Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove CalyxOS, move other items to comparison page #1378

Closed
wants to merge 1 commit into from

Conversation

dngray
Copy link
Member

@dngray dngray commented Jun 2, 2022

It seems to be that CalyxOS isn't able to keep up with security updates currently Chromium 100.0.4896.127 has 75 known security vulnerabilities. There doesn't seem to be any pending versions in review, which at the time of writing puts it behind LineageOS.

This is not the first time we've had security concerns about CalyxOS, especially when Android 12 was released and they were unable to provide security updates for 4 months, leaving users with vulnerable firmware.

Further I would expect a organization with that kind of turn over (2019, 2018, 2017, 2016), to be able to hire a few full time developers to keep on top of things.

@dngray dngray temporarily deployed to preview June 2, 2022 06:46 Inactive
@github-actions
Copy link

github-actions bot commented Jun 2, 2022

🎊 PR Preview 4ee2296 has been successfully built and deployed to https://privacyguides-privacyguides-org-preview-pr-1378.surge.sh

🕐 Build time: 110.153s

🤖 By surge-preview

@dngray dngray temporarily deployed to preview June 2, 2022 06:50 Inactive
@dngray dngray temporarily deployed to preview June 2, 2022 06:53 Inactive
@dngray dngray temporarily deployed to preview June 2, 2022 07:06 Inactive
@dngray dngray temporarily deployed to preview June 2, 2022 07:12 Inactive
@dngray dngray temporarily deployed to preview June 2, 2022 07:14 Inactive
@jonaharagon jonaharagon added c:os operating systems and related topics pr:missing discussion PRs which add recommendations which have not yet been discussed labels Jun 2, 2022
@jonaharagon
Copy link
Member

Has anyone asked Calyx about this? lol

Copy link
Member

@jonaharagon jonaharagon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Waiting for dev response

Edit: even besides the Calyx thing, splitting up the device notes doesn't seem like a good idea to me.

@jonaharagon
Copy link
Member

I don't see a need to make this change at this time. They are changing their development process going forward to release new versions on time, and the current Chromium version live in their repos is 102.0.5005.78.

I'm also told they plan to support third-party WebView implementations soon, at which point we can recommend Bromite (for example) if we wish.

Further I would expect a organization with that kind of turn over

They're spending 90+% of their yearly income in these reports already though?

@jonaharagon jonaharagon closed this Jun 3, 2022
@TommyTran732 TommyTran732 deleted the pr-delist_calyxos branch June 3, 2022 16:37
@TommyTran732
Copy link
Contributor

TommyTran732 commented Jun 3, 2022

@jonaharagon

I am skeptical. This is the third time this has happened.

First was during the Android 10->11 (admittedly awhile ago, 1 month behind)

The second time is from Android 11->12 (4 months behind on Chromium and the entire OS)

Now its this, 2 months behind.

This is particularly ridiculous because Divest barely got any donation money at all (he's actually losing money, yet he managed to keep Chromium them up to date).

Its not our job to remind them everytime their chromium or whatever goes outdated.

If we are not removing them now, I'd suggest that we remove them the next time it happens. Also, I am aware that Divest builds for the OP8T/9 are coming out soon and i am thinking of recommending Divest for those 2 instead.

@chirayudesai
Copy link

I do agree that being out of date is not good, and we're working on ensuring it doesn't happen again.

Its not our job to remind them everytime their chromium or whatever goes outdated.

This was merely a coincidence, I was already working on it before this issue was opened. See the timestamps on 10241: Initial import of args.gn | https://review.calyxos.org/c/CalyxOS/platform_external_calyx_chromium/+/10241 and following commits (and even some of the patches, they were WiP locally)

@dngray
Copy link
Member Author

dngray commented Jun 3, 2022

Well this is a relief, if it's not intentional, and is moving towards a better process in the future.

For now I agree with closing this. Looking forward to seeing what you do next with the project.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
c:os operating systems and related topics pr:missing discussion PRs which add recommendations which have not yet been discussed
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants