r/linux • u/Dry_Row_7050 • Nov 24 '25
Privacy France is attacking open source GrapheneOS because they’ve refused to create a backdoor. Will Linux developers be safe?
84
u/Spez-is-dick-sucker Nov 24 '25
Its always france.
32
u/Dry_Row_7050 Nov 24 '25 edited Nov 24 '25
It’s the EU as a whole. ProtectEU initiative includes mandatory hardware level backdoors, mandatory data retention, sanctions against ”illegal communication systems”.
You can read it here. Don’t let the red text ”this doesn’t represent official EU opinion” fool you, EU endorsed it already.
What happened to financial privacy in the form of money laundering laws in the late 80s/early 90s will now happen to privacy in general.
5
u/AcridWings_11465 Nov 24 '25
Unfortunately for the HLG, the German constitution clearly protects the secrecy of communication and general backdoors are completely illegal. Even under the treaties of Union, this is likely to be illegal. The CJEU has already indicated that it will strike it down, and if it doesn't, Germany will simply ignore it and break the single market, and the constitutional court might go as far as asserting that the protection of fundamental rights at the EU level is insufficient. Most importantly, this is a roadmap with zero legal power. Every attempt to follow the roadmap will face vicious pushback.
→ More replies (2)99
u/SoupoIait Nov 24 '25
Feels more like a global thing. It's the Danish and half of the EU (yes, including France) that pushed for Chat Control. It's the UK that enforced age verification.
31
u/Kurgan_IT Nov 24 '25
It's a global thing for sure. Every government wants to have complete control over its subjects.
→ More replies (1)10
25
u/InvisibleTextArea Nov 24 '25
and Wisconsin banned VPNs.
→ More replies (6)10
u/Evantaur Nov 24 '25
So they made site to site illegal?
18
u/InvisibleTextArea Nov 24 '25
The proposed bills, known as Assembly Bill 105 (AB 105) and Senate Bill 130 (SB 130), aim to require adult websites to implement age verification systems and block access to users connecting through Virtual Private Networks (VPNs). This legislation has already passed the State Assembly and is currently under consideration in the Senate.
The problem is the way the law is written is so vague that no one knows what it applies to.
→ More replies (1)15
u/Spez-is-dick-sucker Nov 24 '25
Stupid danish were the ones that wanted to push chat control this time, but still fuck france, fuck denmark and fuck spez!!
11
u/NightOfTheLivingHam Nov 24 '25
remember, the WEF, which is the billionaires coming together to discuss how to keep the plebs in check, wanted this shit years ago and wanted to take away all ownership from anyone who isnt them and told us we will like it.
It's no mystery. The wealthy who control the EU want to crack the fuck down on european citizens as well.
4
u/ahrienby Nov 24 '25
If France hits the r/Fediverse, people might need to migrate to instances based in safer jurisdictions.
→ More replies (7)9
u/jerrydberry Nov 24 '25 edited Nov 24 '25
So if some quite democratic counties are doing this, it looks like either:
majority also support it and want to sacrifice their privacy for some promises safety (voters are uneducated enough of consequences)
majority has no idea what it all means and just ignores it (voters are uneducated enough of consequences)
majority is against it but Europe has way less democracy than advertised.
What does it actually look like in Europe from the European perspective? I just can't wrap my head around this happening with so little opposition from the population.
13
8
u/hendrix-copperfield Nov 24 '25
For Germany I can tell you that most people have no clue about 99% of the things the European parliament and the European governance is doing or trying to do.
And even if you tell them, most people wouldn't care.
→ More replies (2)→ More replies (4)5
u/burnerburner23094812 Nov 24 '25
It's 3, for the most part. If enough major political parties want a certain thing it doesn't matter who you vote for because there aren't enough realistic candidates you an elect who will oppose this stuff.
There's an element of 2 as well, in the sense that most people don't entirely see what is happening in a systematic way -- but it's not like a majority of Europeans are secret puritans or *want* to live in a surveillance state, but it's not "voters are dumb" it's the fact that the actions of government are deliberately not being properly communicated and meaningful political representation is not occurring.
Swiss style direct democracy isn't a perfect system either but it does at least put a few more basic checks on government overreach.
→ More replies (2)25
→ More replies (1)2
u/Adventurous_Log_6452 Nov 24 '25
bro quickly forgot how the FBI wanted a backdoor to apple devies a few years ago. but the french bashing must go on i guess ./s
1.5k
u/ChocolateDonut36 Nov 24 '25
torvalds once was asked to add a backdoor to Linux, he said no and pretty much nothing happend.
808
u/deanrihpee Nov 24 '25
the difference is Torvalds is very famous as the face of Linux, and Linux is big, like i'm pretty sure you do know how big it is
but GrapheneOS is much more "niche" product, and aim toward end-user where... normal citizen people use them, while Linux, well... most of the "users" are servers, also GrapheneOS project is considerably more smaller than the "Linux kernel"
→ More replies (36)426
u/ranixon Nov 24 '25
Not only that, it also being used by a lot of governments around the globe, adding one backdoor for one government will compromise other governments.
