I have a hard time believing this wasn’t intentional at the orders of the famously anti-encryption, anti-privacy Indian government under Modi. It would also have allowed their spy agencies to carry out certain activities with plausible deniability with global reach.

I just don’t believe incompetence in this case. It’s so incompetent it’s like it was intentionally engineered to look that way rather than something malicious.

I’ll not be allowing this company’s certs into anything I run ever again.

Minimum age requirement and activity requirement. If it was built all in one go it’s more likely to be abandoned and full of problems and just pollute the landscape. If it’s been under development with multiple commits over a time-span of months or a year or more it’s more likely to be higher quality, have human in the loop somewhere, continue development, patches, etc. Linux itself for example would be exempted because it has a significant age, significant recurring activity in development, multiple human developers, etc.

I do think exceptions on a case by case basis for clever simple programs that address a not previously addressed need might be fine as well. I really think there needs to be a little discretion for mod action.

What a lot of people hate and I do as well are these “look daddy I can ‘code’ too” baby’s first/second/etc vibecoded programs that people proudly toss out there without any real thought beyond pride they told an LLM to make something and it did it. Those rarely add much value, often are redundant with one another (why reinvent the wheel again and again?), and would tend to be lower quality and end up just being so much spam that makes it harder to understand what’s worthwhile.

Won’t work.

They’ll call in experts from the FBI, forensics firms, etc. Show the court other graphene OS models, show what happens when the duress code is entered and ask the agents whether it matched what happened. Demand his lawyers provide an alternative explanation (there are no other plausible ones). Search github and try to find similar reports of the Graphene phones “just doing that” as in wiping themselves or displaying a screen like that. There won’t be any. Reasonable conclusion that’s good enough for a conviction will be that he gave them the duress code.

He’ll either go down or walk on other factors such as the legality of the search, whether the fact he didn’t personally enter it counts (I really doubt that holds water, it’s like encouraging cops to activate a booby trap that burns down your house, the courts take a dim view of it and it’s still destruction of evidence), or some other vague technicality.

Also cops are allowed to lie to you and do it regularly as a matter of practice so the police lying to him about what the search was for is not illegal. It was a tactical, calculated lie designed to outrage the subject and get him to cooperate to prove he wasn’t a pedophile.

And the word of authorities is considered to have more weight than the word of your average person so their word it happened like this vs his that it didn’t and no other plausible explanations with evidence for his version of events and they’ll find against him.

The best thing to do is not cross international borders with sensitive info on your device. The second best thing failing that is to use a securely encrypted device like Graphene that they can’t crack and while passing through customs to put it in before first unlock mode such as restarting it.

What Graphene should have is a setting that wipes the phone automatically after so much time without an unlock. They’d have seized his phone, wouldn’t be able to crack it. Would set it aside hoping for a future vulnerability to be discovered by those zionist fascists they employ and the phone while in storage and through no direct action of his would wipe itself before they could deploy such a future vulnerability 6-12+ months down the line. Now maybe they already have a way to affect the clock on the device to prevent such a thing but it’s the only alternative I can think of to hoping the encryption stands up and there are no vulnerabilities found for years or ever.

I just want a real security solution for Linux that’s privacy respecting and not the NSA in a trenchcoat (aka M$) but that’s too much to ask. The offerings for advanced security on Windows are better than those on Linux for desktop use (we’re not talking server) and it’s not even close. Secure enough for most people is nice. But it’s not enough for the paranoid like me and I desperately want it to be.

Defender has a very good thing in its configurable hard mode that simply blocks new executables that have never been seen before by M$'s cloud data. That stops pretty hard and fast a lot of new in the wild malware including campaigns by sophisticated actors. Combine with good management of LOLbins and a lockdown on those and you have a pretty hardened machine. The issue is it isn’t private because it’s sending M$ a complete list of hashes of every file on your machine which they pass to the NSA I’m sure. That and Windows itself being NSA-malware you know.

While there are many people that are genuinely that daft take heart in remembering that reddit is heavily astroturfed by US/UK psyops and a lot of those posting and upvoting are soldiers paid to sway opinion using bot armies.

This is another way they’ll lock out Linux as an OS. It won’t pass passkey attestation or age check attestation so it just won’t be allowed to access the web because clearly you’re a bot or some other bad actor for failing those.

That or they’ll create a special government backdoored and approved Linux that has attestation in among a bunch of other blackbox modules that you have to trust aren’t an NSAKEY right into your system.

The future looks so bleak with all this online, Flock, Axon, etc cameras IRL controlling all movement and all fed into Palantir for one online and offline profile of you for the police state.

Ah good that way US sanctions cut off designated bad guys from encryption that much faster.

Also good because heavy automation means larger opportunities for the NSA and eyes countries to hack you, change that automation slightly and compromise your infrastructure to their liking and you won’t even notice because things are changing so often you as a human cannot possibly keep up and review these things.

Centralized trust is already experiencing a massive crisis as it’s entirely under the control of very untrustworthy, abusive western authorities centralized within the US and subject to subterfuge by spy agencies, political machinations, sanctions laws, etc.

Attackers really don’t need more than a few days to exploit stolen private keys anyway. Assuming they’re using an attack kit with good zero days in tandem with it (pretty likely with AI assisted exploit finding) so all this will result in is attackers adapting IMO.

Let’s be clear that not just any state actor can do this. We’re talking about the US, UK, rest of the eyes alliance. Snowden revealed they are the threat who operates like this and we shouldn’t forget it.

India can’t likely do this, China, Russia, Brazil, South Africa cannot do it.

You don’t understand.

The alternative to device based private attestation which is what this is or could be part of is constant online verification by Palantir.

Is every time you want to view porn or adult content you have to verify your real identity so evil corporations and the government who pays them know exactly what your fetishes are and can blackmail you. So they know exactly what you’re posting online because you have to face-scan and ID-scan to set up an email account, a social media account, any account with anything that allows posting content online. Is training the population not to enter a date for their kids or themselves when setting up a computer or device account for the first time, once but upon demand scan their face, scan their ID, comply, sit meekly in fear because everything they do online is known.

What does this know? Your birthday. That’s nothing. As it stands it you can enter anything you want. Fight them when they come to add a verification system to this and point out parents would be in a position to set this up for their kids anyways and its just spying. Fight on stronger ground.

We’ve already lost the maximalist position. The internet scanning and ID verification has already been enacted in several states and countries and we risk a world where it becomes the norm and hosting companies drop anyone who doesn’t implement it because they’re made liable as well. This stuff won’t be repealed. People don’t live in democracies. They live in a dictatorship of the wealthy and the corporations. Your dissent doesn’t matter and it cannot reach most tech illiterate people who have far more pressing concerns than to riot over this.

This is a compromise solution and I wish more people would see it. If you can bend you don’t break. If you don’t bend and your enemy is the government they are stronger than you and they will snap you like a twig.

Linux desktop market share is too small to matter. And if you make this push fail then the only alternative, the only viable solution these politicians who are being cajoled and urged to implement this will see is online live-scan face and ID verification and it’ll sweep everything. You’ll have destroyed the internet and having saved Linux won’t matter. After that it’ll be a quick move to ban encryption that the government cannot break and ISPs will block traffic they can’t inspect. Game over. A simple maneuver from the place you force them to by refusing to cooperate and enact this compromise, privacy-preserving solution. We need strong defensible positions to protect privacy and the internet and free software and to understand that the old ways have been lost, they’ve died, they’ve been strangled and a compromise position must be taken up to endure and avoid a total loss.

No thank you. I like Firefox the way it is. I hate big changes for the sake of designers keeping their jobs changing my tools and workflow and making things ugly.