Mastodawn

GrapheneOS Apr 5

Gaël Duval is the founder and president of the /e/ foundation along with the CEO of Murena. Duval and his organizations have consistently taken a stance against protecting users from exploits. In this video, he once again claims protecting against exploits is only useful for pedophiles and spies.

Translation to English:

> There's the attack surface, on that front we're not security specialists here, so I couldn't answer you precisely, but from the discussions I've had, it seems that everything

GrapheneOS Apr 5

> we do reduces attack surface. However, we don't have a "hardened security" approach, we aren't developing a phone for pedo(censored) so they can evade justice. So there aren't difficult things to check if the memory is corrupted, really hardened security stuff that could clearly be useful for executives, in the secret service, or whatever. That's not our goal, our goal is to start from an observation: today our personal data is constantly being plundered and that wouldn't be legal in real life

GrapheneOS Apr 5

> with the mail or the telephone, we want to change that. So we are making you a product that changes that by default for anyone.

GrapheneOS Apr 5

Transcription in French:

> Il y a la surface d'attaque, là pour le coup on est pas des spécialistes de la sécurité, donc je ne pourrais pas te répondre avec précision, mais des discussions que j'ai eu, il semblerait que tout ce qu'on fait, ça réduit la surface d'attaque. Donc oui, probablement ça aide. Par contre, on a pas une approche "sécurité durcie", on développe pas un téléphone pour les pédo(bip) pour qu'ils puissent échapper à la justice. Donc il y a pas des trucs pas possibles pour voir

GrapheneOS Apr 5

> si la mémoire est pas corrompue, des trucs de sécu vraiment durcis qui pourraient être utiles clairement pour des dirigeants, dans les services secrets ou que sais-je. C'est pas notre but, notre but c'est de partir d'un constat, aujourd'hui nos données personnelles sont pillées en permanence et ça serait pas légal dans la vraie vie avec le courrier ou le téléphone, on veut changer ça. Donc on vous fait un produit qui change ça par défaut pour n'importe quelle personne.

anonymous1 Apr 6

GrapheneOS exists to protect users from having their privacy invaded by arbitrary individuals, corporations and states. Privacy depends on security. GrapheneOS heavily improves both privacy and security while providing a high level of usability and near perfect app compatibility.

GrapheneOS Apr 5

/e/ has far worse privacy and security than the Android Open Source Project. They fail to keep up with important standard privacy and security patches for Android, Linux, firmware, drivers and HALs. They fail to provide current generation Android privacy and security protections.

GrapheneOS Apr 5

For years, Gaël Duval has spearheaded a campaign to misrepresent GrapheneOS as not being usable, not compatible with apps and only useful to a tiny minority of people. He has repeatedly claimed GrapheneOS is for pedophiles, criminals and spies while claiming /e/ is for everyone.

GrapheneOS Apr 5

It's hardly only GrapheneOS focusing on protecting users against exploits. Apple and Google have put a ton of work into it. Apple heavily focuses on privacy and security. That includes protecting against remote exploits, local exploits from compromised apps and data extraction.

GrapheneOS Apr 5

GrapheneOS and iOS are both heavily focused on privacy and security. Both are gradually adding much stronger protections against apps/sites scraping data, coercion users into giving data via alternatives with case-by-case consent and increasingly strong exploit protections.

GrapheneOS Apr 5

/e/ is far weaker in all of these areas compared to the standard Android Open Source Project on secure hardware. It doesn't keep up with standards updates and protections. It adds tons of low security attack surface and privacy invasive services. It's not in the same space as us.

GrapheneOS Apr 5

/e/ and Murena devices are far worse for privacy and security than an iPhone. It's trivial to break into their devices remotely or extract data from them compared to an iPhone. They have weaker privacy protections from apps too. Their main approach to privacy is a DNS blocklist.

GrapheneOS Apr 5

Their DNS blocklist can only block domains not used for useful functionality to avoid ruining usability. Meanwhile, the most privacy invasive behavior by apps is rarely ever split out into separate domains. Even for those, apps and websites can trivially evade DNS blocklists.

GrapheneOS Apr 5

It's common for apps and websites to do everything through their own servers. That's best practice to avoid leaking API keys. It's increasingly common for invasive libraries to use hard-wired IPs and/or DNS-over-HTTPS to evade blocking. DNS filtering is increasingly less useful.

GrapheneOS Apr 5

Murena is a for-profit company owned by shareholders including Gaël Duval. /e/ has a non-profit organization which is also led by Gaël Duval. /e/ includes paid services from Murena. /e/ very clearly exists to build products for Murena to sell in order to enrich the shareholders.