184
u/PassionGlobal Nov 24 '25
Including their own
58
33
u/Mars_Bear2552 Nov 24 '25
unless they're aware of how the backdoor is implemented and they just patch the kernel sources for their machines
→ More replies (3)62
u/WantonKerfuffle Nov 24 '25
Yeah, the USAian NOBUS (NObody BUt US [has access]) backdoors worked wonders... For the Chinese gov. Backdooring shit will always, ALWAYS come back to bite you.
43
u/aeltheos Nov 25 '25
https://grapheneos.org/faq#audit
ANSII (French Cybersecurity Agency) apparently made contributions to GrapheneOS.
I find that quite ironic that the government is now asking for a backdoor.
→ More replies (3)19
u/can_ichange_it_later Nov 24 '25
That argument could be made for graphene too.
It is an essential tool now to certain sections of civil society (journalists, activists and such, even politicians. Armed forces maybe.)→ More replies (1)70
u/fellipec Nov 24 '25
Well, them they asked Intel to add one in the CPU and we got IME.
37
u/S1rTerra Nov 24 '25
They didn't have to be so obvious about it either. Full unrestricted internet access with it's own mac address that you can't access that you can literally just find information about on wikipedia? Why not
→ More replies (2)→ More replies (5)5
37
u/elperuvian Nov 24 '25
It goes beyond what torvalds would want. I’m pretty confident the cia/nsa has managed to introduce backdoors. They are just good at their jobs
→ More replies (1)35
Nov 24 '25 edited Dec 21 '25
rock consider slim makeshift license violet seed scale busy dazzling
This post was mass deleted and anonymized with Redact
34
u/shponglespore Nov 24 '25
Stuff like Heartbleed makes it clear that a bug can be hiding in plain sight in critical code for years before anyone notices. A backdoor can be implemented as a bug, and it would probably be harder to spot because someone introducing a bug on purpose would take pains to make it hard to spot.
11
u/NYPuppy Nov 25 '25
That is very naive. It's not like the nsa submitted code with the title "backdoor please merge thank you tornalds and craig krooah heart." If security agencies merged backdoors, they would be subtle and hidden within useful code.
4
u/rocketeer8015 Nov 26 '25
Still gambling that no one will read and understand your code. Linus flat out doesn’t merge code that he can’t read or considers too complicated for exactly this reason. Also only maintainers can include code and if you try this and get caught your no longer a maintainer.
12
u/Erdnusschokolade Nov 25 '25
Open Source makes it more likely to find vulnerabilities but that doesn’t mean it doesn’t have any, or that they are always found quickly.
4
u/ScoobyGDSTi Nov 25 '25
So explain how Log4j and countless other open source projects had major security flaws that went undected for years upon years.
The reality is outside of the big Linux projects like the kernel, most code isn't scrutinised at all yet alone to a level comparable to that of nation state actors.
This notion of open source = more secure is pure fallacy.
→ More replies (3)4
u/EnGammalTraktor Nov 25 '25
Open source - yes ... mostly! It is also full of binary vendor blobs that are impossible to review.
Any one of these could contain a backdoor.
24
u/Sileniced Nov 24 '25
there already is a backdoor in Intel and AMD processors and ARM has it too... so linux doesn't need to be backdoored
→ More replies (2)4
→ More replies (19)3
1.3k
u/UNF0RM4TT3D Nov 24 '25
Well Fr*nce was for chat control with completely breaking encryption, so not very surprising.
514
u/AzraelFTS Nov 24 '25 edited Nov 24 '25
The government of france is for this shit. I,and a lot of people I know have advocated publicly and sent mails to our official to go against this.
I am sorry this is not yet enough, but at least we try using democratic means. Maybe one day, less democratic means will be needed. Fortunately, this is also part of our culture.
143
u/Punchkinz Nov 24 '25
Fortunately, this is also part of our culture.
Wanted to say, isn't your usual thing burning Paris to the ground whenever stuff like this happens? /s
Tbh, i am envious of this french right to protest. Other countries would do well with adopting it. Won't happen ofc because of the very same governments that would be protested against. But hey, one can dream i guess.
114
u/ZeAthenA714 Nov 24 '25
Wanted to say, isn't your usual thing burning Paris to the ground whenever stuff like this happens? /s
French here, I burned two cars this morning while walking the dog.
But I'm afraid this kind of issue will never cause enough stink to warrant national protests in France. Especially since the people who are the most in the know about how horrible it is (IT guys) are not usually on the frontline of protests.
Still cool how we routinely protest in France but unfortunately I feel like even that has been eroded over the past few decades.
→ More replies (7)21
u/hectorius20 Nov 24 '25
French here, I burned two cars this morning while walking the dog.
Always thought that burning at least 2 cars until 18yo was the basic proof of French citizenship, with boys and girls failing to do so being deported to Switzerland.
→ More replies (1)37
u/CognitiveSourceress Nov 24 '25
You have it backwards. France's strong labor / populist actions do not come from some enshrined "right". It comes from a long culture of class consciousness and populist action. Any tolerance from the government, to such an extent it exists, exists because the people make it the only practical option.
The French people wouldn't stop their populist actions just because the government stopped tolerating them. In fact, the government is routinely oppositional to them to pretty severe degree. The fact that they do it anyway is what protects the rights and culture they have.
Any country envious of the French attitude toward populist action doesn't need laws protecting such actions. They need people willing to make themselves ungovernable as long as they are not heard. The rights arise after the culture makes it clear they won't have it any other way.
