"Pixel 11 series is a lot more expensive for an incremental improvement to the CPU, the same underpowered GPU and reduced RAM for the Pro base models. They finally caught up to the last generation of Qualcomm cellular radio. It's overpriced, the upgrades aren't impressive and losing MTE is appalling."
Lost any remaining respect for Pixel with the decisions they've made for Pixel 11. The product design and hardware teams have both tried to one up each other and who can deliver the bigger pile of steaming crap.
What, MTE is such a promising tech and for security and now that we need all security we can get. WTF this is terrible development. You cant go backwards when the world needs getting even more secure.
Such a shame. Google themselves barely utilised it in their stock builds. I wonder if there is some silicon or development overhead they decided to cut.
I'm optimistic about the Motorola partnership and when my 9 Pro is EOL I'll definitely look at how that's played out.
Google likely cut MTE to reduce the die space required by CPU cache. It saves them money on a feature they never deployed by default and only used for a few processes as part of Android Advanced Protection Mode (AAPM) without enabling it in the Linux kernel. Their security team should have gotten it deployed by default for a large portion of the OS by now and then it would have been much harder to justify removing it. The small performance impact of asymmetric mode is irrelevant for the vast majority of the OS and it can also be used in the near zero cost asynchronous mode. We use synchronous in the kernel for security reasons but they didn't have to do that.
It's a completely different story for GrapheneOS where it means losing one of the main kernel and userspace security protections. This is one of the only ways we can significantly harden the Linux kernel with existing security features. The Linux kernel has always been a huge security liability for Android and AI models are making that much more obvious to everyone.
Google will likely end up heavily using MTE in the future. Pixel 11 devices won't be able to benefit from it. They're at the start of 7 years of updates but they won't be getting the benefit of future updates enabling MTE. Pixel 8 and later will benefit from Google likely expanding use of MTE for AAPM and eventually beginning to use it by default. It's unlikely Google will stop working on expanding MTE due to the Pixel 11 hardware decision. Multiple other OEMs are interested in MTE for devices made for businesses and governments even if Google decided it wasn't worth the cost for Pixels.
I don't understand much from MTE/Android or MIE/iOS but the explanation is also confusing when:
- They claim Apple did a great job integrating MIE in iOS
- iOS doesn't encourage to opt into MTE ... Apple's docs warn developers of performance and stability issues
So it seems like even for iOS, this special security feature is only available for Apple own iOS app (at most?).
Then also:
> Even Signal doesn't opt-in. Our approach enables forcing using MTE in the standard allocators regardless.
So does that mean that Signal and any other apps are enrolled in MTE on Graphene?
iOS uses MTE for nearly all of the important parts of the OS. It uses MTE within the kernel and for a substantial portion of the base OS processes. They focused on deploying it to the most security relevant processes first but it's deployed for a large portion of the OS beyond those. Apple has done a very good job protecting the OS with it. They've done a very poor job getting the app ecosystem to adopt it.
Android has more app ecosystem adoption than iOS due to having a better open source app ecosystem where GrapheneOS users have asked apps to enable it by default. Many GrapheneOS users are also force enabling MTE for user installed apps via our recommended toggle for it. Those users are reporting invalid memory access to developers via our dedicated notification system for invalid memory accesses it catches. For Android app developers, not opting into MTE doesn't mean their app won't be used with MTE due to GrapheneOS.
GrapheneOS uses MTE for the kernel and nearly every userspace process including all the base OS apps. We've had to fix many upstream Linux kernel and Pixel kernel driver bugs found by MTE. However, we aren't trying to fix the Pixel userspace drivers code ourselves so we have a few userspace processes excluded from MTE caused by userspace driver library/service bugs.
We recommend users enable our toggle for enabling MTE by default for every user installed app not explicitly marked as incompatible in our compatibility database. GrapheneOS has user-facing notifications for invalid memory accesses caught by MTE providing a traceback to share with the app developers. Users can use the per-app toggle to work around it if it makes an app unusable. We take the same approach for other aggressive exploit protections provided by GrapheneOS. Exploit protections with only rare compatibility issues are enabled by default for apps with a per-app toggle to opt-out and no toggle for the global default.