GrapheneOS Apr 5

Despite being done for profit, /e/ receives millions of euros in funding from the EU on an ongoing basis. /e/ and Murena use extraordinarily inaccurate marketing to not only promote their products/services but also to mislead people about GrapheneOS and scare them away from it.

GrapheneOS Apr 5

Recently, France's national law enforcement began fearmongering about GrapheneOS and smearing it with inaccurate claims. France's corporate and state media heavily participated. Many articles and also radio/television coverage misrepresented GrapheneOS as being for criminals.

GrapheneOS Apr 5

Across French corporate and state media covering it, inaccurate claims by the state about features, distribution and marketing of GrapheneOS were wrongly presented as fact. Most of them didn't contact us and we weren't shown what was being claimed so we could properly respond.

GrapheneOS Apr 5

Here are several particularly egregious examples:

https://www.leparisien.fr/faits-divers/telephones-proteges-utilises-par-les-narcotrafiquants-rien-nest-inviolable-19-11-2025-3PP34GIBAJGH3EZOVEJVT7OMU4.php

https://www.leparisien.fr/faits-divers/google-pixel-et-grapheneos-la-botte-secrete-des-narcotrafiquants-pour-proteger-leurs-donnees-de-la-police-19-11-2025-NTGPQE4JCNGEHLF7XGIQ3CCA2I.php

https://www.franceinfo.fr/faits-divers/narcotrafic-les-autorites-alertent-sur-l-utilisation-d-un-systeme-d-exploitation-de-telephone-pour-echapper-aux-forces-de-l-ordre_7631510.html

Gaël Duval and Murena participated in these attacks. They even spread harassment content towards our team and shared it with sites attacking us.

Téléphones protégés utilisés par les narcotrafiquants : « Rien n’est inviolable ! »

Les téléphones Google Pixel équipés du système d’exploitation GrapheneOS permettent à des criminels de dissimuler leurs échanges. Johanna Brousse, magistrate spécialisée dans la lutte contre la cybercriminalité, explique quels sont les moyens de la justice pour contourner ce type d’outils.

Le Parisien

GrapheneOS Apr 5

/e/ and Murena are based in France. They've been pushing false narratives about GrapheneOS falsely claiming it isn't usable by regular people and doesn't benefit them for years. Duval has been making the ludicrous claim GrapheneOS is only useful to criminals and spies for years.

GrapheneOS Apr 5

/e/ and Murena aren't on the same side as GrapheneOS. They're charlatans selling devices with poor privacy and atrocious security to earn money. They've spent years trying to undermine a legitimate privacy project and heavily use the same talking points as police state advocates.

GrapheneOS Apr 5

Their marketing heavily focuses on avoiding Google and gives the impression they believe privacy means avoiding one company. Meanwhile, they add a bunch of Google services not present in the Android Open Source Project and give extensive privileged access to Google apps/services.

GrapheneOS Apr 5

/e/ and Murena have their own privacy invasive behavior in their apps and services. One particularly egregious example is their supposedly private speech-to-text service sending user data to OpenAI without consent instead of doing most locally like Apple:

https://community.e.foundation/t/voice-to-text-feature-using-open-ai/70509

Voice to Text feature using Open AI

Thank you a lot for your positive and supporting comments about our new /e/OS Voice-to-text! Regarding its implementation in /e/OS, I’d like to explain a few things to explain why we have chosen an OpenAI STT API to implement it and how it’s going to evolve in the future: What we have learned from our experimentations with STT models that run locally on the smartphone for speech recognition: they work quite poorly, they make a lot of mistakes in voice recognition they are not able to mix la...

/e/OS community

GrapheneOS Apr 5

/e/ and Murena have repeatedly claimed GrapheneOS is for drug dealers, pedophiles, terrorists and spies. /e/ and Murena are anti-privacy. They're heavily profiting from marketing products as private but don't believe in it. /e/ is an authoritarian-aligned fake privacy project.

GrapheneOS Apr 5

France is the most anti-encryption, anti-privacy and anti-security country in the EU. They've been doing a gradual crackdown on open source privacy projects including GrapheneOS and Signal with escalating smears and threats. /e/ and Murena are on the side of the police state.

GrapheneOS Apr 5

That interview is not Gaël Duval misspeaking but rather he's expressing views we've seen him communicate in written form many times before. He has repeatedly misled people about what GrapheneOS provides and claimed it's only useful to criminals. He supported those media attacks.

@GrapheneOS And this thing is old, for example, back when the first versions of Firefox were released, France had demanded versions of Firefox with significantly reduced security to allow law enforcement agencies to take remote control of it. I didn’t know about it at the time; I was too young, but I know it happened.

During the gradual transition to encrypting the web, France was reluctant and initially wanted to limit encryption to states websites and banks.

