If I may make a suggestion: as GrapheneOS becomes more popular, perhaps it's time to better establish users' trust in the control over it.

When the project was primarily you, who was already known for technical prowess and a principled exit from a different project, that was enough for many enthusiasts.

But as both the team and the user base have grown (and, secondarily, the outside world has become less stable), a new infusion of confidence in trustworthiness would help.

I'm not sure how to do that, but it may include communicating who is involved (not just names, but why they should be trusted), and what safeguards there are against mistakes and compromised/rogue individuals.

I say this because GrapheneOS may be the best candidate for a trustworthy smartphone platform right now, and I hope for the best followthrough and success of that.

We're an entire industry of liars and poseurs.

It would be easy to make even a completely bad-actor company with years of stellar reputation.

Either as a sleeper for some future big attack, or one that only rarely and secretly takes action against very high value targets.

Two examples of people who have established some trust over the years: Linus Torvalds and RMS.

Joking scenario to illustrate...

Badguy: "This is it, Torvalds! Give us the Linux launch codes, or I shoot you!"

Torvalds: "Launch codes? I'm angry that you are wasting everyone's time, when clearly you don't know what you are doing, and are not bothering to get help to do it properly."

Badguy: "How about your friend! Give us the codes, or I shoot Stallman!"

Stallman: "Excuse me, but when you say Linux, I think you mean GNU/Linux, since Linux is a kernel, which is only one piece of the operating system, and used with--"

Badguy: "Argh! I can't take you nerds anymore!" shoots self in head

There was no principled exit from a project but rather from a company. GrapheneOS started in 2014 and was previously called CopperheadOS. We still use multiple of the 2015 era GitHub repositories.

A company which I co-founded in 2015 where I still own 50% of the voting shares was taken over and many illegal actions were taken in an attempt to take over my open source project and then spent years trying to destroy it when that failed. The company was then used as a weapon to wage a war against myself and GrapheneOS for years. A large of donations were stolen and repurposed for attacks on the project people made those donations to. Meanwhile, the company entirely depended on repeatedly forking GrapheneOS to sell it as a project. We stopped them from doing it through legal action and it's essentially over. It took a very long time to rebuild GrapheneOS and the attacks they started never stopped.

I continued working on the same project after the failed takeover attempt and it turned into a much bigger project where I'm no longer anywhere close to the most active developer. I mostly do organization tasks including giving developers tasks and system administration, not development. It's quite hard to do development when you're harassed throughout the day, every day, to an extreme level. It took away my ability to do the kind of creative work involved in development for the most part. I leave that up to others now. I don't even do much code review anymore but rather delegated that to others too. I don't know why people continue claiming otherwise when it's plainly not the case.

> I'm not sure how to do that, but it may include communicating who is involved (not just names, but why they should be trusted), and what safeguards there are against mistakes and compromised/rogue individuals.

We have to protect our team from relentless harassment including swatting attacks. Our moderators aren't allowed to use accounts tied to their real name since otherwise they'd be heavily targeted. The same applies to our community manager. We generally recommend developers avoid using their real name unless they're able to tolerate being tolerated. We avoid having people's names tied to things when we can. It was a mistake to do it in the beginning and can't be undone for myself but others can avoid being targeted. I don't think many people would be willing to work as a community manager or any other public-facing role in GrapheneOS if they had to use their real name. That's especially true if they're part of around half of the people who are women or many other groups who would be targeted specifically for their identity alone.

> I say this because GrapheneOS may be the best candidate for a trustworthy smartphone platform right now, and I hope for the best followthrough and success of that.

Continued success unfortunately enrages people who have been trying to harm us for years as can be seen throughout this thread. It's not getting better and I don't think many people want to be exposed to it.

Most people are cavalier about tech trust, because that's easy or they don't know any better, and often they really don't care.

But it seems the base for GrapheneOS is people who care, and a lot of them (not all) care about trustworthiness (not just annoyances).