The Feature They Cut to Save a Few Dollars

Here’s a small thing that stuck with me: the GrapheneOS team spent a week porting their hardened Android to the Pixel 11, got most of the way there, and then hit a wall. The chip doesn’t appear to support ARM’s hardware memory tagging, or at least nothing in the software, firmware, or (they think almost certainly) the hardware will let them use it. Their guess is that Google cut it to save money.

Memory tagging is a neat idea. Every chunk of memory gets a little tag, every pointer carries a matching one, and if they don’t match the chip stops the program on the spot. A whole family of bugs, the kind attackers love, turns into a crash instead of a break-in. The Pixel 8 shipped with it in 2023, GrapheneOS switched it on across essentially the whole operating system within the month, and Android itself… mostly didn’t. It’s in Advanced Protection Mode for a few processes. Meanwhile Apple made its version always-on for the iPhone 17.

So the odd shape of this story is that Google built a lock, left it in the box for three years, and now seems to have stopped shipping it. And you can see why that’s easy to do. A feature nobody turns on has no users to complain when it vanishes. Its absence doesn’t show up in any benchmark or review. It shows up, if ever, as a breach somebody else suffers later.

Jane Jacobs would probably point out that the one group who noticed is a tiny volunteer-ish project, acting like a canary. I’m curious whether Google answers them, or whether the answer is just the next spec sheet.