Surveillance by the French government has taken an even more aggressive turn since 2015, following the Charlie Hebdo attacks.

The GDPR has so far proven ineffective, and it is mainly due to the censorship and decisions of the Constitutional Council and the Court of Justice of the European Union that the French government is prevented from going further than it would like, but every year, it tries to circumvent these decisions.

30(-ish) toots yesterday and today on /e/. Have you considered increasing the character limit per toot? Perhaps one longer toot (let's say, 1500 characters? 3000?) could summarise all your views on this topic?

@GrapheneOS alo they arrested Pavel Durov, just to add insult to injury.

Seth Jones Apr 5

@GrapheneOS
In a world of corporate and state over reach, anyone wanting privacy is the enemy.

Rust Buckett Apr 5

@GrapheneOS Privacy isn't a crime

@codimp je n'ai trouvé aucune source à ce sujet, ça a été répété par le gars de GOS, mais comme d'hab dans ses attaques gratuites contre le reste du monde (Lineage, MicroG, Murena, F-Droid, etc.) il faut le croire sur parole, et si tu insiste il dis que tu fait partie d'une cabale qui le harcèle :-/

@bohwaz
C'est dans la vidéo en tête de fil

https://grapheneos.social/@GrapheneOS/116353973732143171

GrapheneOS (@[email protected])

Attached: 1 video Gaël Duval is the founder and president of the /e/ foundation along with the CEO of Murena. Duval and his organizations have consistently taken a stance against protecting users from exploits. In this video, he once again claims protecting against exploits is for only useful pedophiles and spies. Translation to English: > There's the attack surface, on that front we're not security specialists here, so I couldn't answer you precisely, but from the discussions I've had, it seems that everything

GrapheneOS Mastodon

@GrapheneOS > /e/ and Murena have repeatedly claimed GrapheneOS is for drug dealers, pedophiles, terrorists and spies

Wow, they used the old tired canard practically verbatim. How pathetic.

Four Horsemen of the Infocalypse - Wikipedia

🎹 Your Masto in April 🎹Apr 5

@GrapheneOS Can't wait for your Motorola partnership to further legitimize GrapheneOS.

@GrapheneOS Le Parisien :

"Ces engins jusqu’à présent inviolés, qui protègent les communications et qui ne partagent pas les données sur les serveurs, sont un nouveau défi que le parquet cyber entend bientôt relever."

C'est exactement pareil avec Signal sur Android si on n'utilise pas le cloud, ils nous prennent pour des imbéciles.

@davep @GrapheneOS Hahaha, furthermore, this false claim makes no sense: GrapheneOS does not route user communications through these servers; GrapheneOS is not a company and does not offer services such as messaging or email etc.

Lilith 🏴🇵🇸Apr 5

@GrapheneOS This is clearly a smear campaign against the project.

Is there any chance this could seriously harm the project to the point of affecting the partnership with Motorola?

Sailor Anarres Apr 5

@GrapheneOS thats how you know you are doing something right

Joe Vinegar Apr 5

@GrapheneOS I boosted this out of sympathy, but are there public sources for these statements?

@joe_vinegar Nope, GOS social account has been attacking other projects without providing any sources for years. And if you try to ask, they'll tell you to do your own research, or that you are part of a conspiracy… This is sad really.

@bohwaz @joe_vinegar Ehm, the thread literally starts with a video? It's pretty clear who they are attacking.

Why are you defending a company that says "security is only for pedophiles and spies"?

@danieldk
I am not defending what they said. The video doesn't mention gos at all.
@joe_vinegar

@bohwaz @joe_vinegar Ok, I think we can at least agree that Gael Duval's statement implies that phones that do security hardening are for criminals and spies?

Now, next, which serious projects (not snake-oil security phone companies) focus on phone hardening?

So, in what way is he not attacking @GrapheneOS ?

(Perhaps ironically, he is also attacking iOS and Pixel OS, but that will whoosh past his audience, since most people do not know about Apple/Google's hardening efforts).

@bohwaz @joe_vinegar @GrapheneOS Put differently, he is using the "think of the children"-argument to attack anyone who has better privacy and security than them.

This effort to make security and privacy suspect puts them really in the same camp as the people using similar arguments for Chat Control, weakening cryptography, mandatory age verification, etc. They are amplifying this "security is only for bad people"-narrative.

Murena is *not* a privacy company.

@danieldk @bohwaz @joe_vinegar @GrapheneOS e-x-a-c-t-e-m-e-n-t. Well said.

