Gaël Duval is the founder and president of the /e/ foundation along with the CEO of Murena. Duval and his organizations have consistently taken a stance against protecting users from exploits. In this video, he once again claims protecting against exploits is only useful for pedophiles and spies.
Translation to English:
> There's the attack surface, on that front we're not security specialists here, so I couldn't answer you precisely, but from the discussions I've had, it seems that everything
Transcription in French:
> Il y a la surface d'attaque, là pour le coup on est pas des spécialistes de la sécurité, donc je ne pourrais pas te répondre avec précision, mais des discussions que j'ai eu, il semblerait que tout ce qu'on fait, ça réduit la surface d'attaque. Donc oui, probablement ça aide. Par contre, on a pas une approche "sécurité durcie", on développe pas un téléphone pour les pédo(bip) pour qu'ils puissent échapper à la justice. Donc il y a pas des trucs pas possibles pour voir
Here are several particularly egregious examples:
Gaël Duval and Murena participated in these attacks. They even spread harassment content towards our team and shared it with sites attacking us.
Les téléphones Google Pixel équipés du système d’exploitation GrapheneOS permettent à des criminels de dissimuler leurs échanges. Johanna Brousse, magistrate spécialisée dans la lutte contre la cybercriminalité, explique quels sont les moyens de la justice pour contourner ce type d’outils.
/e/ and Murena have their own privacy invasive behavior in their apps and services. One particularly egregious example is their supposedly private speech-to-text service sending user data to OpenAI without consent instead of doing most locally like Apple:
https://community.e.foundation/t/voice-to-text-feature-using-open-ai/70509
Thank you a lot for your positive and supporting comments about our new /e/OS Voice-to-text! Regarding its implementation in /e/OS, I’d like to explain a few things to explain why we have chosen an OpenAI STT API to implement it and how it’s going to evolve in the future: What we have learned from our experimentations with STT models that run locally on the smartphone for speech recognition: they work quite poorly, they make a lot of mistakes in voice recognition they are not able to mix la...
Here's a paywall bypass for the 2 paywalled articles above:
These are among the most egregious cases of France's corporate and state media presenting highly inaccurate state smearing of GrapheneOS as fact but there's much more.
@jsa @GrapheneOS @Fnordinger @cutesobri
A non-exhaustive list of issues with /e/ and its misleading marketing :
https://ewwlo.void.partidopirata.com.ar/
These two links contain many other links. There are other sources that I don't have on hand.
@GrapheneOS @jsa @Fnordinger @cutesobri The entire point that GOS is only used by criminals is such an exhausted and cliche argument at this point. It's used against almost any privacy/security project. It's the same argument that governments use to justify encryption backdoors, age verification, and many other invasive technologies.
I'm a "law-abiding citizen" by every metric and rulebook, but I use GrapheneOS because I don't want Google and many other companies tracking everything I do.
1/2
@GrapheneOS @jsa @Fnordinger @cutesobri GOS also gives me way more control over my own phone, and honestly that's something everyone should want.
Secure and private software is for anyone who wants to use it, and for varying amounts of threat level. The amount of privacy, security, and control that GOS provides *should* just be the baseline for every mobile OS, but companies like Murena and /e/OS muddy the waters with misleading marketing.
Security/privacy theatre is dangerous.
2/2
@GrapheneOS And this thing is old, for example, back when the first versions of Firefox were released, France had demanded versions of Firefox with significantly reduced security to allow law enforcement agencies to take remote control of it. I didn’t know about it at the time; I was too young, but I know it happened.
During the gradual transition to encrypting the web, France was reluctant and initially wanted to limit encryption to states websites and banks.
Surveillance by the French government has taken an even more aggressive turn since 2015, following the Charlie Hebdo attacks.
The GDPR has so far proven ineffective, and it is mainly due to the censorship and decisions of the Constitutional Council and the Court of Justice of the European Union that the French government is prevented from going further than it would like, but every year, it tries to circumvent these decisions.
@GrapheneOS
To be fair, Signal lies about their actual security, particularly regarding metadata protection.
Olvid, a French IM, arguably offers better privacy than Signal, by design. But they are French, so I don't trust them either for the reasons you listed in this thread.
@simplex is way ahead of Signal and Olvid, privacy/security-wise.
@x_cli @GrapheneOS
There is no way I would ever trust simplex, when it's founder stated in chat how he should be able to enforce how simplex is used and that he wants software developers to be coders of enforced law.
In addition to his MAGA sympathy, this dude is just one power trip away from (trying) to develop hidden backdoors.
@x_cli @GrapheneOS
Regarding MAGA support this is the only screenshot I have, but there was much more.
