Dear tech media, could we please stop using GrapheneOS as the judge on what's secure? I respect very much what GrapheneOS has built, but their stance that free software is not important to security is very short sighted. They literally are willing to call binary blobs secure because someone told them they are? They have no other standard to go on, since they can't inspect them.
https://www.theregister.com/2025/10/15/fsf_librphone_vs_proprietary_binary_blog/
@moshimotsu there is a very good reason why security audits are done on source code. Yes, observing behavior is important. Then when one has the source code, one can follow up and confirm the exact behavior. With a binary blob, that is not feasible.
@eighthave @rasumi As @GrapheneOS points out, stubbornly preferring the outdated version of proprietary firmware to updated binary blobs is indeed pretty unreasonable and Rob Savoye mentioning Secure Boot doesn't exactly inspire confidence in the endeavor either.
I retweeted this yestertday, but then smb pointed out that...
> They literally are willing to call binary blobs secure because someone told them they are?
...this never really happened? At least I followed the links and the stance they express in the thread is nothing of the sort, just a neutral "out of scope" dismissal.
I share the sentiment otderwise, IMO @signalapp and Moxie have done a lot of harm in this regard, sort of reenacting Telegram's denial policy but wrt gservices
@nobody @signalapp It happened because GrapheneOS claims to do everything for security, but then, dismisses projects that aim to replace binary blobs with free software. So perhaps they did not literally say what I wrote, but that's my synopsis of their logic, as far as I can follow it. I know of no standard to audit binary blobs with any reliability. Moxie was also never a believer in free software, his hand was forced by OTF to make Signal free. It was a requirement to receive funding.
@eighthave
The post said "we don't care for getting fsf approval", nothing about librephone
@signalapp
@eighthave One of the biggest tells of security isn’t in the codebase, its behavior. You could write malware into an open-source piece of software and have it be so obtuse that it goes unnoticed for years, as with what happened with the XZ utils. That was only caught because a program BEHAVED oddly, and a Microsoft employee noticed.
Whatever proprietary software Graphene is using, I’m sure they’ve ensured its behavior matches the security standard they uphold.