GrapheneOS Apr 6

@wa__em @danieldk @[email protected] @joe_vinegar Gael Duval didn't say this as a one-off statement in that interview on video. He has repeatedly specifically claimed GrapheneOS is only useful for pedophiles, criminals and spies in his posts across platforms. It's something he has said many times. Duval didn't specifically say he was talking about GrapheneOS in that video clip but he definitely has elsewhere. It's typical for people to lie about what we've said and pretend stuff which has happened hasn't.

GrapheneOS Apr 6

@wa__em @danieldk @joe_vinegar We can extend our thread with archive links to statements by Duval attacking GrapheneOS and dismissing the privacy and security protections it provides in the same way. The people committed to attacking and undermining GrapheneOS including attacks on our team members with personal insults and fabrications will continue doing so. There's no point in trying to satisfy people who will keep moving the goalposts and claim we haven't provided evidence when we have.

petitevieille Apr 6

Sure you can. Please do. Thanks.

@wa__em @danieldk @joe_vinegar

@GrapheneOS
Can you please provide links to sources which show what you are saying?
@wa__em @danieldk @joe_vinegar

@GrapheneOS
they dont like free competiting with their paid services/products?

@GrapheneOS same question, do you have a source about this funding? Genuinely curious.

GrapheneOS 5d ago

@fla Here's one of many cases you can hear it in his own words:

https://www.projets-libres.org/en/podcast/e-os-a-degoogled-android-gael-duval-e-foundation-murena/

> The European Union has subsidized us to the tune of several million for this project.

You can find the details of the millions of euros in funding being given to /e/ and how /e/ is heavily influencing where the money is going. They're steering government funding towards themselves and projects aligned with them. Many of these projects have a history of attacking the GrapheneOS project and our team.

/e/OS & Murena with Gaël Duval - Podcast Projets Libres

A free, free, privacy-friendly Android OS? This is the challenge launched by Gaël Duval with /e/OS! History, hardware, software support: we tell you everything!

Podcast Projets Libres

Ted's Tech Tips Apr 5

@GrapheneOS What's a more solid solution for blocking ads/trackers than DNS filtering?

Andrey [0xdc, 0x09];Apr 5

@tedstechtips @GrapheneOS
Probably a local MitM (e.g. AdGuard), but that increases attack surface a lot

@tedstechtips @GrapheneOS I think DNS or an adblock browser plugin is your best best. However, the point of the post is about tracking and privacy more broadly which includes not allowing apps to have certain information in the first place. That's why GOS put effort into sandboxing Google Play, file scope, contacts scope, etc.

@tedstechtips @GrapheneOS Allowlisting requests & assets by default (yes this also breaks everything by default until one allows strictly what they need).

Unfortunately umatrix died a while ago and I'm not aware of anyone else doing it to anywhere near the same degree as it did.

An additional problem is that if the "legitimate" destination is also malicious, umatrix cannot help.

@leX 🤘🏻Apr 6

@lispi314
Have a look at uBlockOrigin's "Hard mode":
https://github.com/gorhill/uBlock/wiki/Blocking-mode:-hard-mode
Here scripts, frames, CSS and images are blocked by default.
@GrapheneOS @tedstechtips

@schm43cky @GrapheneOS @tedstechtips That's somewhat similar, yes.

It doesn't quite reach the same granularity.

Both of course also lack per-script granularity, presumably under the assumption that at point the host could just make them all malicious at any given moment.

GrapheneOS Apr 6

@lispi314 @tedstechtips That doesn't do anything to address the privacy invasive behavior built into the app's own services providing functionality. That's how the most privacy invasive behavior happens in practice other than cases where a site is tricked into including malware or one of the client side services they use is compromised. Filtering in the browser does work dramatically better than DNS filtering but even with an allowlist approach it has the same inability to deal with root issues.

@GrapheneOS @tedstechtips > That doesn't do anything to address the privacy invasive behavior built into the app's own services providing functionality.

Indeed, that's what I refer to as the '"legitimate" destination' first party being malicious.

Some however are lazy and externalize the enactment of their malice. They can possibly be used with reduced harm (through allowlisting) for some amount of time before they correct & apply their malice everywhere.

GrapheneOS Apr 6

@lispi314 @tedstechtips Apps are increasingly doing it server side to avoid leaking API keys and having it filtered out by DNS filtering. Apps are also using the lazier approach of using client-side DNS resolution or fallbacks to IP addresses. Facebook has started using those approaches in their apps. Multiple Facebook apps including WhatsApp can still connect to some of their services without DNS working due to hard-wired IP fallbacks not depending on DNS resolution if it fails to connect.

Ted's Tech Tips Apr 5

"heard that you were popping /e/"
"stop resorting to the vowel"

-Logic

idk I'm bored

@GrapheneOS woo interesting I didn't know those declaration from Gael 😵‍💫 about you as project