Marocco2

[GrapheneOS @GrapheneOS]

This paper is inaccurate slop. It makes a large number of clearly inaccurate claims about GrapheneOS and presents results which are verifiably false. It's filled with nonsense which appears AI generated. > The Clone Strikes Back: Efficient Vulnerable Code Detection in Custom Android-based Systems

The authors wrongly believe GrapheneOS has diverged from the Android Open Source Project (AOSP). The starting point for GrapheneOS is the latest stable release of AOSP with all of the AOSP security backport commits applied. Our changes to AOSP repositories are maintained as cleanly rebased patches.

Our AOSP changes are reviewed and improved on an ongoing basis. It's not only the code being improved but also commit structure. We're always preparing for porting to the next stable release. It's handled as if our AOSP changes are being prepared for submission to the project for the first time.

We start fresh with each stable release of AOSP. All our changes are ported to the new source tree. There's no merging process but rather porting and submitting the changes to the new source tree. Major changes are often required including entirely rewriting certain features for the new release.

This entire paper is based around a misconception. The authors wrongly believe we need to identify and incorporate all of the upstream changes into GrapheneOS. It's our changes we need to make sure to fully and correctly port to each new release of AOSP, not the other way around as they believe.

The authors should have seen that each of releases has all of our changes to AOSP repositories cleanly rebased on top of the latest stable release. We do make substantial changes to AOSP but it can all be reviewed as a set of patches applied on top of the latest AOSP release with zero merge commits.

Android Security Bulletins are a list privacy and security patches backported to older releases of the OS. These aren't the privacy and security fixes made in the development branch but rather incomplete backports. Far more fixes made in the development branch and the approach is often different.

Android's development branch can do major refactoring and rewrites. It can make privacy and security improvements requiring substantial changes to the code. It can fix weaknesses requiring backwards incompatible changes. The backports don't even attempt to cover Low and Moderate severity patches.

The authors of the paper took the diffs from the Android Security Bulletins and created tooling to look for the changes made by those diffs being missing. They present the findings where they manually confirmed lines of code don't appear to be present as if those are missing patches in GrapheneOS.

They should have easily figured out GrapheneOS releases are based on the latest AOSP release. They should have used their tooling on AOSP itself as a control. They would have gotten the same results for AOSP and GrapheneOS if they used versions from the same date. Instead, they're misleading people.

If they checked the latest AOSP release at the time, they would have seen there's no actual difference in what their tooling finds between AOSP and GrapheneOS. The code they identified as not present in GrapheneOS wasn't in the latest AOSP release at the time. It also doesn't show anything is wrong.

Many of the security issues fixed by Android for older releases aren't present in recent releases due to rewrites and changes to the code. Fixes in the development branch are often difficult to backport with major changes or entirely different approaches being needed. Backports are their own thing.

It's common for the initial attempt at fixing a privacy and security issue to be incomplete or incorrect. These changes sometimes even introduce new vulnerabilities. There are often multiple rounds of partial fixes. Truly fixing it often requires major changes or rewrites impractical to backport.

This paper is built around an incorrect understanding of how GrapheneOS is based on AOSP and Android's security patches. All of the patches included in Android at the time were shipped by GrapheneOS. If any of what they found was an actual issue, which is doubtful, then it was missing in AOSP too.

Aside from the incorrect premise and methodology, the paper is filled with many other inaccurate claims about GrapheneOS. Look at this example: > For instance, GrapheneOS eliminates unnecessary background processes and applies exploit-hardening techniques to reduce CPU and battery usage.

Did a human truly write that sentence? We aren't aware of any background processes we've eliminated compared to AOSP. Our exploit protections certainly don't reduce CPU, memory or battery usage. We do take great care to minimize the overhead and provide toggles for features with a substantial cost.

The paper is filled with statements which sound reasonable to non-experts but are nonsense. We wouldn't be surprised if most of the paper and code was LLM generated. There are many strong signs of it and it's hard to believe humans wrote all of this. We think it should be investigated further.

There are 4 authors listed for this. The person listed 3rd is a Senior Research Scientist in the Platforms Security and Privacy team at Google. It's published as part of the 2026 IEEE 11th European Symposium on Security and Privacy (EuroS&P). What happened here?

https://t.co/DQMsT0kZWF

Google published Android as an open source project and it succeeded based on it. For years, they've been engaging in illegal anti-competitive tactics to gain control over what was an open platform supposedly governed by a group of companies rather than Google. That includes the Play Integrity API.

Play Integrity API is pushed based on the false premise that it's a security feature. In reality, it's a core pillar of an illegal anti-competitive business model and clearly harms security. It bans GrapheneOS despite it being far more secure than anything they certify including far better patching.

This paper pushes Google's false narrative of alternatives to Google certified Android not providing standard patches and protections. A Google researcher being directly involved as an author is scandalous. The claims made by the paper about GrapheneOS are clearly false and it needs to be retracted.