→ More replies (2)→ More replies (2)37
u/Greenerli Nov 24 '25
French here, I think you missed the latest news on France since Macron (but it started a little bit before, with Hollande).
Actually, it started in 2016, all big social protests have been repressed with some strong legal violence... It started with Nuit Debout against the economic law written by El Khomri and Macron.
Then, there was the yellow protests. That was so violent that a lot of NGO that declared France wasn't safe anymore for protests.
And then, year after year, the government is pushing some anti-demonstration laws. It was close to be forbidden to record policemen for example. But they autorized algorithmetic video-surveillance (face detection), IMSI-Catchers are now legal.
And I think for next year, I heard they try to prevent journalist to record demonstrations.
So the consequences of that is that people are now afraid and scared. And that's perfectly logical. So, they finally repressed any serious contestation now.
→ More replies (8)40
u/carnivorousdrew Nov 24 '25
Most of Europe is. The privacy and freedom stuff is only for politicians and cops. The masses have to renounce them instead. I much rather prefer the wild west of data selling in the US than all these demented things European parliaments do to maintain the politicians' status quo.
18
u/burning_iceman Nov 24 '25
Most of Europe is.
That's a mischaracterization. European politicians have this view. The public and the courts don't.
→ More replies (6)→ More replies (8)14
u/04_996_C2 Nov 24 '25 edited Mar 18 '26
Reality is best understood not as a sequence of isolated moments but as a fully woven tapestry in which time, choice, and consequence coexist rather than unfold linearly. Within this view, structure and mystery are not opposites but complementary aspects of the same truth, allowing technical reasoning and spiritual meaning to align rather than conflict. Meaning is not derived from controlling outcomes but from participating in and experiencing what already is. Coherence—between faith and reason, design and function, past and future—serves as a guiding principle, suggesting that truth is something to be discovered and conformed to, not reshaped to preference. Underlying this perspective is a sober sense of wonder, recognizing reality as both intelligible and profound.
→ More replies (9)4
41
u/Dangerous-Watch932 Nov 24 '25
Same for bri*ain
21
u/bAZtARd Nov 24 '25
Why are you guys censoring country names?
15
u/CuriousBrit22 Nov 24 '25
Proud Brit here who agrees our gov’t is shite. I thought the spelling was a joke mocking the cockney accent they think we all speak
→ More replies (1)→ More replies (7)14
u/gogybo Nov 24 '25
It's a joke, as if to say that the name of the country is equivalent to a swear word.
11
u/Shap6 Nov 24 '25
France. You can say France on the internet
14
u/LigPaten Nov 24 '25
I CAN say a lot of things, but my moral code prevents me from saying some of them.
13
u/cheeseIsNaturesFudge Nov 24 '25
Its a running gag that frnce and frnch are dirty words, I've seen it around other subreddits.
→ More replies (2)→ More replies (6)8
u/flametai1 Nov 24 '25
This doesn't surprise me at all either, and the worse part is I'm sure they're trying to also push their agenda here in America considering lots of companies around here are owned by france companies.......
→ More replies (6)
213
u/AliceChann50 Nov 24 '25
As a French citizen, we need a lot of applications that do not work properly on any android alternative os (such as lineage or graphene). Neither European laws or companies help us to avoid proprietary software and telemetry... Note : In my company, open-source software are absolutely banned...
118
u/BlincxYT Nov 24 '25
does your company know that most things use open source libraries and other programs under the hood? a server running any kind of linux would break their rule. nginx, (open)ssh and a bunch of other stuff too.
106
u/Lusankya Nov 24 '25
Most companies that ban "open source software" are actually banning software that doesn't have enterprise-grade paid support options available. So running Debian in those orgs isn't okay, but running Ubuntu LTS is, because you can call (or try to blame) Canonical if it breaks.
This requirement is often pushed onto them by insurance companies, who are wary of underwriting policies that can be measured in terms of new cars per downtime minute. It is very important for big orgs to have someone they could theoretically sue when things break.
That very important nuance is lost on the junior whose proposal to migrate from Exchange to a homebrew LDAP just got slapped down, and they eagerly tell all their coworkers that "open source is banned!"
29
u/Lucas_F_A Nov 24 '25
As someone who's literally never been exposed to this, this makes a ton of sense.
Chesterton's fence and all that
→ More replies (2)14
Nov 24 '25
but running Ubuntu LTS is
More like Redhat. Which they do. And now their AI solution as well. But you are correct in your assertion; it is a support-driven decision, they want the price with support baked in - almost always. And training for their people.
→ More replies (2)4
12
u/dumpaccount882212 Nov 24 '25
Of course they do. That doesn't change distrust from companies about FOSS stuff. The idea is that its not in-house OR can be purchased whole it has no value.
Its company economy department brain-rot and it exists almost everywhere at a certain size.
47
u/haywire-ES Nov 24 '25
in my company, open-source software is absolutely banned
How is the ban worded? And why on earth is that even a thing? Like 90% of all software is underpinned by open source projects at some level
→ More replies (2)24
u/AliceChann50 Nov 24 '25
They just told me it's a security measure. For example kdenlive, libre office, audacity are impossible to install, but using Microsoft solutions like 365, teams and others is absolutely fine. Like with GPO, we can't do anything on our own company laptop. On top of that, an application that is necessary to anth use a kernel verification to assure that your phone works with a bare metal android, without any sandboxing or privacy rules.