I see a significant difference between making a security feature available but opt-in during a teething phase, and removing the feature altogether. Am I missing something?
This isn't terrible development, it's simply that GrapheneOS devs can't do miracles
They can't just continue supporting phones if they have security downgrades, especially if it's an important feature.
I think they mean "this is a terrible development" in the sense that this is terrible news/turn of events. They arent criticizing GrapheneOSs software development.
Pixel 11 has an incremental upgrade to the CPU, the same underpowered GPU and less RAM for the base Pro models. It has a new major version of the secure element (Titan M3) which likely greatly improves Before First Unlock state security for users without a strong passphrase. It has a better radio from a performance and efficiency perspective but it's still a more than yearly generation behind Qualcomm. The cellular radio firmware is also likely a security downgrade but the userspace code is more secure due to moving to AOSP IMS code. If these devices hadn't removed MTE, then they would have been a sidegrade with marginally better security. Removing MTE ruins these devices for GrapheneOS. We could still support the Pixel 11 series but it would be greatly rolling back overall security to before the Pixel 8. It does at least have PAC and BTI but MTE was the main improvement with the Pixel 8 rather than those.
They do make limited use of it for Android Advanced Protection Mode (AAPM) introduced in Android 16. It no longer provides this upgrade for protection against exploits on the Pixel 11. They could substantially expand AAPM to using it across much more of the OS and could also start using it without AAPM since there's no significant downside to using it for most of the userspace code outside of the kernel.
It's funny how much Google lies about Android being 'secure' [1] and how much GrapheneOS, for free, improves the security of everyone with their work. Google should be, immediately, merging all patches/changes GrapheneOS makes and releasing a new build of Android to AOSP. Instead, users are subject to weak efforts to protect their security and privacy while Google parade about how good and amazing they are. They mention [1] 'This unencrypted data can be used to build user profiles or, in the hands of malicious actors'...And can't see the irony. They ARE the malicious actor and they absolutely build profiles about everyone. Whatever happened to the 'privacy sandbox' initiative again?
Anyone who values Graphene's work will purchase one of their Motorola devices, whatever the cost, otherwise it seems your choices are going to be giving up more data and control to Google, because they are clearly, obviously and systematically trying to remove GOS from Pixels (lack of source code, removing hardware features, making it purposely difficult to support pixels).
I predict by 2030 GrapheneOS will not support any new pixels entirely. The existing pixels will eventually die off and that will be that.
It's obvious they see open access to users data as a threat to their business model. No, they haven't suddenly decided to care about your privacy, they want to deny other actors access so you need to get data directly via them. They will obviously still collect it themselves via their numerous methods (play services, chrome, ad networks etc).
You can get a Pixel 10 or wait for the upcoming Motorola flagship with GrapheneOS support. Pixel 11 only has an incremental CPU upgrade and the same GPU as the Pixel 11 anyway. It isn't much of a hardware upgrade and is even a downgrade for RAM with the base Pro devices. It's more expensive than the Pixel 10 was too.
The upcoming Motorola flagship will have a dramatically better CPU and GPU than the Pixel 11 and competitive cameras. It will still have 7 years of updates, MTE and a secure element with the features used by GrapheneOS. Motorola Signature (2026) is the predecessor not quite meeting our requirements mainly due to lack of MTE but also lack of other features which had to be developed.
Is the Motorola partnership that they're ensuring support in the phone, and helping the port with docs/support perhaps, or is it even actually shipping with GrapheneOS?
They're implementing all of the features required by GrapheneOS, are helping us port GrapheneOS to the devices and may help us maintain it. They'll provide us with the drivers and firmware needed to support it too. Selling devices with GrapheneOS is planned but the details and timeline aren't worked out.
Motorola doesn't have a great track records for flagships smartphones. I will keep finger crossed that we won't have to choose again between security and features but either way it's a great news, and I truly hope that GrapheneOS will be adopted by more manufacturers in the future
Motorola Signature (2026) was well received. They committed to 7 years of updates and provided top tier smartphones cameras which were previous limitations. Razr Fold (2026) has the top rated camera for a folding device on DXOMARK, unlike the huge camera downgrade for folding Pixels.
