ROM is to android what distro is to Linux. The term is used correctly here. An android ROM could refer to the stock OS, GrapheneOS, LineageOS, Pixel Experience, etc.
GrapheneOS and other operating systems based on the Android Open Source Project (AOSP) are Linux distributions. None of those is a ROM. They're AOSP-based OSes. They're not read-only memory firmware or stored in read-only memory. Using the term ROM that way is very confusing to people who aren't part of communities historically using it that way. It's very misleading and propagates misconceptions. It's not simply about it not being technically accurate.
With immutable distros (see bootc or systemd-sysupgrade) the operating system itself is also only just a read only file system. Does that count as ROM too?
In the context of GrapheneOS, ROM means read-only memory. GrapheneOS does security research on hardware and firmware where the term ROM is useful and very relevant to security. There are multiple ROMs used on devices including the boot ROM loading, verifying and running the SoC boot firmware from the SSD.
Most people aren't exposed to the Android modding communities where the term ROM is used to mean Android-based OS. It's confusing to the general public including technical people. It misleads people about what it is and directly leads to misconceptions which we keep needing to address. It's best to avoid using inaccurate terminology which creates unnecessary misconceptions. There isn't a good reason to insist on using it. We would appreciate if Roblox fixed their documentation to avoid using it.
Might as well just use the term "Android distr(o|ibution)" whenever talking about it. I think its also more self-explanatory vs "Android ROM" if you never heard of them before.
GrapheneOS and other operating systems based on the Android Open Source Project (AOSP) are Linux distributions. None of those is a ROM. They're AOSP-based OSes. They're not read-only memory firmware or stored in read-only memory. Using the term ROM that way is very confusing to people who aren't part of communities historically using it that way. It's very misleading and propagates misconceptions. It's not simply about it not being technically accurate.
LineageOS disables major parts of verified boot, doesn't preserve the security model it depends on and sets an inaccurate security patch level solely based on the AOSP security backports. Most alternative Android-based operating systems are based on LineageOS and inherit these properties from it.
GrapheneOS didn't create any attestation system and has been a very strong advocate against apps disallowing people from using an arbitrary device or OS. For developers insisting on doing it, we explain how to permit other operating systems beyond Google certified ones using the standard Android hardware attestation system. We provide a signed JSON file with our verified boot key fingerprints for use with it. Other operating systems can do the same as long as they preserve the security model including verified boot. It isn't anything added or created by GrapheneOS but rather is fully functional in a properly done release build of the Android Open Source Project signed with release keys.