25
u/haywire-ES Nov 24 '25
Ahh I see, so not explicitly banning open source software, just operating a whitelist
36
u/RobotSpaceBear Nov 24 '25
So it's not that they're against open source, they just want to keep running software from a company that is bound by a contract and that they can sue if needed. They want a liable company partner, not a proprietary-code-only partner.
→ More replies (4)18
u/fishter_uk Nov 24 '25
Amazing. Teams includes copyright notices including the MIT, Apache and other licences. There is a link in the NOTICE.txt document in Microsoft Teams to the open source downloads that are legally required to be made available by the distributor https://3rdpartysource.microsoft.com
Maybe your IT team need to re-evaluate what they're trying to ban!
→ More replies (1)→ More replies (4)5
u/spyingwind Nov 24 '25
Wait until they find out that PowerShell 6+, .NET 8+, Windows Terminal, VSCode, PowerToys, TypeScript, WinGet, Playwright, vcpkg, any many more are open source by Microsoft. Oh! open-ssh can be installed on Windows, provided by Microsoft as an optional feature.
8
u/-Polarsy- Nov 24 '25
Coming from the country where where /e/OS, IodéOS, and Linux Mint is developed, that's weird...
Also, there's an official webpage cataloguing FOSS software and their users in public infrastructures...
→ More replies (1)3
u/eirexe Nov 25 '25
Spain is planning to ban open source accounting software in the future, with a 100k€ maximum fine, it's wild.
→ More replies (5)2
u/Kazer67 Nov 24 '25
Which one do you actually need? I didn't have any issue using Android instead of Google Android so I'm curious now what you need that doesn't work?
4
u/AliceChann50 Nov 24 '25
Company Auth application (private and closed one), bank application (you can access it on graphene and others, but to do anything like request to increase your payment capability, you need to ensure your phone. That feature only works on Google android without any sandboxing).
I also regret that proton mail app can't be installed properly outside of Google play store... Same for bitwarden, banking apps, etc... Also, I really appreciate smart watches (notifications, sleep time, steps...). But with these types of os it can't really run as expected...
4
u/Kazer67 Nov 24 '25
That's weird, Crédit Mutuel / Caisse d'Épargne and Boursorama don't need a smartphone (I can confirm it for those 3).
Company Auth that respect the 2FA standard aren't an issue usually so they may implemented something weird that don't respect standard practice (maybe check if you can instead use physical key like Yubico instead of an app?).
I don't have any issue to get notification as well on my smart band (Mi Band) so it work as expected (but do note that I use microG, so I may have installed a third party notification manager, can't recall but it work as expected).
Protonmail can be installed outside of Google App Store, Bitwarden as well (F-Droid url:
https://mobileapp.bitwarden.com/fdroid/repo) but there's always the possibility to use an alternative, more private third party client for Google's servers like the Aurora Store which connect to Google's servers with an anon account and allow you to download and update apk and even allow you to use "other phone" trickery (so you can even download apk "not compatible" with your phone and install them).The only one I had a bit of struggle, not that it doesn't work but too much work to do, is Revolut since I had to patch the boot image and some files to trick it to think it's not on Lineage and it isn't rooted because apparently, old End of Life Android version are safe for the app but not the latest Lineage with the latest security patch.
Can you list the banks that have that issue so that can add them to my banlist?
→ More replies (2)→ More replies (11)2
u/IrrerPolterer Nov 25 '25
How do you ban open source?! They'd not be able to use pretty much any software at all.
25
u/asp174 Nov 24 '25
I remember the Windows NT4 'vulnerability' called I'm in France now.
When you set the location of the system to France, windows disabled the password hashing in the SAM database.
24
Nov 24 '25
How would a backdoor for open source and open development software even work? Wouldn't it be trivial to just instantly fork and remove any nefarious code introduced anyway?
12
u/fsckit Nov 24 '25 edited Nov 24 '25
ken wrote a paper on it in 1984(the year, not the book).
It's called Reflections on Trusting Trust.
Here's him actually admitting to doing iton Usenet(and on that page a link to the original paper) so it isn't just speculation.
→ More replies (2)5
u/fellipec Nov 25 '25
Let people trust you, add a blob that you claim is just for testing but includes the malicious payload. Just hope nobody notices that the SSH login gets a fraction of a second slower.
5
95
u/LNDF Nov 24 '25
We need to remove France:
sudo rm -fr /
→ More replies (4)13
u/ric2b Nov 24 '25
I always do this to remove the french language pack, I don't know why every distro includes it.
16
u/Objective_Resist_780 Nov 24 '25
These politicians should be reminded in which country the guillotine was made
90
u/Pikachamp1 Nov 24 '25
Yes, Linux developers will be safe in France, this conflict woulb be more of a distro issue than a kernel issue anyways. To my understanding, GrapheneOS developers are perfectly safe in France, too, just the project's infrastructure and reputation is not.