One detail that remains to be seen is whether you'll cater to the EU market, and how the impact of the memory crisis will impact the possible consumer-base. It's a weak market and sales are likely to be only the 'hardcore' users who demand/require security. I sincerely hope there is no numbers you need to hit to keep the partnership going, sales are not likely to be at first significant.
Pixels offer affordable options which is why unless you can cater to that market, a Motorola-only GrapheneOS future will only gain traction if you're able to get a cheaper low/mid-range option out there, akin to the Pixel A-series.
Motorola Signature (2026) has 7 years of support and the successor to it is what we'll be supporting. GrapheneOS will be providing the updates for a device running GrapheneOS so it doesn't particularly matter how quickly they ship the AOSP patches or major Android updates themselves. GrapheneOS already provides AOSP patches months before Pixels via our security preview releases. We provide Linux kernel patches many months earlier than Pixels but it's currently limited by the speed of Greg KH's GKI LTS branch unless we start doing it ourselves again.
Motorola will directly Qualcomm firmware and drivers we need which are mainly from Qualcomm. The updates will be up to us.
You can get a Pixel 10 or wait for the upcoming Motorola flagship with GrapheneOS support. Pixel 11 only has an incremental CPU upgrade and the same GPU as the Pixel 11 anyway. It isn't much of a hardware upgrade and is even a downgrade for RAM with the base Pro devices. It's more expensive than the Pixel 10 was too.
The upcoming Motorola flagship will have a dramatically better CPU and GPU than the Pixel 11 and competitive cameras. It will still have 7 years of updates, MTE and a secure element with the features used by GrapheneOS. Motorola Signature (2026) is the predecessor not quite meeting our requirements mainly due to lack of MTE but also lack of other features which had to be developed.
Good riddance to Google. I'm happy GOS is no longer dependent on their hardware.
My concern is that Motorola is a Chinese company. Sure, Pixel and Apple phones are made in China too, but they're overseen by American companies. How can we know these Motorola phones will not one day be placed on the "do not trust" list like e.g. Huawei phones?
The US government puts them on the list. I don't care that they are on the list, but it does mean they can't sell the devices in the United States. If that ever happened to Motorola, and there were still no other devices that Graphene OS supports, then there would be no options left.
> placed on the do not trust list?? who places them on this list?
The President of the United States, or members of the Federal Government that have the various levers of power.
> and why do you listen to the people who place them there
If they won't allow the devices to be imported then it's not really an option. Which also means they wouldn't be allowed to connect to the cell network.
Or they could be barred from all Federal or State facilities, having to be left in a faraday bag upon entry.
Federal grants and loans to states and companies could be denied if company policy allows the use of those devices for corporate communications and purchasing decisions, etc.
I guess that's a thumbs down then?
The 10 dropped the physical SIM slot and Google started with their device tree shenanigans that year, with little to no improvements in exchange.
I've got 16GB of RAM and 512GB in an ecosystem that shows every sign of regressing in capacities due to component price inflation.
Very interested to see what Motorola does next year, however.
I'm optimistic about the Motorola partnership and when my 9 Pro is EOL I'll definitely look at how that's played out.
It's a completely different story for GrapheneOS where it means losing one of the main kernel and userspace security protections. This is one of the only ways we can significantly harden the Linux kernel with existing security features. The Linux kernel has always been a huge security liability for Android and AI models are making that much more obvious to everyone.
Google will likely end up heavily using MTE in the future. Pixel 11 devices won't be able to benefit from it. They're at the start of 7 years of updates but they won't be getting the benefit of future updates enabling MTE. Pixel 8 and later will benefit from Google likely expanding use of MTE for AAPM and eventually beginning to use it by default. It's unlikely Google will stop working on expanding MTE due to the Pixel 11 hardware decision. Multiple other OEMs are interested in MTE for devices made for businesses and governments even if Google decided it wasn't worth the cost for Pixels.
