Final

https://discuss.grapheneos.org/u/final

Still fighting. Technology writer, security researcher and engineer, contributor #GrapheneOS. Npub used for post comments and support.

Different key? Burned my last npub. See first note for verification.

Public Key

npub1hxx76n82ags8jrduk0p3gqrfyqyaxnrlnynu9p5rt2vmwjq6ts3q4sg75y

NIP-05 Address

final@stacker.news

Profile Code

nprofile1qqstnr0dfn4w5grepk7t8sc5qp5jqzwnf3lejf7zs6p44xdhfqd9cgspzpmhxue69uhkummnw3ezumt0d5hszrnhwden5te0dehhxtnvdakz7c7vww5

Publishing to

nostr.mom

nos.lol

nostr.bitcoiner.social

Author Public Key

npub1hxx76n82ags8jrduk0p3gqrfyqyaxnrlnynu9p5rt2vmwjq6ts3q4sg75y

Show more details

Last Notes

2024-10-29 16:30:16

#GrapheneOS device deployment and management was mentioned in the requirements for a director-level job vacancy in a large (multi-million) NGO about wildlife and environment preservation. Their overall security commitments outside of their mobile security demands is also very impressive.
https://image.nostr.build/1f5a43c393de180f0d007718fb81b9fb1327cc6ab93cc4cc669c33fdc6f98da0.jpg
It is great to see big organisations with big requirements choose GrapheneOS because they know we provide security and privacy other platforms do not have. For too long users with tougher security requirements were left in the dark because every commercial OEM is often thinking about seamlessness or user experience. Users should have the choice to go above.
Let it be a message to every exploit broker and mercenary who tries to use our name / the platforms we support for marketing an urgency to attack our work: You cannot claim your actions to be for the greater good. You want to target a project that protects people in organisations campaigning for a cause far more important than yours. GrapheneOS works for good while you arm oppressors who work agsinst causes like the ones above.
The security community's greatest principle is transparency and you can't claim yourself to be trailblazers when you keep research a secret and we will continue our work in spite.

2024-10-25 19:16:37

- reply

When we had previous reports for this it was usually because their phone had automatically rebooted from our auto reboot feature (it may unlock slower for first unlocks), or if they are switching between profiles and there may also be a slowness as the profile is starting up.
I can't really say I experienced this myself although I use the latest device which will be faster. My 6th generation Pixel didn't have any noticeable differences.

2024-10-25 10:16:42

#GrapheneOS version 2024102400 is out. It brings back the a stricter DNS leak block that was previously reverted due to it breaking a lot of popular VPN apps (notably Proton VPN). An additional fix was made for the VPN DNS routing to prevent the compatibility issues from before. The ancient Android bug to do with widgets in secondary users disappearing have also been fixed by us.
IMPORTANT NOTICE that only affects a small amount of users: Apps which were only installed in secondary users but not Owner before updating to Android 15 and which were then installed in Owner after updating to Android 15 will have a one-time revocation of their Network/Sensors permissions after updating to this release as a minor consequence of migrating them from Android 14 again. If you installed an app, check those permissions!
Changes since the 2024102100 release:
- switch back our original stricter approach to DNS leak blocking from our [2024050900](https://grapheneos.org/releases#2024050900) release with an additional fix for an Android DNS routing bug causing requests to the VPN DNS servers to be routed incorrectly, which should avoid the compatibility issues experienced with certain VPN apps when we tried to ship it before
- avoid resetting Network or Sensors back to the global default after app updates in a specific case when migrating the state from Android 14 or earlier
- add an extra one-time migration of Network and Sensors being disabled in Android 14 to Android 15 to work around an issue with the previous migration of the permission state which occurred for some users with some of their apps
- fix ancient Android bug causing widgets to disappear from the user's home screen when the user stops, which was a major usability issue for secondary users
- Keyboard: extend fix for upstream layout bug in landscape mode to fully fix it for 3-button navigation in addition to the default gesture navigation
- Gallery: fix upstream cropping activity bug when both the input and output URI is the same to fix setting profile pictures for user profiles
- raise backup service transport (Seedvault) timeout from 10 minutes / 5 minutes to 60 minutes / 30 minutes to handle very large backups, particularly for the device-to-device mode which includes nearly all app data
- temporarily revert enforcing minimum 64kiB stack guard size for arm64 since Facebook recently included a buggy stack overflow check for the React Native Hermes runtime that's incompatible with larger gap sizes and beginning to be shipped by apps (revert was not applied for Android 15 port)
- Sandboxed Google Play compatibility layer: add stubs for update_engine wrapper API to avoid potential Play services crashes if the existing approaches to disable the update service fail
- Pixel 8, Pixel 8 Pro, Pixel 8a: disable Wi-Fi HAL debug logging to avoid memory corruption caught by hardware memory tagging on GrapheneOS
- kernel (6.1): update to latest GKI LTS branch revision
- use hardened GrapheneOS 6.6 LTS kernel for microdroid virtual machines for both arm64 and x86_64
- Vanadium: update to version 130.0.6723.73.0
- GmsCompatConfig: update to version 145
https://grapheneoss.org/releases#2024102400