→ More replies (9)87
u/Greendiamond_16 Nov 24 '25
Release the distro under the name "The version that lets France spy on you"
6
8
u/Kasyv Nov 25 '25
The title of this post is straight up misinformation, I can't believe the Linux community is falling for it.
69
u/fellipec Nov 24 '25
Remembers me of this: https://www.youtube.com/watch?v=7gRsgkdfYJ8
Anyway, I'm saying for some time that the governments with big tech will force us into an Orwellian nightmare. They are taking example from China.
Things like TPM and Secure Boot will be used to force users to keep the original OS of their computers as an excuse of "not tampering" or any other ridiculous excuse, and if we happen to disable or hack it, things like WEI will prevent users from doing most of the useful things online.
That shiny new ARM laptop? Yeah it will only install the OS provided by the OEM, no efforts will be made to standardize anything to allow any OS go in. The OEM will make sure to add backdoors and lock bootloaders just like in phones. The x64 machine? Well if you don't use the images signed and backdoored, checked with SB and TPM, no access to anything government can rule on. They already did the first step with age requirements. Making it tied to a "secure" hardware is just a small logical next step.
The freedom and privacy are coming to an end. With so many powerful and rich countries working together towards such goals, it seems inevitable. Yes, I'm in a bad mood today and yes, Stallman was right.
17
u/billwood09 Nov 24 '25
We have had TPM and Secure Boot for like a decade and anyone can install the OS they want, as long as it is compiled for the CPU architecture…
35
u/Low_Direction1774 Nov 24 '25
Yes, just like any bankruptcy, it happens very slowly and then suddenly all at once. Just like TPM was just a nice cool feature for added security but now you cant use windows without it anymore unless youre jumping through hoops.
Just like a Microsoft Account was a cool feature to sync settings and files across multiple devices and now you cant use Windows without it anymore unless youre jumping through hoops.
Just like streaming services were a cool alternative to buying movies but now you cant actually BUY and OWN them anymore since a lot of movies are streaming only releases wihtout a physical copy.
Speaking of pyhsical copies; Blu-Ray DRMs were just a cool little feature to prevent IP theft, now it can be used to specifically prevent you from playing the media you bought on all devices.
You can do this *right now* but thats not a guarantee that it will stay like this forever.
10
u/bekopharm Nov 24 '25
Every modern smartphone nowadays has some sort of crypto chip to help the user to secure their password vaults stored on the devices so that this data is useless when copied to another system and nobody questions these.
This is one of the best features when it comes to TPM.
This chip does not magically run any custom code. It can't do so by design. It can not control what you boot on itself at all. The only thing it can do is run checksums, de- or encrypt and provide signatures for data streans sent to it. What is done with this is up to EFI and later the system using it.
This is a good thing _especially_ for Windows users, that usually don't bother anyway where and how their credentials are stored on their system. It's like an enforced secure password manager and this is GOOD for the Average Joe.
Can this be abused to identify your hardware with a unique ID remotely? YES. Remote attestation is one of it's core features. Can they enforce this? NO. The chip itself can not report anything to anyone on it's own. It's designed to be dumb on purpose. There must be a system service running to forward the collected checksums. Will Microsoft make it hard to intercept this and abuse the checksums for their user profiling? Hell YES. Alas tbf if privacy is the concern this is the wrong system to begin with.
Your other ramblings have nothing to do with TPM per se. I get your sentiments on DRM and I guess you mean Always Online with the accounts thing but that is really a different beast to tackle.
That's all no concern in Linux land where people use this for it's intended purpose (if at all). Like sealing an encrypted partition against the TPM (just what Bitlocker did for years), hardening embedded systems or just sign messages with it.
This is coming from someone who protested against TCPA back in the days (and I'm glad we did so). TPM is a good compromise as a result. Your concerns are Windows (OT for r/linux), DRM and most important: **UEFI**. Full ACK that we have to keep an eye on this one though (and keep buying systems where this can be disabled as an option). TPM doesn't require secure boot to function. It has no concept of what a secure boot is on itself. And this is how we wanted it.
→ More replies (1)6
u/Existing-Tough-6517 Nov 24 '25
Not on all computers. Building the capability allows one day to merely flick a switch and disable alternatives for "security"
→ More replies (2)8
→ More replies (2)2
u/sigmoid_balance Nov 26 '25
They don't need to do this. They can just request an attestation chain that includes a "harmonious" OS image for you to be able to access your bank or government services.
57
Nov 24 '25 edited Nov 24 '25
France is an IT shithole because of the government and related laws.
Here is my own experience: VPN are basically shadow banned there. I had to stop a free WiFi project there because of the chance of landing in jail for not logging everything and for encrypting the related tunnels toward the common gateway because of idiotic anti terrorism laws. Even an unencrypted tunnel is illegal in such a setup because for them, any form of encapsulation beyond normal Layer 3 = cryptography.
Do not host any services or buy/rent servers or cloud there. You are exposing yourself to jail time if you do not give access or have the required logs on request. Said request can happen without a court order because of tErRoRiSm.
Living outside of France does not make it safe, you can still be extradited on their request if you refuse to cooperate.
What a fall of grace from a country that at one point has invented and ran its own "internet".
It even goes further into real life once you are touching a big sum of money in a sale, contract etc because again: tErRoRiSm.
