i dont want to sound like a dick but they really should've just forked the LineageOS apps that are maintained like they did with seedvault. this feels like theyre reinventing the wheel, or NIH
As a Calyx user, only kinda. A lot of the hardening done in GOS is missing from Calyx. Likewise, a lot of features in COS (firewall rules per connection type per app for instance) are missing from GOS.
When you have a unique goal and set of constraints that are not shared by most users and are actually opposed to the interests of most users and developers it’s not a good idea to try to add them into an existing general purpose project.
Part of the memory tagging support of graphene for example is that the applications need to actually support it too. You can force them to deal with it, but that causes instability and crashes.
Shouldn’t all applications support memory tagging? Well that would be nice but it makes everything slower and only a few schizoid weirdos want it. Clearly the better option is to rewrite the basic system apps that everyone expects to support all the optional security features graphene requires.
Bear in mind graphenes security competition is ios. The system applications in ios all got rewritten to support emte when apple rolled out os level support for it combined with concurrent releases of new hardware with silicon support.
They’re playing a different game than the aosp community.
GrapheneOS is very picky about what phones are supported, which is why up to now only certain pixels are supported, as well as Motorola phones in the future.
It still goes through a human before it's pushed to the repo. That's very different thing than "slop". Slopcode is generating the actual app code via claude or whatever and shipping it as-is.
Another thing to keep in mind is ai is what people are going to be using to try to find vulnerabilities in the software so using it to beat them to the punch is just good development practices.
25 Comments
Turret3857@infosec.pub · 87 pts · 1d
i dont want to sound like a dick but they really should've just forked the LineageOS apps that are maintained like they did with seedvault. this feels like theyre reinventing the wheel, or NIH
Ludicrous0251@piefed.zip · 36 pts · 1d
Would be great if those two could play nicely. Lineage features with GOS security would be the bees knees.
Goodlucksil@lemmy.dbzer0.com · 1 pts · 20h
I think Calyx OS would strike that balance
Turret3857@infosec.pub · 3 pts · 9h
As a Calyx user, only kinda. A lot of the hardening done in GOS is missing from Calyx. Likewise, a lot of features in COS (firewall rules per connection type per app for instance) are missing from GOS.
possiblylinux127@lemmy.zip · 67 pts · 1d
They could just... work with the community and use preexisting community apps
That is not how they role I guess
TrollAccount69@lemmy.ml · 5 pts · 11h
When you have a unique goal and set of constraints that are not shared by most users and are actually opposed to the interests of most users and developers it’s not a good idea to try to add them into an existing general purpose project.
Part of the memory tagging support of graphene for example is that the applications need to actually support it too. You can force them to deal with it, but that causes instability and crashes.
Shouldn’t all applications support memory tagging? Well that would be nice but it makes everything slower and only a few schizoid weirdos want it. Clearly the better option is to rewrite the basic system apps that everyone expects to support all the optional security features graphene requires.
Bear in mind graphenes security competition is ios. The system applications in ios all got rewritten to support emte when apple rolled out os level support for it combined with concurrent releases of new hardware with silicon support.
They’re playing a different game than the aosp community.
bilb@lemmy.ml · 2 pts · 11h
You are correct, TrollAccount.
aReallyCrunchyLeaf@lemmy.ml · 36 pts · 1d
Hopefully we can get a calendar app!!
Cheers to the GOS team, doing the lord's work truly.
iturnedintoanewt@lemmy.world · 5 pts · 1d
Etar isn't half bad. But yeah I wouldn't complain if they improve the landscape.
yestalgia@lemmy.world · 5 pts · 1d
Calendula is FOSS and very good. I liked it so much I donated.
Steve@communick.news · 13 pts · 1d
It's a big ask, but might that include the browser?
They could contribute dev time to the Servo browser project.
nebby@piefed.blahaj.zone · 22 pts · 1d
The already have vanadium
Steve@communick.news · 20 pts · 1d
That's just Chromium with some removed "features", not a whole new app.
peskypry@lemmy.ml · 8 pts · 1d
Well they can't do everything, can they?
Azzu@leminal.space · 3 pts · 1d
Apparently, they plan to.
Steve@communick.news · 1 pts · 1d
On a long enough timeline they can
Endymion_Mallorn@kbin.melroy.org · 3 pts · 1d
Excellent. Does it run on the basic Tracfone devices? otherwise, they need to get on the road to compatibility.
unknownuserunknownlocation@kbin.earth · 10 pts · 1d
GrapheneOS is very picky about what phones are supported, which is why up to now only certain pixels are supported, as well as Motorola phones in the future.
victorz@lemmy.world · 1 pts · 22h
I guess Motorola phone will be my next phone.
jlow@slrpnk.net · 1 pts · 20h
From recent posts on the Fediverse I'm afraid their slopping these apps ...
lka1988@lemmy.dbzer0.com · 6 pts · 19h
What posts?
wholookshere@lemmy.blahaj.zone · 2 pts · 17h
In the announcement threaded, they replied they us AI code analysis and code review tools to review security.
lka1988@lemmy.dbzer0.com · 8 pts · 17h
It still goes through a human before it's pushed to the repo. That's very different thing than "slop". Slopcode is generating the actual app code via claude or whatever and shipping it as-is.
GreenKnight23@lemmy.world · 7 pts · 12h
I hate AI, absolutely. without question.
however, code reviews and security reviews are in the top 5 acceptable uses for an LLM.
why? because I can't be bothered to read the newbies 10k lines of changes for a CSS rule change.
do I review the review? absolutely! does it make any changes to the code? absolutely NOT.
TrollAccount69@lemmy.ml · 5 pts · 11h
Another thing to keep in mind is ai is what people are going to be using to try to find vulnerabilities in the software so using it to beat them to the punch is just good development practices.