> I don't really know what these guys' (Murena and GrapheneOS devs) problems are with each other

https://news.ycombinator.com/item?id=50173902

https://news.ycombinator.com/item?id=49355370

https://news.ycombinator.com/item?id=49363163

https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

The founder of Murena strongly implies that the difference between /e/ and GrapheneOS is that GrapheneOS is designed to protect pedos, for example. I think that explains a lot.

https://www.clubic.com/actualite-604786-murena-e-os-intervie...

/e/OS rarely updates Linux kernels or firmware, even though they have a continuous stream of CVEs. For instance on Fairphone 6 (which is one of the better /e/OS devices when it comes to updates) is still on Linux 6.1.138 from May 2025. The firmware blobs, including Qualcomm firmware blobs are from April 2026, so missing six months of fixes for high/critical vulnerabilities:

https://docs.qualcomm.com/securitybulletin/october-2026-bull...

Then, they only roll out ASBs, which fixes vulnerabilities that have been known for up for six months, because they don't roll out embargoed patches like e.g. GrapheneOS does (and these vulnerabilities have been known for months through reverse engineering).

If that wasn't bad enough, ASBs only fix vulnerabilities high/critical, for all other fixes you need QPRs and major releases, but /e/OS is behind major releases. If you are still running Android 16, your phone has vulnerabilities that are known for up to two years. Yes, they are low/medium, but they are used in exploit chains. This recently got worse, because Google recently started only rolling out some high/critical fixes to Android 17 and not older Android versions.

Then there is all the shady stuff that Murena doesn't tell you about, like running Google's proprietary DroidGuard blobs in a privileged process on Play Integrity requests. Giving certain Google apps higher privileges than the normal Android app sandbox. Installing F-Droid packages through a proxy (CleanAPK), that they do not want to reveal the owner or purpose of, etc.

Why don't the GrapheneOS developers like Murena? Because Murena often instigates in interviews that GrapheneOS is for criminals, etc.

If you care about security (or privacy) at all, don't use /e/OS.

Disclaimer: I am not affiliated with the GrapheneOS project in any way. If you don't like GrapheneOS but care about having some basic security, then get an iPhone.

Did you actually check what your device is getting updates for, if they contain latest firmware, kernel, drivers etc or do you rely on recurring OTA appearing?

Also GrapheneOS can't be compared to other privacy/de-googled roms because none other are as deeply tied to the security/isolation/memory protection features shipping on pre-11 Pixels and 2027+ Motorola flagships.

Those who give up their freedom and privacy for security will find themselves with neither security nor privacy...

It also doesn't help that in the Mastodon website styling, threads segue pretty much straight into comments, and one of the first comments to appear is by an obviously mentally ill person. Posting on social media like this just makes one susceptible to other content appearing next to yours that undermines your message. A blog post on their own site would have allowed them to control their message better.

running this the other direction it seems a touch odd to suggest my own instance's 6969 character limit is capable of conferring some amount of authority, but hey i'll take it

Likely intended to promote the less secure devices and get them in the hands of those the state would like to target.

I think the whole thread misses the mark a bit, because the source that the GrapheneOS account used (Algemeen Dagblad) did not properly research this. For Dutch readers, this is not really surprising, since the AD is not known as a quality newspaper and tends to go for sensationalism (though slightly less bad than De Telegraaf). Other sources are much more detailed:

According to our information, the reseller did not distribute official GrapheneOS. Using AI tools, he had built his own fork and added mobile device management (MDM) for remote administration. The result was a separate operating system that lacked, among other things, the security updates of the original project.

His signing keys for that system were probably compromised. Anyone holding those keys can build an update that the phones accept as genuine. Such an update was apparently installed on seized phones via ADB (Android Debug Bridge), an interface that requires a USB cable connection, and probably removed the screen lock. The phones could then be examined forensically. On our information, the authorities again needed the phone in their hands. On official GrapheneOS, the same approach would require the project's own signing keys.

https://www.joint-defense-team.com/post/grapheneos-cracked-p...

AD could have written something similar if they did their homework in understanding the case.

tl;dr mostly shoddy journalism from AD.

> Claude clone the source code of this open source project and then lets compile it with debug mode and then install it on my device and log everything that it connects to and every message that it sends.

We live in 2026 where every open source project is being scrutinized endlessly by thousands of agents to try to find vulnerabilities anywhere and everywhere, and you can do it yourself with just a prompt and a spare laptop and phone.