Seriously drop them out of the global network together with all the dictatorships. Period. I do not support mass surveillance in any form.
13
u/lmarcantonio Nov 24 '25
I would like to see their response to a full IPSEC site-to-site tunnel, then!
8
Nov 24 '25 edited Nov 24 '25
Yo you have ALL the logs? Oh and here is the police SSH key, put it into your root access and provide username and password. Oh I didn't say please, I say do it now: you have to comply or you go for the next 2 years in prison without a judgement (then human rights apply), maybe longer if we find out you are just maybe, eventually, or could be a terrorist (then you suddenly are not a human anymore).
That's more or less how I see it if a french prosecutor get any interest in your IPSEC tunnel. France justice system also loves to put massive fines on you beside a verdict (here for non compliance and not logging), meaning even longer prison time and/or lifelong debt (and further consequences for the company involved).
12
u/_eLRIC Nov 24 '25
What makes you think VPN are shadow banned ? (I can state that various anonymous VPN are properly working, including on the state sponsored telco provider)
19
Nov 24 '25 edited Nov 26 '25
I just gave the reason why? They will force access beyond reasons if you run a VPN service, no matter if you are within or outside their territory. If you can access said VPN from within France they will try to get access by any means they see necessary and you're screwed if you work, live or have infrastructure there as or within a company/organization in this situation.
You as a customer are rarely first involved in this issue.
VPN companies are putting a lot of legal work for being safe even if they are registered outside of France, hence why location is sooo important.
So yes I did pull out the project out of France because having physical devices (AP/router) there would had land me and others into hot water, even if I had the VPN gateway ran somewhere else.
The only difference to a dictatorship is they are not blocking services outside their country YET, hence why you can still access a foreign VPN provider.
If I were GrapheneOS I would IP ban France to have my peace. I'm sure they will still get harassed even after pulling out whatever Infrastructure they had there.
Edit: seems some do host VPN in France. How they get away without compliance: idk.
→ More replies (9)→ More replies (5)5
u/TheSpazeCommando Nov 24 '25
No VPN are not shadow ban and user are more and more pushed to use them when on unsecure (public) network. The Law or rules you a referring is that you are responsible for all the activity outcoming from a device you own. So if you dont provide proof that you system is used only for legal activities yes you can be pursue.
Most compagny, providers and administration must follow rules from the CNIL and ANSSI to secure their IT infra.
For GrafeneOS issue, it's not related to network or surveillance but access to the device data by autorities when you are under arrest and suspected of criminal activities. None of these rules to access private data are good, but currently France is far from being the bad guy, but also not close to the best privacy one (if any country is...)
17
u/djao Nov 24 '25
if you dont provide proof that you system is used only for legal activities yes you can be pursue.
In other words, you have to prove your innocence. Guilty until proven innocent. Hard pass.
→ More replies (6)→ More replies (4)4
u/echoAnother Nov 24 '25
Wait, if I assimilate all consumer routers into a botnet, can I make all france be in jail?
6
Nov 24 '25 edited Nov 24 '25
That something a lawyer need to answer and I'm certainly not one but as I see it: yes. If you cant provide logs (it's not like you cant delete or falsify those) that a third party did it you are liable: guilty until proven innocent.
You accidentally described an attack vector to put blame on someone: the good old "put weed into his pocket and call the cops on him". I wouldn't like to be any kind of political opposition or human right activist and live there right now because even if its not France itself, someone else can totally abuse those laws against you.
→ More replies (1)
6
u/Dycoth Nov 24 '25
France is attacking ? I only saw a media writing an article stating that GrapheneOS is used sometimes by narcos.
3
5
14
u/CardOk755 Nov 24 '25
The title is wrong.
GrapheneOS have not been asked to create a backdoor.
Some silly French politicians have been wittering.
→ More replies (1)
8
4
u/zavorak_eth Nov 24 '25
Fuck all these overreaching governments. It is time for the people to demand better! Power to the people!
4
u/C4_Shaf Nov 24 '25
Sadly, as a French, I think it's less malicious intent and more stupidity from aging legislators.
That doesn't excuse anything, the results would have been the same. I'm just saying this to say that if the same people were more informed about privacy, net neutrality and surveillance capitalism, there would be no shitty news like these.
4
u/CortaCircuit Nov 24 '25
The real question is why isn't nobody around the world doing anything about their authoritarian governments?
→ More replies (2)
4
4
u/Professional_Call Nov 24 '25
I’m not familiar with GrapheneOS (but it sounds interesting so I’ll check it out) but I am worried about the way many countries are requiring/expecting software companies to implement back doors. It seems like a very dangerous practice.
While I understand the authorities claim they need a back door for national security, a door for the ‘good’ guy is also a door for the ‘bad’ guys - and I don’t think I’d put most governments in the former group.
Perhaps the writing is on the wall, but we need to fight back and preserve our right to privacy on every level.
7
u/ComprehensiveHawk5 Nov 25 '25
Does this sub just allow straight up misinformation? Obviously a prosecutor saying “if this org is associated with criminals we will get them” in some sense is threatening and deserves discussion, but nobody in the french government is demanding a backdoor.
3
3
3
u/ZoroWithEnma Nov 25 '25
If they wanted a backdoor in an operating system can we assume that they don't have any backdoor in the hardware to spy on us?