2024-10-12 14:03:55

New change to #GrapheneOS website.
You can now see which device has which releases in Alpha, Beta, and Stable channels. This let's you know what release you'll be on depending on the channel you used.
https://grapheneos.org/releases

2024-10-12 12:25:37

Android Auto with GrapheneOS on OSMand maps
#nevent1q…myu9

2024-10-08 21:05:08

New GrapheneOS update out now folks. Contains this month's security patch level and some fixes with memory tagging by patching some Android memory bugs.
#nevent1q…7e5q

2024-10-01 08:08:12

- reply

That npub was burned, I don't use that one anymore.
(Check GrapheneOS forum profile for npub so you don't click a sketchy from me.)
It's not something we come across, but we are aware Orbot has some problems, that's why a Tor VPN app is being redone (not by us) in the future.
We are aware of leaks caused by some VPN apps and we keep making patches to fix it but they end up breaking said apps and force us to revert. It's predominantly an app issue, look at the posts on my old npub about Mullvad to get what I mean here.
Latest build added a second-generation leak prevention mechanism but for it's for multicast leaks: https://grapheneos.org/releases#2024092900
I'd contain Tor usage in its own profile so I don't see this happen. I guess if it happens right when Orbot is connecting, give it a few seconds after connecting before doing something?

2024-09-30 06:19:26

Top of Stacker News, thank you so much.

2024-09-29 21:05:13

#GrapheneOS: The Purpose, The Strategy, and The Why [Article]
This post explains a bit about the development approach, reasoning and strategy behind GrapheneOS security innovation and how power users protect themselves.
On SN: https://stacker.news/items/705242

2024-09-27 17:35:40

Using an app that locks with the OS credential like Phoenix Wallet in GrapheneOS allows you to trigger the device duress password when starting the app because the duress feature also extends to any OS credential input. This doesn't extend to apps exclusively doing their own implementation of a PIN though.

2024-09-27 07:32:11

- reply

The older generation face scanning hardware was far more robust and secure and the current face unlock options are far less.

2024-09-27 06:44:30

- reply

Didn't have the zap address back, only the NIP-05 (which is the same as the zap address)

2024-09-26 19:14:46

- reply

RE: Chainalysis
Companies targeting users of cryptocurrencies like Blockchain analysis firms being a fan of the tech would be expected. I would expect they use it on a daily basis and would know more about it than the typical maxi would. In conferences i've met FBI digital forensics lab staff who hold Bitcoin because of learning more about it during seizures.
We have a similar two-faced relationship with forensic companies who try and target GrapheneOS and the Pixel platform. Hate that we do whatever we can to break their capabilities but some definitely use GrapheneOS because they are impressed by the security offerings. I also find some of their tools interesting. Chainalysis is a very well made application.

2024-09-26 18:20:41

What would you want to see in a post about #GrapheneOS? Preferably something you've not seen in posts before. I want to be unique here. Is there a feature you want to understand the technical details about? Maybe a justification on X? Would be inrerested to know.
#nevent1q…u8hv

2024-09-26 11:12:32

- reply

Believing they are using the literal definitions to base their statement here... For data to be uncensorable it needs to be known and distributed to everyone. Online privacy is about reducing, hiding, or anonymizing data so it's not known. Some privacy techniques involve self-censorship.
You can use censorship resistant platforms with privacy technologies like onion routing to make the connection between your identity and the platform private, but what you create on the platform is never private.

