Graphene OS is the odd one, I don't know what to make of it. It seems to be the only entrant in the mobile OS space that has a remote chance to work as alternative OS for daily use - but it's optimizing directly for the philosophy opposite to what I hoped it would be, I.e. it's focusing on privacy and security. Which AIUI means also securing the device against its owner, much like the big players do.
I hoped we'll get an OS more amenable to opening up the device, exposing its capabilities to the owner, but alas, I fear there is no way for an OS to survive in this space unless it acts the same way the Big Two do. As it is, I can't help to think that Graphene is just the same as Google and Apple: just another security-maximizing vendor owning your computer.
You are expecting and hoping that it will act the same as desktop environments do.
Desktop environments can't/don't because there is an inherent expectation of users that they should work a certain way and they are built upon decades of neglectful security practices.
Mobile OSes are the attempt to change that and provide better security models from the ground up. AOSP being open-source is what gives you the actual control to modify your platform as you see fit, not having runtime root access exposed to the user.
The idea of "control" that you are describing is illusory and only serves to actually undermine your real control. If you expose root access in that way, you have a much lower guarantee that the rules and permissions that you set are going to be able to be enforced by the system, because you have allowed the system to be modified. If something malicious gains that access, you have lost that guarantee.
> You are expecting and hoping that it will act the same as desktop environments do.
Pretty much.
> Desktop environments can't/don't because there is an inherent expectation of users that they should work a certain way
Yes, and many of those expectations are exactly how computers are supposed to behave in general.
> and they are built upon decades of neglectful security practices.
That is true, but:
> Mobile OSes are the attempt to change that and provide better security models from the ground up
I strongly disagree with unqualified "better" here. Better for whom is what matters, and mobile OSes are security-maxxing in the direction that's - IMO - bad for users. They're optimizing for market ecosystem.
> AOSP being open-source is what gives you the actual control to modify your platform as you see fit, not having runtime root access exposed to the user.
That I vehemently disagree with, in two dimensions:
- Open-source as panacea to everything is a bullshit belief techies overindex on. OSS has long been defeated, SaaS killed it. Whether code is open source or not is immaterial, what matters whether this particular code executing on this particular machine I use is open to me, which is not - and I can't even guarantee it's the same code that's supposedly "open" on some repository somewhere.
- "having runtime root access exposed to the user" is precisely what freedom of computing means. That is the one thing that matters.
> If you expose root access in that way, you have a much lower guarantee that the rules and permissions that you set are going to be able to be enforced by the system, because you have allowed the system to be modified. If something malicious gains that access, you have lost that guarantee.
Wrong. I have a much higher guarantee, because the alternative is that I cannot set any rules at all. Per basic math, "very little" is still greater than 0.
It sounds like you want a phone version of Raspberry Pi, something that's totally open to tinkering? That would be cool to see, but it would be a tough sell to general users.
Sort of. Maybe not at GPIO level, but come on - the phones are loaded with sensors that mostly cannot be accessed directly, APIs increasingly expose them as logical indicators of system state, hardcoding a use case and throwing 99% of the signal, and the app building process is designed to create a hard separation between "user" who is a consumer of apps, and "developer" who is building apps to sell to users. The middle ground is hollowed out entirely. And even at the OS level, 90% of the phone data - including especially data stored by apps - is purposefully made inaccessible to user.
I'd like a device where I can, to use a random example, trivially wire up so all messages are collected to shared database I can search, and voice messages are directed to a local or remote transcription endpoint. Or even simpler, I want a phone where I can screenshot the list of transactions in my bank app. Right now this is near-impossible, because by the time I defeat enough of "security" measures to access the data, the phone stops passing attestation checks and some of the apps in question won't load anymore.