortable with it and you. If your read his reddit he's focused on getting help from the community. He can make his own decision how to go forward. it's not my place or your place to judge his call

If he wants your help occasionally remind him

no need to fight about this

like you started out doing

Yes let's end this please

fair enough. I rest my case

I'm sorry if you think I'm aggressive cn3m

<nuttso[m] "I'm sorry if you think I'm aggre"> I appreciate you saying that. I hope we are all good

<cn3m[m] "I appreciate you saying that. I "> We are good. But u missed the point

If I switch to the beta release channel from stable in the system update settings, is that all I need to do to be able to contribute to beta testing or do I need to reflash thedevice?

I think we both made our points clear

nuttso: you are on the right track my friend

@fomijafi:matrix.org yes you're good

Thanks, switching over now

Good night guys

<spaceinfinite[m] "nuttso: you are on the right tra"> Thx try to be

fomijafi[m]: yes, you can switch from stable to beta at any time you like, but if you want to switch back, you will need to select "stable" and then wait until the next update is pushed, that's all.

Got it

This is by design; the Titan M will only allow upgrades, but it won't allow you to downgrade to an earlier version, to prevent a rollback attack.

Are there any resources for my stub development question beside those previously linked?

Btw anyone using riot? Do you have the font on normal/large/larger?

Or am i getting old ?

On normal fomt size is too small and cant read

It s big enough stock size pixel 3 5.5"

<strcat[m] "brenneke: it rolls back the prev"> Thank you!

<radixed9[m] "Are there any resources for my s"> What parte of google services are you planning to replicate?

is modem in pixel 3 isolated?

boniek[m]: yes, the modem in all modern android handsets is isolated via SMMU. Pixels are the best for this.

The modem can only read from or write to locations in memory that the driver in the kernel specifically allows it to.

<TheJollyRoger "boniek: yes, the modem in all mo"> thanks!

<xabierd[m] "What parte of google services ar"> The goal is to make it appear as google play services are available offline. Unbreak apps right now. There is more I am interested in down the road.

Yeah. Even if the modem gets compromised, it can't access host memory. Since the host loads the firmware when it boots, rebooting your phone should reset it to a known good state. It doesn't save state.

I can stub a basic implementation of as simple code I can and allow the user to opt apps into using. This will help with compatibility

* I can stub a basic implementation of as simple code I can and allow the user to opt apps into using it. This will help with compatibility

I am looking for more information regarding exactly what the project wants as I am working to bring this beyond a half baked POC

<cn3m[m] "I've been offering to help peopl"> Id love the ability to study. I lack a proper device to develop anything for this project but i am on reddit every day

@frloonie:privacytools.io message me and I can give you resources and mock debates with me

cn3m: what other rooms are useful her

Here*?

@spaceinfinite:matrix.org don't use matrix or Reddit for information on security

follow who Daniel follows on Twitter

Twitter is where all the real research happens

or is shared rather

Hmm but questions are more answere here than twitter

On twitter is general knowledge

I find this room much more informative

this matrix room is worth searching

yes

it's the only exception

There is always an exeption in every field of life

this room and Twitter is the only areas I don't see a ton of security and privacy theater on

I'm in others to fight misinformation, but I don't recommend it

Yes i see the spite room, ptivacytools room asweel

spite is the second most decent room here

still not a reliable source

I can see from comments

This room is growing

Reading nm.reddit.com/u/DanielMicay is a good idea too

Yea i know,I followed daniel a long time

you can also read the comments from me and madaidan at /u/madaidan and /u/cn3m if you feel you have to read Reddit

You and madaidan also on reddit i seen you are very active

dazinism: on the wiki, do you have to be a registered user to add pages? I can edit them just fine, but can't seem to add a new page.

Reddit is good for science and history nothing else

Twitter is what you're looking for

less better information is better than more bad information

Already on twitter on daniels list and some more but thought worth asking you

<cn3m[m] "Twitter is what you're looking f"> I understand buy on twitter you cant get answers you can get on this room,specially when daniel answers

Ask here

unless it's offtopic then wait until you see madaidan or I active on Spite?

So are you the mod on r/graphene?

that's correct

Nice

You are very active on reddit and here

That's the best tool I have to help the community

If our community steps up I can start developing on open source projects with my free time. For now I do what I have to do

From what i read before you were are in advertising so you have the knowledge

<cn3m[m] "If our community steps up I can "> I feel there is nit enough people with knowledge here to step up as required

@spaceinfinite:matrix.org Yes, my strength is in privacy research. I am not a security expert, but there's an overlap

threat modeling and spotting theater

@spaceinfinite:matrix.org I offered time and time again to help anyone who needs it to get up to speed

I'm an open door

if I have to spend 10-20 hours training 6 people that are able to all able to do half the work I do and spread it to 3 subs that's worth it for me

Huh. I wonder if I should distill down my GrapheneOS Knowledge base? I could try adding some more of that as well, I've kinda left it unmaintained...

