Motorola announces partnership with Graphene OS to bring us secure phones!

[kstrlworks@techhub.social]

@tomgag Any update on if that means Motorola update cycles will be more than 3 years?

[tomgag@infosec.exchange]

@kstrlworks Yes, I think that's the best part: Motorola phones are great hardware-wise but have terrible updates cycle. Graphene OS fits perfectly there, because they are only subject to the much faster AOSP release cycle!

[woo@fosstodon.org]

@tomgag I just bought a Moto. It took me days to clear the slop off it (I hope.)

[tomgag@infosec.exchange]

@woo good news for you then: once you install GOS on it, bloatware will become a thing of the past

[woo@fosstodon.org]

@tomgag Realistically, I'm probably not going to do that. I'd like it to be on my next phone but hopefully that won't be for years.

[tomgag@infosec.exchange]

@woo your choice I guess, but just FYI, I've been on GOS on Pixels for years and they work flawlessly. Only two things don't work: contactless payments (blame Google and politics, not GOS) and CERTAIN banking apps.

[alexandermars@mastodon.social]

@tomgag @woo the first Moto phone that you can install GOS on hasn't been released yet. As per the linked article, no existing Moto handset meets GOS' stringent hardware requirements. Moto is likely doing this to address it's massive security and support shortcomings. GOS needs more hardware options than Google, reliance on pixel hardware is a single point of failure, and a huge liability for the platform.

[tomgag@infosec.exchange]

@AlexanderMars @woo I agree, but I think this announcement points exactly at the fact that Motorola agrees to produce phones that meet GOS' stringent security features, even if no model has been released yet that's good news. In other words, this should mark the beginning of exactly what you said: avoiding reliance on Pixel phones only.

Thread on the GOS forum from a few min ago: https://discuss.grapheneos.org/d/32656-motorola-partnership-announcement

[kstrlworks@techhub.social]

@tomgag So the issue isn't the AOSP; it's the firmware updates. These companies sign agreements for updates with chip manufacturers. For example, Qualcomm charges more based on the window of updates you're willing to get. If Motorola doesn't want to pay more, we're stuck with 3 years. Qualcomm only offers their IoT/enterprise lines 10 years max. While consumer chips get between 5-7 years, but they charge per year, which Motorola never wanted to pay for.

No amount of Android updates fixes the lack of drivers from Motorola and firmware updates from Qualcomm.

Graphene openly refuses to maintain phones where the security updates end from upstream, so we're looking at 3 year updates only as it stands.

[tomgag@infosec.exchange]

@kstrlworks better than nothing, no? I mean, what's the alternative? 1) keep using Pixels only 2) use a still immature Linux mobile OS 3) embrace enshittification.

It's not that I don't agree, mind you, but at this point any good news is good news IMHO.