26
/e/OS is not a secure OS
(lemmy.world)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 10 Mar 2026
26 points (65.1% liked)
Open Source
45254 readers
510 users here now
All about open source! Feel free to ask questions, and share news, and interesting stuff!
Useful Links
- Open Source Initiative
- Free Software Foundation
- Electronic Frontier Foundation
- Software Freedom Conservancy
- It's FOSS
- Android FOSS Apps Megathread
Rules
- Posts must be relevant to the open source ideology
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
- !libre_culture@lemmy.ml
- !libre_software@lemmy.ml
- !libre_hardware@lemmy.ml
- !linux@lemmy.ml
- !technology@lemmy.ml
Community icon from opensource.org, but we are not affiliated with them.
founded 6 years ago
MODERATORS
There is no privacy without security. Android is one of the most widely exploited OSes and every month a dozen or more critical severity vulnerabilities are patched. Being 1-2 months behind on security patches is inexcusable for a privacy project.
Are those vulnerabilities ever exploited? The stats I'm seeing say that 30% of users run outdated Android version. Most attacks are malware apps installed from Play Store and mobile phishing sites. Yes, you have 0-click vulnerabilities but is anyone really setting up spoofed BT devices in public places? I think the risk of getting your phone taken over this way is extremely low, specially if you're doing basic things like disabling BT when not in use. Tracking on the other hand is extremely common. Most non-open source apps will connect to multiple analytics and tracking APIs. I care more about controlling those connections than about theoretical attack using some 0-day exploit. GrapheneOS doesn't have good tools to monitor and block trackers. /e/ and iode do.
So you're excusing lazy patching with improbability? Personally, I wouldn't bet my privacy and security on a criminal's lack of motivation.
It's like eating candy from a bowl in which 5 are poisoned and 5000 are harmless. It's improbable for you to pick a poisoned candy but because the consequences of choosing wrong are so perilous, I wouldn't choose at all or choose a bowl with less poisoned candy.
Yes it does. Rethink has (in addition to other awesome features) a local DNS blocklist option which you can configure to automatically block almost all telemetry apps send.
Of course I am. I'm not paranoid. You always prioritize the risks. Looks like you're worried about highly motivated hackers targeting you specifically. That's ok, you're probably basing this on some sensible risk assessment and you concluded that you're a potential target for state level actors or criminals. Maybe you're a political activist or just very rich. I'm neither so I'm not really worried about someone targeting me specifically. I'm worried about malware (I don't install apps from random sources) and phishing (I don't click on random links). If you're worried about extremely unlikely attacks you're either wasting time or treating this as a hobby.
DNS blocklists are not enough. iode and /e/ offer more fine grained control and monitoring. You can permit some connections temporarily or permanently for specific apps only. Not to mention other features GraphenOS is missing like pattern unlock, backups or navigation shortcuts. Sacrificing all this just to be protected from very unlikely attacks is simply not worth it.
Not really, no.
Not patching security vulnerabilities leaves you open to not just targeted attacks but also wide spread attacks, which also use the same exploits that nation states use. Just look at the recent Coruna debacle.
Let me bring another analogy. You live in a town where theft and burglary is rampant. You have a lock on your front door but the lock is based on a legacy design which is not hard to pick. Sure, no one has broken into your home yet but if you keep using an antiquated lock, it's a matter of when not if. And it's not like only rich and important people's houses are broken into. Everybody who's vulnerable can and eventually will get attacked. If I had to choose between risking burglary and paying a little extra for a better lock, I'd choose the latter.
I don't have to be a political activist to take measures to protect myself online nor rich to afford a used Pixel.
To each their own, I guess.
So you mean like OpenSnitch? If so, Rethink also has that.
EDIT: grammar
Even coruna was specifically targeting crypto wallets. Some articles say it was a 'broad scale' attack but I can't find any info about how it was distributed. Anyway, if you're using crypto wallets you have to be more careful. Traditional banking is protected by TFA and very often additionally insured. Again, risk assessment.
Oh, and I tried Rethink but it works as a VPN so you can't use other VPN apps with it. The app iode has can be used with any other VPN.
I think you might not understand the meanings of privacy and security.
These are two different things, you can have privacy without security and the other way around. Having both is the best case.
As @ExLisper@lemmy.curiana.net said, some people care more about all those app trackers rather than have a full secure phone.
If there would be the one solution 100% privacy and security and available for most phones I would instantly use it. But it is not available yet.
If you are happy with Graphene OS good for you, but keep in mind it might not be what everyone is looking for.
I think you replied to the wrong comment but you said the right thing :)
To me it shows me that I replied to the right comment. I just tagged you, as I agreed with what you said in your comment below.
Ok, I guess no one tagged me before. TIL.