The paper links to a GitHub repository with code, data and a copy of the paper. It's strange they apparently never thought to run this against the AOSP release which the GrapheneOS release they tested was based on. There are 0 differences in most of the relevant code...

https://t.co/o2bMPi8HvT

[ReStory: Chill Electronics Repairs | OUT NOW💛 @restorygame]

To celebrate the launch of our game, we're giving away 4 copies of ReStory on Steam! 💛

All you have to do is:
🔁RT this post
✅Follow us @restorygame
💬Comment your favorite device

Ends 10th Aug @ 9am EST

Good luck, Restorers! ✨

[Panos Karabelas @panoskarabelas]

You asked for it, you’re getting it.
Coming soon to https://t.co/Do7zVBWbud: DLSS and FSR. 🚗💨

[GrapheneOS @GrapheneOS]

Revolut recently banned using GrapheneOS without any justification. They're falsely claiming to do be doing it for security reasons. In reality, they're enforcing licensing Google Play. Revolut doesn't enforce security standards. It runs on Android 9 with no patches since 2018.

[WitherOrNot @witherornot1337]

It's possible to statically recompile games from scratch and run them in XeO3. Here it is running Chaos;Head Love Chu Chu, a game that never got an official Xbox One or PC port.

[Del @TheCartelDel]

If you tried to push Character Design like this in a modern game studio run by U.S. directors, a subset would villainize you (mostly men, as many Women game developers actually like sexy theme options when done in a fun way).

The problem is that nobody can correct this American puritanical behavior (despite the fact that the average age of most video game players in the United States is 37), because the discussion about Sexuality in Fashion is being led by either raging racists who spout conspiracy theories or misogynists who don't have the literacy to hold the conversation with respectful dialogue.

So, what would have probably slowly resolved itself by now hasn't, because there's a vitriolic force whipping up angry likes and RTs that make it distasteful to ever "see their point." So we have to continue to suffer this puritanical view that "Sexy characters are gross", and they can never be empowered, cool, complex, mature or aspirational, apparently.

[UTM @UTMapp]

UTM v5.0.4 beta is out now and for the first time you can play modern Windows games on UTM with our experimental DirectX 11 driver. Please test and help us by providing your feedback.

[Does it play? @DoesItPlay1]

The goal is to make Sony change course, keep physical alive. For that we need to stay and voice our opinion. Leaving the platform entirely at this stage means one voice less that opposes their plans. It's a paradox, but for now, we need to stand our ground. Ultima ratio in 2028.

[Panos Karabelas @panoskarabelas]

https://t.co/PbfkJjnDiK v0.39 is finally here!

Our biggest graphics and lighting overhaul yet, featuring even more than you see in the video, including a new D3D12 renderer, clustered shading for hundreds of real time lights, and much more.

Luis Anton and I poured our hearts into this one. We hope you enjoy it! 🚗✨

[Rhys Elliott @superhys]

A lot of folks still buy physical games on PlayStation (@alineaanalytics estimates), but the type of game matters there.

Now that Sony has confirmed it’s taking physical discs behind the shed in 2028, its physical splits are worth a proper look. Sony knew a vocal minority of superfans would be mad, but they did it anyway for a simple reason. Margin.

While I’m no fan of this decision as a consumer, the data explains the boardroom math. Here are our estimates for the physical share of copies sold across ten high-profile PlayStation titles over the past couple of years:

The range is enormous, running from Final Fantasy VII Rebirth at 48.0% physical down to Black Myth: Wukong at 10.8%. That spread reveals a lot about who still gives a shite about discs:

The top of the list is collector territory, the prestige single-player epics (FF7 Rebirth, Astro Bot, Spider-Man 2, Expedition 33) that we older heads want sitting on our shelves.

Then, the bottom belongs to digital natives like Black Myth: Wukong (a PC-first title with a massive China audience used to digital downloads) and Madden 26 (an annual live-service game nobody keeps a box for). Most recent annual sports games land at a similar physical share.

Third-party publishers are obviously chuffed behind the scenes because of the underlying unit economics. On a standard $70 first-party game, a disc sale nets Sony roughly $45 after retail’s cut and manufacturing. A digital sale keeps effectively the full $70, yielding a 54% jump per copy.

Sony’s internal numbers clearly show that any unit sales lost by killing the disc drive will be far smaller than that 54% margin uplift. For third-party games, the gap is smaller but still significant: ~$35 on a disc versus ~$49 digital (a ~40% uplift). $80 base prices widen that absolute cash gap on every single converted sale.

Extrapolating this across a full catalogue shows why Sony pulled the trigger. Sony wants Steam-style catalogue margins, so they are cutting an increasingly small, low-margin retail channel to force everyone into a storefront they fully control, pocketing the retail cut on every transaction.