- They claim Apple did a great job integrating MIE in iOS - iOS doesn't encourage to opt into MTE ... Apple's docs warn developers of performance and stability issues
So it seems like even for iOS, this special security feature is only available for Apple own iOS app (at most?).
Then also:
> Even Signal doesn't opt-in. Our approach enables forcing using MTE in the standard allocators regardless.
So does that mean that Signal and any other apps are enrolled in MTE on Graphene?
Android has more app ecosystem adoption than iOS due to having a better open source app ecosystem where GrapheneOS users have asked apps to enable it by default. Many GrapheneOS users are also force enabling MTE for user installed apps via our recommended toggle for it. Those users are reporting invalid memory access to developers via our dedicated notification system for invalid memory accesses it catches. For Android app developers, not opting into MTE doesn't mean their app won't be used with MTE due to GrapheneOS.
GrapheneOS uses MTE for the kernel and nearly every userspace process including all the base OS apps. We've had to fix many upstream Linux kernel and Pixel kernel driver bugs found by MTE. However, we aren't trying to fix the Pixel userspace drivers code ourselves so we have a few userspace processes excluded from MTE caused by userspace driver library/service bugs.
We recommend users enable our toggle for enabling MTE by default for every user installed app not explicitly marked as incompatible in our compatibility database. GrapheneOS has user-facing notifications for invalid memory accesses caught by MTE providing a traceback to share with the app developers. Users can use the per-app toggle to work around it if it makes an app unusable. We take the same approach for other aggressive exploit protections provided by GrapheneOS. Exploit protections with only rare compatibility issues are enabled by default for apps with a per-app toggle to opt-out and no toggle for the global default.
So basically they say don't buy it, wait for the Motorola phones.
Anyone who values Graphene's work will purchase one of their Motorola devices, whatever the cost, otherwise it seems your choices are going to be giving up more data and control to Google, because they are clearly, obviously and systematically trying to remove GOS from Pixels (lack of source code, removing hardware features, making it purposely difficult to support pixels).
I predict by 2030 GrapheneOS will not support any new pixels entirely. The existing pixels will eventually die off and that will be that.
[1]: https://blog.google/security/new-android-network-security-pr...
The upcoming Motorola flagship will have a dramatically better CPU and GPU than the Pixel 11 and competitive cameras. It will still have 7 years of updates, MTE and a secure element with the features used by GrapheneOS. Motorola Signature (2026) is the predecessor not quite meeting our requirements mainly due to lack of MTE but also lack of other features which had to be developed.
https://www.dxomark.com/smartphones/
We aren't sure when the first Motorola folding devices we can support will be released, but that will happen.
Pixels offer affordable options which is why unless you can cater to that market, a Motorola-only GrapheneOS future will only gain traction if you're able to get a cheaper low/mid-range option out there, akin to the Pixel A-series.
Is there any guarantee that in 4 years this device will be getting monthly patches, source and builds regularly?
Motorola will directly Qualcomm firmware and drivers we need which are mainly from Qualcomm. The updates will be up to us.
Let Motorola do the hardware and GrapheneOS the software.
Google just can't help being a fucking disappointment at every single opportunity!
The upcoming Motorola flagship will have a dramatically better CPU and GPU than the Pixel 11 and competitive cameras. It will still have 7 years of updates, MTE and a secure element with the features used by GrapheneOS. Motorola Signature (2026) is the predecessor not quite meeting our requirements mainly due to lack of MTE but also lack of other features which had to be developed.
My concern is that Motorola is a Chinese company. Sure, Pixel and Apple phones are made in China too, but they're overseen by American companies. How can we know these Motorola phones will not one day be placed on the "do not trust" list like e.g. Huawei phones?
The President of the United States, or members of the Federal Government that have the various levers of power.
> and why do you listen to the people who place them there
If they won't allow the devices to be imported then it's not really an option. Which also means they wouldn't be allowed to connect to the cell network.
Or they could be barred from all Federal or State facilities, having to be left in a faraday bag upon entry.
Federal grants and loans to states and companies could be denied if company policy allows the use of those devices for corporate communications and purchasing decisions, etc.