<cn3m[m] "if I have to spend 10-20 hours t"> 20 hours training at what?

@freenode_TheJollyRoger:matrix.org no one seems willing to read blogs and such. I just have to sit down and explain it all to everyone over and over again with this tl;dr society

How to maintain privacy?

@spaceinfinite:matrix.org sharing my knowledge and mock debates so they can help on Reddit

a few hours per person

if they stay on topic

But i doubt it will work or depends on subject or person

if you look back to my first posts my comments were buried since I couldn't explain myself well and no one heard these ideas. After a week it starting being more popular. 100 hours later there's a marked change in the sub. There's still much more work to be done

Got it. :(

If someone really had the drive they could research my comments. This stuff keeps coming up in the same way and I keep arguing with the same people with little verbal support

Lol

cn3m[m]: if you have blogs to recommend, what are they?

@freenode_TheJollyRoger:matrix.org It doesn't really hurt, but if people aren't going to read it besides people like you and me?

Careful of burnout though

@freenode_chani1:matrix.org will link some in a minute

I see you madaidan strcat giving answers long like poems and again an again

@spaceinfinite:matrix.org I'm trying to minimize Daniel's burnout. If people start helping me help him we can get a chain going

Yarr!

<cn3m[m] " @spaceinfinite:matrix.org I'm t"> As i said few hours ago, in the emd good will triumph

cn3m[m]: i get what you're saying about not wanting to cater to tl:dr culture, but honestly, I think it might be worthwhile to increase the ratio of good information in these reddits by writing posts that are more explanatory

And it is step by step

microsoft.com/security/blog is worthwhile too

<chani1 "cn3m: i get what you're saying a"> you're going to have to explain that

I wrote this whole thing for one person reddit.com/comments/gro3rc/comment/fs2o8bf

I can't get more explanatory imo

<TheJollyRoger "Huh. I wonder if I should distil"> As in the FAQ section of the GrapheneOS site? I think you explain subjects very well and i have always enjoyed reading your explanations so I'd be happy if there was more

Hi mxnorvak[m]! Thanks, I actually have a small backwater repository of stuff I've collected on GrapheneOS and notes I've taken at github.com/Peter-Easton/GrapheneOS-Knowledge although it's a tad bit dated.

one of the things I keep seeing over and over again on reddit threads is people having slapfights contstantly, and you've got to have the time and patients to dig into the arguments to understand what's going on

TheJollyRoger: haha, didn't realize that was yours. DannyWorkOrderPr recommended I link that on the new wiki and work on getting that info ported over

Ah!

Sure. I can help jump in and try to help a bit there once I've got some stuff on this end figured out.

it's slapfighting a lot of it is

That has consistently changed people's mind

cn3m[m]: part of the problem is a lot of these arguments get really into the weeds really quickly, and the average user doesn't really have the technical knowledge to evaluate the claims made themselves

Yeah. So this is why quantity tends to win out in the end.

one guy was very misinformed and aggressive. When we got to it he changed his mind and is working on some cool security projects build on meaningful measures

I'm trying to change one person at a time. The general disposition of the sub

I'm the only person on every thread related

cn3m[m]: that's awesome! I want to see more of that happening.

if there were more people that would happen faster

It's not that hard

It's frustrating, but they aren't attacking my life's work. I can't imagine that for Daniel.

Yeah...

if you aren't coding you should be beta testing and fighting misinformation

<TheJollyRoger "Hi mxnorvak[m]! Thanks, I actual"> I'll check them out ,thanks

even just a little bit

I'm just saying I think it's more effective to fight misinformation by providing good information in a a clear format for a wide audience than arguing with internet trolls.

sadly, there's a lot of trolls floating around those subreddits, and there's a huge lack of solid information available in a non-technical format

I'm making a difference in those subs

cn3m[m]: I'm not suggesting you aren't.]

the trolls are usually walking back statements

the culture is slowly changing

that's the most effective method available

<chani1 "I'm just saying I think it's mor"> I like this idea

upvotes on Reddit matter it's stupid but it does

if we work together on Reddit it will work. Even me going mostly alone works

you guys are missing the point

blogs and things won't help

you need to go to root of misinfo and paranoia

that's Reddit

cn3m[m]: I'm not suggesting blogs, I'm suggesting informative posts on reddit

cn3m[m]: ones written in a way the average user can understand

That's going to be called shilling

that's not going to help

The people who don't like me are very active at trying to say I'm biased

if I start making posts I make myself a target

winning in the questions is how I have to do it

the climate there is not what you think it is

Got the patch. Thank you, @strcat:matrix.org