As for why GrapheneOS is mostly green, I guess there are three explanations: GrapheneOS is really that good

No, it clearly is not. If it provides nothing over AOSP forks, there is no reason why it is better. Maybe you did not read the propaganda dissemination they do, which I sent as a screenshot of their Telegram chats.

Here, I provide it again. https://imgur.com/a/fpcsIL2

If you know of categories where GrapheneOS doesn't do well,

If feature rebranding does anything other than cosmetic or placebo changes, do tell me. Anyone can do it. It improves nothing functionally. Modifying app permissions and using a strong firewall can be done without root and is far more risk free and incomparably easier than flashing a custom Android fork. There is nothing "out of the box" about flashing a custom ROM on any phone for most people in the world, including tech users.

Well yeah, Linus Torvalds does almost no actual development, but he's involved in merging patches. That job has value, and the end result is that people trust his branch.

He also happened to create the Linux kernel by himself and developed it himself for a very long time, until it started getting more contributors. He did all the development needed to be done.

yeah, if GrapheneOS is an embargo partner, that's has a lot of value, and I hope other ROMs are able to get that as well. Faster access to patches is a good thing.

That is very shady. A Google partnership is avoided by other custom build makers like LineageOS for a reason. That is enough reason to stay away from Graphene.

But Chrome is superior to Firefox on mobile in terms of security because Mozilla hasn't ported many of the security features from the desktop browser. That's a fact.

Who decided this fact? Micay's propaganda? Because Tor Project avoids Chromium base for both desktop and mobile browsers for multiple reasons, one of them being security. Chromium is incredibly leaky, insecure and anti-anonymity.

https://trac.torproject.org/projects/tor/wiki/doc/ImportantGoogleChromeBugs

You think Micay and his GPT tier filler has even 1% credibility compared to TailsOS professionals who maintain supremacy over state actors?

Sane defaults has a ton of value. Most people don't know how to configure an OS to be secure. It's not the only option obviously, that's just stupid dogmatism, but it is a good option, and perhaps the best option out of the box

There is nothing OOTB about flashing a custom Android build on a specific phone brand/model people buy with a lot of money. It risks bricking, alongside the obvious thing about Graphene community being insanely vitriolic as far as tech support questions go. Non root hardening is risk free, easy, achieves same goals and is a transparent process.

I'm guessing most phones are, or at least compromised by the NSA. The NSA's job is to maintain backdoors to go after national security threats, so there's no reason to expect any default configuration to protect you.

Huawei was sanctioned by USA partly because they refused to put NSA backdoors in it, and western agencies failed to find any Chinese backdooring in it, since they were provided source code to analyse. The ban eventually happened due to market protectionist reasons similar to what is happening to Tiktok now, or Alstom, Toshiba, IPTN and others.

Yet [Snowing allegedly recommends GrapheneOS]

That said, I don't put a ton of stock into what Snowdon has to say. He's not a security expert, he's just a contractor who got away with government documents. He's careful, but fairly average.

Snowden is not a security expert, but an OPSEC expert. Wildly different things. He was a spy. He was able to practice his OPSEC without fail and modify it on the go. His advice is not meaningful, and this tweet is irrelevant because too many things happened since 2019. He acts more like the "Symbol of Peace" like All Might in Boku no Hero Academia anime show, like some sort of symbolic "hero" figure.

Few years ago, in 2021, without any community consensus, Micay added a shutter sound for camera which could not be muted, putting the target audience of this tool/product at risk of jail or even death – privacy users, journalists and activists. https://old.reddit.com/r/privacytoolsIO/comments/pjl4bh/what_is_your_opinion_of_grapheneos_conforming_to/ So, how is Snowden's 2019 tweet relevant? How can anyone seriously trust Graphene one bit?

That said, it's unlikely to impact regular users because those attacks are quite sophisticated and often caught by security researchers pretty quickly. The Android market is more sketchy because there's so much more diversity to the point where security researchers are going to miss a lot.

It was established by Zerodium few years ago that Android's zero days cost more than iOS' zero days, and that Android's open source security model has surpassed whatever obscure security Apple has. That gap has continued to widen.

If there is a permanent hardware vulnerability, it will impact security just like Spectre, Meltdown and others affect Intel chips. Apple's phones and devices with "security enclave" chips are all permanently vulnerable. Androids as a whole are far more secure, and it is Apple that is sketchy, not Android.

Regardless, staying up to date on security patches is the best line of defense, and sandboxing everything is the next line. GrapheneOS provides both.

...on Google hardware with proprietary "security" chips that it refuses to open up. And Graphene's embargo patch Google partnership is shady. Why is it the only custom Android build to get this? Any unrevealed links to Google hidden from all of us? Because Micay loves creating toxic social media army, using sockpuppet trolling tactics evidently and obscuring or hiding conflict of interest.

"security by obscurity"

Ok, you lost me here. What they're providing is security by layers (sandboxing, reducing attack surface by having less stuff running, etc) and rapid security updates from upstream.

Google has one extra proprietary "security" hardware layer than every other Android phone in existence. This makes Google much more proprietary and unpredictable, which makes it logically unfit for adopting for privacy, security and anonymity purposes.