GrapheneOS or other custom ROMs don't solve the actual problem that you can't just buy a smartphone and install any operating system like you can with an actual computer, despite technically being one.
Also, GrapheneOS supports device attestation (the non-google kind at least), which is still ridiculous as such systems have no benefit to people, only to technofeudalist corporations.
>which is still ridiculous as such systems have no benefit to people, only to technofeudalist corporations.
GrapheneOS literally has an app that uses attestation and isn't for "technofeudalist corporations".
https://attestation.app/about
Device attestation is how you can use private keys you don't actually have access to. It has a lot of value to literally anyone who wants to store tokens or use one time authentication codes. Linux folks need to implement the full stack and offer an open alternative to payments, secrets, and tokens. In the age of LLMs there is no excuse. It is annoying as hell that I can't buy a System76 or Framework laptop with a fingerprint sensor but a Lenovo comes with one that works on Linux perfectly.
"Device attestation is how you can use private keys you don't actually have access to."
Read that phrase back and then ask "is this the future of computing that we wanted?"
The likes of passkeys, essentially user-hostile ssh keys that live on your device but aren't accessible by you, would have been an unbelievable dystopia to us in the 90s.
"Linux folks need to implement the full stack"
Nah it's fine thanks, I'd rather opt out of corporate serfdom than compromise my principles.
That's just your opinion. Has nothing to do with Linux. And yes I would like a device like a soldered in tpm device that can generate private keys and verify signatures signed with the public key. Your misunderstanding of the technology not withstanding it does appear to me to be quite a valuable technology since it's in basically every computer these days.
Stop speaking for Linux.
Framework has a fingerprint sensor. [1]
[1] https://frame.work/products/fingerprint-reader-kit?v=FRANTD0...
Lots of laptop vendors do. Very few integrate fingerprint scanners into any kind of secure authentication flow, though. There are decent fingerprint drivers for various brands, but connecting fingerprints to authentication beyond basic login requires manual setup.
You don't actually need biometrics to use key material, that's what (f)TPMs are for. They're not set up to be usable out of the box in any Linux distro I've tried, though.
It needs to come stock on every Linux laptop from now going forward period. Like you expect a screen to come with your machine. Every Mac has one now and I'm not going back to typing my password in every single time.
If this is your stance it's trivial to have your cake and eat it. You can easily build your own GrapheneOS based image, which will then be unable to use attestation (because your own keys you'll use for the secure boot won't match).
And I'm not trying to be snarky, if that's the only thing, it's solvable right now. Everything else will work.
And concerning "you can't just buy a device and install is" - android and iOS are far more secure than any desktop os, and both pixel/iPhones are far more secure than any computer (or any other phone as well (we'll get the third one next year)). GrapheneOS actually explains "whys" in their hardware support faw section.
Generally maintaining an os is a hard work, so that perhaps explains why there's not many mature offerings.
> you can't just buy a smartphone and install any operating system like you can with an actual computer, despite technically being one.
What's stopping you from buying a phone, unlocking the bootloader, and flashing whatever ROM you want?
> install any operating system like you can with an actual computer
This is in practice only true of IBM PC compatibles these days, you really can't install any OS on modern Macs. Maybe you can on (some?) Chomebooks?
You can install Linux on modern macs? That doesn't mean that driver info is available, but there's nothing stopping you from installing another os.
A piece of wisdom I read here is that "install any operating system like you can with a [PC]" is something that you can only do with a PC. PC's are the exception. Every other device is controlled by the manufacturer.