The other 2 screenshots are taken from an open simplex dev channel.
"Software and law...will be one thing... [which is the] only...alternative to...tyranny"
"Absolute freedom to use software...can only lead to tyranny..."
"you should not be able to break [rules]"
"Technology is better positioned to enforce....then police..."
@x_cli @simplex We listed Signal as an example of another serious privacy project which Duval has repeatedly attacked and misled people about. It wasn't a recommendation of Signal over other options, but we don't agree with your assessment about Olvid.
We've never seen Signal lying about privacy or security. What exactly are you referring to?
We've seen /e/ and Murena doing it relentlessly and we can show many examples of it as we've been doing including here:
@GrapheneOS
Olvid offers better privacy than Signal because:
* it supports multiple identities, none tied to a real world identity or PII. Signal supports only one identity tied to a phone number;
* it can be installed from F-droid without Google services ; Signal can only be installed from the Google Play Store on Android. Both supports APK, though.
* servers can be decentralized/federated/self-hosted. Signal is centralized and hosted.
* server (message relay) is actually open source. Signal server source code is incomplete, often outdated.
* Servers do not rely on numerous service providers; only the one for the message relay; you can select your own TURN server for calls. Signal on the other hand depends on AWS, Cloudfront and Cloudflare for messaging/attachments.
This was in the previously linked video. Here are the slides if you don't want to listen to it:
https://cfp.pass-the-salt.org/media/pts2025/submissions/7K9MEV/resources/PTS2025-TALK-25-metadata_prot_in_instant_msg_apps_LsHI6ZN.pdf
Signal lies about their security level in multiple ways:
* inducing a false sense of security by pretending they collect any metadata except the time of account creating and last message retrieval: their infrastructure depends on many subcontractors, none of which make any privacy claims about not collecting data;
* they can silently and selectively disable sealed senders;
* they have a history of ignoring security reports sent to them, sometimes for months or years;
* they obviously can have so much more data than what they pretend, like all metadata regarding group size and management, prekeys requests/refresh, last connection IP address, connection frequency, etc. We have to trust them for not collecting them. That's not security. That's blind trust.
Regarding /e/ and Murena, I don't know anything about them. I'm not gonna advocate for them or anything.
@simplex
> it supports multiple identities, none tied to a real world identity or PII
Multiple instances of Signal can be used on the same device at a time. Contact discovery and sharing of the phone number can and should generally be disabled. It's an anti-spam mechanism to still require it despite having usernames. There are non-KYC services for phone numbers available.
> Signal can only be installed from the Google Play Store
No, Signal is available outside the Play Store in multiple ways.
> Multiple instances of Signal can be used on the same device at a time.
Using GrapheneOS profiles sure but I don't know how people using other OSes can. Maybe I am missing something?
> There are non-KYC services for phone numbers available.
Services with no KYC may exist in some countries. Even if there is no KYC, you still need to pay in cash or other kind of untraceable currencies, and get the SIM card without being filmed. That can be done, but to be honest, it is just easier to rely on a service not relying on a phone number 🤷
Olvid and SimpleX do not need a phone number to be protected against spam.
> No, Signal is available outside the Play Store in multiple ways.
I know about APK installation and I mentioned it. I don't know about other installation mechanism.
On signal.org/download, the only advertised installation options for phones are the official app stores.
@GrapheneOS
I stand corrected. Thanks!
I did not know this was a thing in AOSP! I believe these are recent features, because I do not recall having them on my phone before I switched to GrapheneOS.
30(-ish) toots yesterday and today on /e/. Have you considered increasing the character limit per toot? Perhaps one longer toot (let's say, 1500 characters? 3000?) could summarise all your views on this topic?
@bohwaz
C'est dans la vidéo en tête de fil
Attached: 1 video Gaël Duval is the founder and president of the /e/ foundation along with the CEO of Murena. Duval and his organizations have consistently taken a stance against protecting users from exploits. In this video, he once again claims protecting against exploits is for only useful pedophiles and spies. Translation to English: > There's the attack surface, on that front we're not security specialists here, so I couldn't answer you precisely, but from the discussions I've had, it seems that everything
@GrapheneOS > /e/ and Murena have repeatedly claimed GrapheneOS is for drug dealers, pedophiles, terrorists and spies
Wow, they used the old tired canard practically verbatim. How pathetic.
GrapheneOS
Sobri | Zoe (she/her)
jsa
Fnordinger
Xtreix
Ted's Tech Tips
Alyx ⏚
Andromxda 🇺🇦🇵🇸🇹🇼
desirable_dialogue
jon_bon
Splinux 
Seth Jones
Rust Buckett
BohwaZ
dallo
LisPi