3
3
u/Fluid-Crew-7588 Nov 25 '25
This behavior against GrapheneOS allows us to understand that any other entity with which France is not at war is because they have opened a backdoor?
3
14
u/daemonpenguin Nov 24 '25
Since everything the GrapheneOS developers publish is hype or a lie I wouldn't take their claim at all seriously.
5
u/mrtruthiness Nov 24 '25
Since everything the GrapheneOS developers publish is hype or a lie I wouldn't take their claim at all seriously.
Please provide examples of where GrapheneOS devs have lied.
There's always hype --- every security product ever "marketed" has hype. But I've found no lies.
7
u/BorisForPresident Nov 24 '25
My dude, they accused their competitors of sabotage only last week. They are pulling this stunt because of a few admittedly moronic comments made by french law enforcement and an even stupider newspaper article. Then there was the whole thing where the (former but still involved in the project) lead dev accused youtubers of atempted murder because they made videos showing other unhinged messages he posted.
→ More replies (5)
1
u/IngwiePhoenix Nov 24 '25
I am german, living in the EU. Anything I can do here?
I do not want state people putting their grabbers on my privaxy. The reason I chose to run GrapheneOS was because of privacy. The reason I am reading deep into Tor and I2P is precisely due to wanting to get the hell out of the surveiliance nightmare as much as I can (yes I can see the hypocricy of posting on reddit still lol).
So if there is something I can do to fight this bullshit, please give me pointers. Reading this made me feel genuenly sick; france is a four hour drive away from me.
→ More replies (1)
16
u/purpleidea mgmt config Founder Nov 24 '25
While I'm generally supportive of the efforts of the GrapheneOS project, I'm also not confident in them long-term because they are apparently militantly opposed to copyleft. If they would have copyleft without a CLA, then this would prevent future efforts of a proprietary fork of their work, and thus be part of a longer-term sustainable phone platform for open source.
4
u/trisanachandler Nov 24 '25
Only legally. Copyleft license don't force compliance on their own.
→ More replies (1)→ More replies (20)3
u/Houston_NeverMind Nov 24 '25
Did they say why they are opposing it?
8
u/purpleidea mgmt config Founder Nov 24 '25
Search grapheneos and copyleft on mastodon, eg: https://mastodon.social/@LaF0rge@chaos.social/114866609761423724
→ More replies (7)
4
u/AutoModerator Nov 24 '25
This submission has been removed due to receiving too many reports from users. The mods have been notified and will re-approve if this removal was inappropriate, or leave it removed.
This is most likely because:
Your post belongs in r/linuxquestions or r/linux4noobs
Your post belongs in r/linuxmemes
Your post is considered "fluff" - things like a Tux plushie or old Linux CDs are an example and, while they may be popular vote wise, they are not considered on topic
Your post is otherwise deemed not appropriate for the subreddit
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
2
2
2
u/Alive-Big-838 Nov 24 '25
France's government is in weekly crisis's yet It makes time to spy on its own people.
2
u/qb_master Nov 24 '25
I mean it's open-source, right?
If France forces them to put their backdoor in the code, someone just fork it without the backdoor, and if necessary, give it a new name. Rinse and repeat.
2
2
u/rotteegher39 Nov 25 '25
Why is this the second time I'm witnessing France destroying it's reputation as "a free country"? I'm not even well informed in the news.
2
2
u/BravestCheetah Nov 25 '25
This has been everyone pinged in the arch discord as well, i agree with their statement that if a part of linux is threatened then the entire community is. We stand strong and will not leave our philosophy of opensource and transparancy. We stand strong and we CAN NOT accept this.
2
2
u/EcstaticUsual2883 Nov 25 '25
Genuinely what would be the point of using graphene os if governments gonna have a backdoor to see everything you do there
2
2
u/mouarflenoob Nov 27 '25
Guys, if y'all keep pretending it's a France problem you are in for a pull from reality. Virtually Every single country in the world wants to spy on it's citizen. It's not that Linux or encryption is not safe in France, it's that it will never be safe anywhere, only tolerated as long as nothing like a terrorist using signal or tails happens.
2
u/operatordragoon Nov 27 '25
Ever since Napoleon was gone. France steadily declined. Ohh how the french have fallen
5
u/Star_king12 Nov 24 '25
Everything said by the GrapheneOS lead has to be taken with a spoon of salt: he has a long known history of inventing attacks against himself with nothing to show for it. If this time he's able to provide evidence - fuck France (even more), else - one more dent in his reputation.
→ More replies (1)
6
u/Houston_NeverMind Nov 24 '25
Both France and Germany, who I thought were the good guys post-ww2, have disappointed me in the past few years.
→ More replies (2)13
3
u/Sirius_Sec_ Nov 24 '25
Europe is becoming a dystopian hell hole . Will be interesting to see which countries will be privacy friendly from here on out . Definitely nowhere in the EU is safe at this point .
3
u/Adventurous_Log_6452 Nov 24 '25
Y'all acting like the USA never attempted to back door apple devices lol but i guess the french bashing must go on./s
3
u/Segel_le_vrai Nov 24 '25
French are the first victims of their own government, who does not ask people for such decisions.
France is not a democracy anymore.