FF7 Rebirth at 48% physical means nearly half its buyers ran through the lowest-margin channel. Push even a chunk of those buyers to digital, and per-copy revenue on that group jumps by half.

More on Substack!

[Ryan Fleury @rfleury]

Stop putting web UI frontends in game engines

[GrapheneOS @GrapheneOS]

https://t.co/fSCUYxV9OB

This proposal wouldn't hide that a wipe occurred and would help adversaries exploit and recover data from the device. It isn't a new idea and people have proposed variations of this hundreds of time for years. These proposals wouldn't hold up against widely available forensic software. Giving an attacker access to a decoy profile would make it far easier for them to exploit the device. Without a shut down or reboot, a device was previously in After First Unlock state would be very vulnerable to having data extracted.

GrapheneOS has strong protection against data extraction without depending on a duress PIN/password. The default enabled protections combined with a strong passphrase and 2nd factor fingerprint PIN would have provided fantastic protection for the data on the device. Reducing the device auto-reboot timer would be even better. The secure element would have protected the data with only a random 6 digit PIN instead of a passphrase in practice too.

All of our features are designed to work against adversaries aware of GrapheneOS. Our duress PIN/password is no different. Adversaries aware of GrapheneOS face a dilemma about whether a PIN/password provided by the user is going to unlock the device or wipe it. It wasn't designed around being a secret resulting in an unpleasant surprise for an adversary. We also plan to provide it as part of secure element rate limiting on future devices built to run GrapheneOS to prevent bypassing it with an OS exploit.

Triggering our duress PIN/password feature wipes both hardware keystores, the secure element as a whole and disk encryption metadata. Each of these 3 steps is enough on their own to reliably wipe material needed to obtain the key encryption keys for disk encryption. It happens nearly instantly and it wouldn't be secure if it took a bunch of time or depended on actually erasing any of the encrypted data. Shutting down the device triggers clearing sensitive data from RAM and registers to complete the process. It's necessary to clear a lot of sensitive data from memory and registers including decrypted encryption keys in TEE memory.

Giving an adversary access to a profile on the device instead of shutting down or rebooting would be very problematic. It would give them an immense amount of attack surface for exploiting the device to recover sensitive user data. If the Owner user is in After First Unlock state, the adversary has given massive attack surface for exploiting the device to obtain all of the data from the main user. It would be the extreme opposite of the attack surface reduction and exploit protections provided by GrapheneOS.

GrapheneOS and apps running on it could continue to function indefinitely after the key derivation material is wiped. It already has disk encryption keys loaded into Trusted Execution Environment memory and is using those for inline disk encryption via wrapped keys. Only functionality depending on hardware keys would be broken. If there were profiles in After First Unlock state those would still be available. An attacker exploiting the device would recover the same data as before wiping the key encryption keys.

Forensic data extraction companies have access to GrapheneOS and we don't have access to their software. We cannot rely on security through obscurity or knowing how their software works including which vulnerabilities they exploit. Fooling widely available forensic software into believing a decoy profile is the Owner user isn't feasible. It would need to provide a fully functional Android Debug Bridge (ADB) environment which is completely impractical.

People should consider the fact that they likely haven't thought about this nearly as much as us. There are good reasons for why we designed this feature the way we did and it's working as intended in the real world. The feature becoming widely known about is a requirement for it to work as intended by creating a dilemma for adversaries. The main thing we need now is secure element support for it which we can get implemented for future devices as part of our Motorola Mobility partnership and future OEM partnerships.

[Marocco2 @Marocco2s]

@PabloOraa @carygolomb There's no need to partnership Steam: Valve already gives to publishers keys for free for their games. They can totally wake up one day, give steam keys for players and close their launchers services. Also, they are able to revoke keys if a refund request is issued

[Nuno Afonso @nafonsopt]

Tired of Git / Git Hub? Want to bring sanity and performance to your version control?

Introducing Ark HUB! It is a spartan version control hosting solution for Ark VCS, aimed at high performance / reliability, currently supporting private repositories.

It is currently in closed beta, if you'd like to try it please reach out! https://t.co/Z1XaBf3tWC

[Marocco2 @Marocco2s]

@ShyVortex Kane absolute stat-padder, destroyed even by Lautaro when the ball is hot

[GrapheneOS @GrapheneOS]

GrapheneOS has strong defenses against data extraction. It heavily builds upon the standard security features provided by Android 17 and the most secure hardware available for Android. Currently, only Pixels provide the hardware security features and updates required by GrapheneOS. That's going to change in 2027 thanks to our partnership with Motorola Mobility and progress being made by Qualcomm.

Disk encryption provides strong protection for data. Even the most sophisticated attackers aren't going to be directly breaking it. They either need to exploit the OS while in After First Unlock state or brute force the PIN/password.

Android 16 QPR2 calls for a secure element implementing rate limiting ramping up delays. It's 4 hours after 10 and 41 days after 15. Only 20 attempts are allowed. For usability, It rejects the most recent 5 unique failed attempts early to avoid wasting attempts on repeated errors. GrapheneOS only supports devices implementing the latest generation secure element rate limiting.

https://t.co/NCM7SKeVM6

The secure element on the supported devices also has insider attack resistance. That's implemented by requiring the Owner user to successfully authenticate before the secure element firmware can be updated. A valid signing key and greater version number aren't enough alone. The purpose of this is preventing any government from bypassing the rate limiting by coercing the creation of a firmware update removing the rate limit.

Pixels have used a secure element with an internal timer implementing rate limiting and insider attack resistance since the Pixel 2 launched near the end of 2017. Here's a post about this from back in 2018:

https://t.co/PyRTAml5Cw

The secure element and integration into the OS has become far better since then, but it shows this goes back a long way and isn't a new feature.

GrapheneOS also raises the character limit for passwords from 16 to 128. This enables using high entropy diceware passphrases not depending on the secure element rate limiting.

To make a strong passphrase convenient to use without ruining it with biometric unlock, GrapheneOS adds an optional 2nd factor fingerprint PIN. We reduce the allowed fingerprint attempts from 20 to 5 and failure to enter the correct 2nd factor PIN counts towards it. This enables using 6-8 random diceware words as the main unlock method required in Before First Unlock and fingerprint+PIN using a short PIN for convenience. Using a valid fingerprint prompts to enter the 2nd factor PIN which is needed to complete unlocking the screen and hardware keystore.

GrapheneOS greatly improves the exploit protections for the OS with hardened memory allocators and other features. It heavily uses hardware-based security features including hardware memory tagging (MTE) to protect against exploits. A partial overview of those protections is here:

https://t.co/NH8qDWfnH0

GrapheneOS adds specialized protection against attacks with physical access too. For example, it blocks new USB connections at a software and hardware level by default while locked and disables USB data as soon as there are no active USB connections.

GrapheneOS shipped a locked device auto-reboot timer back in June 2021. It can be set between 10 minutes and 72 hours. We enabled it by default using 72 hours and then lowered it 18 hours. It automatically returns the device to Before First Unlock state due to our memory zeroing as part of tearing down the OS and booting. We got Pixels to add memory zeroing for booting the firmware fastboot mode in April 2024. Apple and Google added a locked device auto-reboot timer in iOS 18.1 and Android 16. For Android, it can be enabled with the Android Advanced Protection Mode. Our implementation is better for multiple reasons but it's a useful feature regardless.

Android uses separate encryption keys for each secondary user and Private Space. GrapheneOS adds support for putting both back into Before First Unlock state without a reboot via end session for secondary users or toggles for either to do it by default. It's still much better for the device to be rebooted to get the main user back at rest, completely clear leftover data from RAM and block secure element updates.

Our duress PIN/password feature is a minor feature fitting into the bigger picture. It wipes the device when it's entered in any OS prompt for the current profile's PIN or password. It will wipe the device when entered into the authentication prompt for changing a sensitive setting or anything else requiring it, not only the lockscreen. It works across every profile including secondary users and Private Spaces, not only the main user.

There are multiple ways to use the duress PIN/password feature including writing it down on a phone case or a paper kept in a wallet. People should carefully consider how to use it in an actual duress situation where there can be physical or legal consequences for wiping the device. GrapheneOS doesn't require it to protect data from being extracted from the device, but it takes recovering it completely off the table even with the PIN/password for each profile on the device.

GrapheneOS doesn't depend on the duress PIN/password to protect user data. It's one of the tools it provides among the major privacy and security improvements it offers as a whole. Our features page provides an overview of what GrapheneOS offers compared to standard Android 17. It covers most of the major features we provide and many of the minor ones but there's also a lot more beyond it. Our release notes are a lot more exhaustive since we make sure to cover everything when it's added, changed or removed.

https://t.co/5BbNpMO7No
https://t.co/sNlMyRHsyL

[RPCS3 @rpcs3]

⚠️ Attention NVIDIA users on Windows!

Recent NVIDIA drivers have an issue that is CRASHING our Vulkan renderer!

If you see any Fatal Error on Module name: 'nvoglv64.dll' - this indicates a driver-side crash - the solution is to disable "NVIDIA overlay" on the NVIDIA App!

[Beyond FPS @beyond_fps]

The amount of times that game devs do this is truly annoying, why is it so hard to include in-game settings to turn on/off these things?

At least on PC we can fix this ourselves, on consoles they are stuck with it.

[Anees Iqbal @realsteelbrain]

metal2vulkan is now open-source! 🔗 in the🧵

paravirt-gpu is going to take more time, lots of todos!

https://t.co/i5btRuakzl