Android 17 QPR1 was released for Pixels on September 15. It has a regression in the Pixel kernel driver tree causing stuttering, lag and outright freezes under memory pressure. It impacts #GrapheneOS too since we updated the firmware/drivers but now we fixed it ourselves. Google is taking increasingly long to implement and ship fixes for major issues in Android. We're having to expand our workload to include handling basic updates, testing and quality control for the entire operating system. We have rapidly growing resources and we'll handle it. Pixel 11 series received a bug fix release near the start of September 2026 with the 2026-09-01 patch level. That update wasn't Android 17 QPR1 and also doesn't include the September 2026 Pixel firmware/driver security patches. Perhaps they noticed this issue and cancelled it. Standard Android and Pixel updates have a severe issue with delays. It usually takes 2-3 months for Google to ship fixes for both severe regressions and security issues. They often get the issues fixed in days but the release engineering and testing process is completely broken. Major Android releases including Android 17 QPR1 go through a long public testing period. It typically takes Google at least around 4 to 6 weeks to ship fixes for even the most severe issues. They either cancel the release (Pixel 11) or ship a broken release (everything else). Here's our fix for the awful Android 17 QPR1 regression causing lag, stuttering and freezes: https://gitlab.com/grapheneos/kernel_pixel_6.6/-/commit/ed5a9b87d99b45618fa55b3d6b53094cbd784b9f It's so severe that it's causing processes to be killed for stalls. It's unclear when Google will ship a fix for the issue. December 2026 wouldn't be a surprise. Due to this major Android 17 QPR1 regression, we've been looking into reducing memory usage. We found a way to eliminate most extra memory use from our secure spawning feature without any significant downsides. We'll try to get that huge improvement shipped before November 2026.

Lifelong 'Grand Theft Auto' fan excited to play the first 'Grand Theft Auto' game released in his lifetime

Our massive overhaul of the AOSP Messaging app has reached the Stable channel in our App Store after 3 releases. It's well on the way to becoming our own high quality #GrapheneOS Messaging app instead. There are still parts of the interface to overhaul including widgets and important features to add. Full support for RCS with all of the additional features it brings including proper group chats, media, opt-in read receipts and much more is going to be the largest project. We'll also be adding RCS end-to-end encryption via Messaging Layer Security (MLS) compatible with Google Messages and iOS. RCS support will be provided via an optional dependency on sandboxed Google Play for activation. In the longer term, we plan to make a fully standalone implementation requiring the carrier to support it. We probably won't make an alternate implementation of using Google's own system for this. Finishing the user interface overhaul, resolving many minor issues and adding important features including search are going to be the priority before getting to RCS. In the meantime, Google Messages is already fully supported on GrapheneOS including RCS with E2EE via MLS:

Usage guide | GrapheneOS

DID YOU JUST SURF THE BLOODY INTERNET WITHOUT PAYING YOUR "BBC LICENSE" MATE 💂‍♀️

The i Paper

How BBC licence fee could be scrapped for a new £11 monthly internet charge

Popular shows like Celebrity Traitors could go behind a paywall if the BBC licence fee isn't replaced by a 'universal' levy

The @White Noise app transition to Kotlin and Jetpack Compose is really good. It's such a smooth, fast messenger. Even more so when I expect most apps relating to Nostr or BTC to be quite sluggish. There is a significant leap in usability for apps that are designed for a platform's native language and libraries.

Now in Stable. View quoted note →

Become Ungovernable View quoted note →

When it comes to open source software, the corporates funded with state money who want to find vulnerabilities in your software for their advantage are often far more qualified, resourceful and committed to their objectives than the limited project developers are. You must be more cautious about having both a secure design and a secure implementation of the design of your software at the earliest possible stage of software development. This increases the time and effort to discover a vulnerability or can close out entire classes of vulnerabilities. We have seen how massive projects are weighted down from development standards of the late 90s and 00s that makes them have thousands of CVEs every release. https://www.phoronix.com/news/Linux-Kernel-CVEs-Nearly-2000 Check out some of the open-source AI tooling from Cellebrite to improve their workflows and automate in researching mobile device vulnerabilities.

