you are viewing a single comment's thread
view the rest of the comments
[–] 13 points 3 days ago (3 children)

When you have a unique goal and set of constraints that are not shared by most users and are actually opposed to the interests of most users and developers it’s not a good idea to try to add them into an existing general purpose project.

Part of the memory tagging support of graphene for example is that the applications need to actually support it too. You can force them to deal with it, but that causes instability and crashes.

Shouldn’t all applications support memory tagging? Well that would be nice but it makes everything slower and only a few schizoid weirdos want it. Clearly the better option is to rewrite the basic system apps that everyone expects to support all the optional security features graphene requires.

Bear in mind graphenes security competition is ios. The system applications in ios all got rewritten to support emte when apple rolled out os level support for it combined with concurrent releases of new hardware with silicon support.

They’re playing a different game than the aosp community.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 2 days ago (1 child)

    They could just add optional support upstream behind a compilation flag.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 2 days ago

    Maybe.

    I think graphene is so far removed from aosp in terms of goals and strategy that would be a pretty big commitment of resources.

    If you haven’t ever done upstreaming in an open source project, there’s a pretty big support commitment involved if the thing your work could be part of has insider scope than your own project.

    Which is pretty much the exact situation graphene is in.

    And if the graphene people are serious about security then giving aosp their (just my own hypothetical) emte enabled apps runs a good chance of providing a false sense of security to the users of those apps when not on graphene.

    This isn’t hypothetical btw, I had to dig through datasheets to prove that the old pixels don’t have emte to some random commenter a week or so ago even though just the most cursory understanding of arm mte versions and release schedules would make that obvious.

    The point isn’t to say people are stupid or that person was stupid, but that often people will assume the best even when it opens them up to a huge blind spot. One of the best security (and safety) practices is to make your secure component incompatible with insecure ones. That way it’s impossible for someone to point to the thick low awg nema 5-20 extension cord without acknowledging the cheater plug they used to get it into a two prong outlet with no wide neutral.

  • source
  • parent