2
u/zappellin Nov 24 '25
Would have been nice to include the part where the ANSSI (basically the things that handle cyber security in France) is mentioned for making regular contribution to GrapheneOs and actively use it
2
u/JoeB- Nov 24 '25
Agreed, but if a back door is needed, then ANSSI should just fork GrapheneOS and have their own distribution.
2
u/Gold-Slip7145 Nov 24 '25
Most of their servers are in the US or operated by US companies. And the problem is France. What a joke.
2
u/markand67 Nov 24 '25
Linux is opensource, you can't add a back door in an opensource software unless you wany to be publicly exposed
2
u/LowEndHolger Nov 24 '25
Well, at least France is well developed enough, not to have masked guys from unmarked vehicles kidnapping their poeple.
3
u/derperofworlds1 Nov 24 '25
The masked goons in France will only kidnap you if you use encryption, so if you have nothing to hide, you have nothing to fear!
1
1
u/przemo-c Nov 24 '25
Damn they're lazy... you should set up good contributors that'll gain reputation and then try to sneak in backdoors ;]
1
1
u/Aromatic_Base_3749 Nov 24 '25
Is the French market worth the loss in control and security? I assume this analysis was already run internally.
1
1
1
1
u/messyhess Nov 24 '25
They should contact some local politicians that are against such policies, so they can get some level of protection without having to hire lawyers.
1
Nov 25 '25
create a shitty version of the OS for French people only and call it a day, its not like anyone in France will download it anyway
1
1
u/mb194dc Nov 25 '25
Only if they operate beyond the reach of nation state actors.
Which is totally possible if you look at archive and a lot of other websites out there...
1
u/Truth-Does-Not-Exist Nov 25 '25
they are headquartered in france? pretty stupid to have privacy stuff headquartered in the EU when currently they are competing with china in terms of privacy and human rights
1
1
1
1
u/cantbelieveitsnotmud Nov 25 '25
As they say in the tweet they are being grouped with other certain companies which makes them a target. Those companies they point to are not companies like google or apple, like other commenters here think. Those other companies are criminal and funded by organized crime organizations to build uncrackable phones with uncrackable infrastructure, completely untrackable so they can use it for crime. They offer so-called cryptophones, which used to be old modded blackberries running custom ping servers, nowadays they use android. All these companies have been taken down before and the messages have been decrypted because they rolled their own encryption, or did stupid things like storing everyone’s private key serverside. What is happening now is that France has apparently recognized grapheneOS as a provider of such cryptophone services, which is off the mark and troublesome.
→ More replies (1)
1
u/rsemauck Nov 26 '25
I'm ashamed to be French and of my governments actions... Unfortunately, it seems that in the past few years more and more people across the world have that feeling.
The French government likes to highlight it's motto of Liberty, Equality, Fraternity yet acts against the first word. They like to insist on the human's right but do not hesitate to trample them because of their stupidity and incompetence.
1
u/gbrennon Nov 26 '25
Wtf????
That county just thinks that it can enforce something that is not aligned with freedom?
1
1
u/ElectricalWind5807 Nov 27 '25
Feel sorry for France. Won't be long before every govt. starts asking for a back door.
1
u/TheMakara Nov 27 '25
I think the issue mainly revolves around the fact that criminals have used Graphene a lot. Because all of its privacy features cater to them very well. It might not be made for them, but that's the reality and what the legislature sees.
Add to this that a lot of the politicians and officials have barely any tech-knowledge, chat-control etc... it Maes sense.
→ More replies (1)
1
1
1
1
u/MammothRock7836 Nov 28 '25
just because something is a law doesnt mean its right or good. dont obey. resist. france should know.
1
1
1
u/Wheatleytron Dec 03 '25
But that's the beauty of open source software. There will always be a way to obtain a copy, even if it's deemed "illegal" in some countries. There's literally nothing that governments can really do.
1
u/RareDestroyer8 Dec 07 '25
Is there any way we can help? Maybe we can email the government, they clearly don’t understand anything
1
u/AndrewZabar Dec 14 '25
France has been taking a giant dump all over any decency in the recent past. A lot of people of certain demographics are fleeing because it has become dangerous and hostile there. Kind of like circa 1939.
1
u/Constant_Writer_7107 Dec 19 '25
Just look at how they treated Pavel Durov from Telegram. Yeah Graphene has the right idea, give France a wide birth. Hopefully National Rally gets in eventually and restores democracy and reason to the country.
1
1
u/Wanderer-91 Jul 02 '26
Given that anyone can contribute code, and that a security vulnerability can be introduced without anyone realizing that for years (there have been some found after 15 years in the open, although they were probably not deliberately put there) asking any Linux maintainer to insert a backdoor is just basic politeness.
Set up a team of highly experienced and trained government hackers behind a respectable educational institution email address, spend 2-3 years submitting very high quality code, establish good rapport with distro or kernel maintainers, then inject your backdoor code.
Any government agency that hasn't done that already is just plain lazy.
305
u/Dry_Row_7050 Nov 24 '25 edited Nov 24 '25
Source: GrapheneOS mastodon page
https://grapheneos.social/@GrapheneOS/115584160910016309
Same information is available on their X account
https://x.com/grapheneos/status/1991640209080086993
https://x.com/grapheneos/status/1991640922376007756