GitHub

GitHub - cellebrite-labs/ghidra-rpc: A Ghidra agentic reverse engineering skill.

A Ghidra agentic reverse engineering skill. Contribute to cellebrite-labs/ghidra-rpc development by creating an account on GitHub.

GitHub

GitHub - cellebrite-labs/ida-bridge: Bridge between agents and IDA Pro.

Bridge between agents and IDA Pro. Contribute to cellebrite-labs/ida-bridge development by creating an account on GitHub.

GitHub

GitHub - cellebrite-labs/ida-docs: Agent skill for IDA 9.x IDAPython lookup, backed by the public Hex-Rays IDA SDK.

Agent skill for IDA 9.x IDAPython lookup, backed by the public Hex-Rays IDA SDK. - cellebrite-labs/ida-docs

GitHub

GitHub - cellebrite-labs/ida-porter: Let the agent carry your IDAPython to the next IDA version.

Let the agent carry your IDAPython to the next IDA version. - cellebrite-labs/ida-porter

You can have opinions on the issues of LLMs (and I have several), but that comes with having to accept an adversary is accelerating how to harm you with that technology. View quoted note →

The overhauled #GrapheneOS Messaging app is available in our App Store via the Alpha channel. Our new app development team worked on this for months. It's now a far better app with much higher quality code. We'll make a new release based on feedback soon. We're going to be overhauling or replacing most AOSP apps in the near future: Calculator, Clock, Contacts, Gallery, Keyboard and Phone. The apps we created will be overhauled too. PDF Viewer is done and Camera is next. Camera and PDF Viewer will be getting many new features too. It's a massive overhaul and may need a few releases to reach the Stable channel. We're working on a version 14 release fixing issues with the predictive back animation, tapping contacts not always showing the right SIM with dual SIM and some outdated icons/colors we missed. Messaging will be overhauled even more. We plan to add RCS support with Messaging Layer Security (MLS). That will provide E2EE with contacts using Google Messages or iOS. RCS with MLS can already be used on GrapheneOS via Google Messages but we want to avoid people needing it. View quoted note →

Near the end of May 2026, Russia began filtering access to DataPacket IP space with an enforced domain allowlist for HTTP and TLS SNI. #GrapheneOS services aren't on the allowlist so we had to switch from DataPacket Frankfurt to Cherry Servers Amsterdam for Russia. That's now getting filtered too. We've fixed it again by using Zare London for connections from Russia instead. That's the final of our sponsored servers in Europe we can use so we'll need to fall back to Xenyth Toronto if they filter it. We're using our own IP space in Toronto so it should work unless they specifically block us. We don't think we'll be blocked directly but we're also unlikely to get placed on the allowlist. That means our services are gradually going to become inaccessible in Russia via the IP space of major cloud services. Our own IP space will still work fine and we don't host any VPN services ourselves. Our website, OS updates, app repository, connectivity checks, network time, network-based location, geocoding and other main services should work again in Russia. It's likely they'll expand to filtering Zare's IP space and then we'll have to use Toronto where we have our own non-anycast IPv4 /24. They use a domain blocklist for most of the internet and an allowlist for many VPS and dedicated server hosting providers to block access to VPN services. It's likely they'll expand to enforcing an allowlist for every major server hosting provider. That's far more aggressive than China's filtering. Our authoritative DNS is hosted via 2 anycast networks using our own ASN and IP space so it hasn't been impacted by this. It's likely we can avoid it for the rest of our services by using our own IP space. If they start filtering netcup IP space, we can make a reverse proxy to those from Toronto. If our services are blocked, connectivity checks can also be set to Standard rather than Disabled to use the Google servers. That'll keep automatic selection of networks with internet working along with automatic captive portal handling and JobSceduler not assuming every network has internet access.