2024-09-26 11:00:35

- reply

If a nation state had been in my old phone I'd almost consider it a compliment because I am fucking boring 🫡

2024-09-26 08:02:33

Every time a GrapheneOS post trends on SN I feel like delaying my big post I promised a year ago because I don't want to oversaturate the trending with the project. Suffering from success...

2024-09-26 07:43:15

- reply

Wasn't really something I looked into since it was extremely unexpected. Also up to believe official GrapheneOS platforms would suffice in announcing my key change. I dont want to spread fear by people misunderstanding a personal and isolated incident as a GrapheneOS one.

2024-09-26 07:29:56

- reply

All the text the LLM produced are just explaining the default features of Android (secure boot, disk encryption, data collection etc). Doesn't go into the features of any of them. Also some features like "secure boot" (likely means Verified Boot) depends on device support. Replicant definitely doesn't have that.
Id look at: https://eylenburg.github.io/android_comparison.htm

2024-09-26 02:43:49

- reply

That would be the standard procedure, but circumstances about the event meant I couldn't. Users should announce change of keys if able to.

2024-09-25 22:50:46

- reply

I didn't put the links as some people may have thought links may be phishing (IF YOU DO, GO FIND MY PAGES ON A SEARCH ENGINE INSTEAD! DONT TRUST ME!)
BUT, if you kinda trust me:
Official GrapheneOS forum page: https://discuss.grapheneos.org/u/final
My stacker.news page:
https://stacker.news/final
All zaps are going to the original address the old npub has as you can see on my profile so I earn nothing doing this if I was a real faker anyway.

2024-09-25 22:48:13

- reply

how im looking today
https://image.nostr.build/e32bccf36796b26d7877f8bccdee568d20406e2018f1c136c27e39f3ee5e38f4.jpg

2024-09-25 22:46:00

- reply

I understand. I imagine I have really annoyed a ton of people but oh well.
Key pairs for Nostr are great for verification but are a disadvantage towards certain security measures. Nsec is only as secure as the app that generated it and is only as secure as the least secure platform you stored/used it on. Takes a lot of responsibility, which I'm fine with, but most people aren't.
If you want to change security requirements (like me) you likely need to burn your key... I guess it's no different to PGP keys that expire on a set time but I'd really be waiting for a dedicated secure hardware signer before I ever share my Nostr nsec keys on any other app or device... and id probably also rotate my keys again if a device existed.

2024-09-25 22:33:32

- reply

He has bursts of being quite busy.

2024-09-25 22:27:21

- reply

Metroplex: @nprofile…jrax
He was in Nostr before I was.

2024-09-25 22:26:42

- reply

1. npub is burned, can't post what I don't have the keys for.
2. Official GrapheneOS forum page: https://discuss.grapheneos.org/u/final
3. https://stacker.news/final
Trust me or not, it's up to you. All zaps are going to the original address the old npub has as you can see on my profile so I earn nothing doing this.
You're free to contact another GrapheneOS team member.

2024-09-25 22:15:46

#plebstr #nostr #newstr (winks)
#nevent1q…0sq8

2024-09-25 22:00:06

Hi all, Final from #GrapheneOS again.
Due to an extraordinary event (not a breach!) and a change causing me to up my security requirements, I have burned the previous npub I used. This is my new npub. My security requirements are above people's conveniences, I apologise for these inconvenience but I don't regret necessary actions either.
- I will use this npub for post comments and support.
- I will refrain from constant GrapheneOS reposts as Mastodon bridges fulfill that space. Rest of the team can also USUALLY see posts there. I believe I should be more diverse in my content here.
- In short, less GrapheneOS, and more Final.
I can be verified using the original Stacker News account (final) NIP-05, Bio and LN address.
I can be verified via the GrapheneOS discussion forum user page (final). You may also verify me in any official GrapheneOS platform you wish.
Thank you for the support.
-- final