Android
DROID DOES
Welcome to the droidymcdroidface-iest, Lemmyest (Lemmiest), test, bestest, phoniest, pluckiest, snarkiest, and spiciest Android community on Lemmy (Do not respond)! Here you can participate in amazing discussions and events relating to all things Android.
The rules for posting and commenting, besides the rules defined here for lemmy.world, are as follows:
Rules
1. All posts must be relevant to Android devices/operating system.
2. Posts cannot be illegal or NSFW material.
3. No spam, self promotion, or upvote farming. Sources engaging in these behavior will be added to the Blacklist.
4. Non-whitelisted bots will be banned.
5. Engage respectfully: Harassment, flamebaiting, bad faith engagement, or agenda posting will result in your posts being removed. Excessive violations will result in temporary or permanent ban, depending on severity.
6. Memes are not allowed to be posts, but are allowed in the comments.
7. Posts from clickbait sources are heavily discouraged. Please de-clickbait titles if it needs to be submitted.
8. Submission statements of any length composed of your own thoughts inside the post text field are mandatory for any microblog posts, and are optional but recommended for article/image/video posts.
Community Resources:
We are Android girls*,
In our Lemmy.world.
The back is plastic,
It's fantastic.
*Well, not just girls: people of all gender identities are welcomed here.
Our Partner Communities:
view the rest of the comments
I guess I didn't make that very clear, I want a non-closed system.
Apple os is obviously a jail, but Google is getting worse and worse at controlling their environment, what you're allowed to do with your phone and bloatware and so many of their featured updates encumber my phone.
For instance, I can't remove the date and time from my home screen?
Or Google still won't tell me which devices are connected to my hotspot?
That is absolutely ridiculous.
Fair phone on the other hand, is deliberately providing an open source Linux operating system for phones that allows actual privacy and customization of your phone if you choose that route.
I vastly prefer that option to any corporate environment OS I've tried so far.
China does not have the best tach, Taiwan is far and away leading the charge in chip tech, even Intel is ahead of chinese chip tech.
China has been the cheapest factory country for a couple decades, but that does not mean that they manufacture the best products.
And I haven't heard any reports about workers jumping off the roof of fairphone buildings in China, not to mention that apple works very hard to obscure their manufacturing base and organization, while fair phone does not.
I'm not convinced that Apple, who uses child labor and sweatshops to build their phones specifically to cut costs, treats their workers better than a company focused on transparency and ethical manufacturing and supply lines.
I'll need some sort of evidence if you're going to insist on that point.
I do keep hearing about graphene OS, and I will look into it has an alternative because this stock OS is as frustrating to use as any I've ever had.
I am not advertizing for apple, I hate that company. Just as perspective on how much Fairphone pays the workers.
FairphoneOS is fully FOSS?
I am comparing GrapheneOS against Fairphone, not Googles Pixel BS.
Agreed AOSP is a Google OS with actively restricted capabilities. But it is the best we have.
I get that, and I wouldn't trust any numbers Apple puts out there, seeing as how they constantly fudge their numbers in every aspect of their business, and we know they have no regard for workers rights at all.
I don't think Murena is strictly foss, but a lot of it is open source and it is degoogled, so you have a lot more control over your environment and all of the fundamental features apparently can be switched out according to your whim.
And murena explicitly doesn't send data to Google or any third party, by design. There are apparently specific tools in Murena that allow you to track permissions and exactly which apps are exporting data and how much, with the option to enable or disable those permissions and data uploads as you see fit, data sending is not pre-installed or checked by default.
As far as I understand, there aren't any apps that are "Oh no. Sorry you can't uninstall this. It's way too important. Also, you can't disable permissions and you can't stop sending data back to us", which are practically all Google services now.
So it's not the perfect solution, but it's a very large practical step in the right direction, and I don't want to take part in these giant unethical, money grubbing slave using companies anymore if there is any viable alternative.
I'm very happy there is finally a third option.
GrapheneOS was the first one to proxy SUPL and DRM leasing.
Also they selfhost connectivity check and attestation servers.
Maybe Murena copied their code.
Degoogled doesnt mean using AOSP or Chromium. Google products include Google everywhere.
Try to use googleteller with Chromium. Its a small tool that beeps if you connect to a google site. That shit was so scary
Degoogling means not depending on Google apps and services.
That's the point of murena, they've replaced most google-dependent apps and services in the OS with foss apps/services.
I'm not a zealot about degoogling, but I don't want to use their apps or services, and with murena I don't have to.
I don't use chromium, though I am well aware of the frequency and amount of data Google collects.
Pretty sick of it.
You use Chromium and you use a Google product because you use Android.
Please go to "settings - apps - show all apps" and enable "show system apps".
Do you have a webview? This is Chromium. Firefoxes Geckoview does the same but it is not feature complete and cannot be used as a webview.
Google is everywhere.
This is all AOSP. No Google apps on the surface, all FOSS. Then play services and frameworks are used for
Those either dont work if you dont have any play services, or you sandbox them to be restricted, possible to disable, isolate in a seperate profile, uninstallable and behind permissions. Or you use microG which fakes values, runs unsandboxed and is still a bunch of proprietary Google stuff.
I wonder how "degoogled" Murena is, please tell me!
You mean pixels, not the fairphone?
Yes, pixels are Google phones and use Google apps and services.
iPhones are Apple phones and use Apple apps and services
But both of these companies by default send a lot of your user data to various third parties.
That is the reason I want a privacy focused phone, to avoid being tethered to a particular environment(you can use alternate OSs by unlocking the bootloader following the steps fairphone provides on their website) and permissions you aren't allowed to customize and are designed to send data to third parties by default.
Murena is based on e/os, which is open-source, it doesn't send user data out by default, they replaced Google apps with open source apps, trackers are removed by default, you can restrict tracking on any apps you choose to have that do track you, Google servers don't check for connectivity, no Play store, location services by Mozilla,
this is the summary from the e/os site today:
https://doc.e.foundation/what-s-e#degoogling--ungoogling-in-eos
And this 2020 paper goes into a little more detail with the services that it blocks, although as you can see from the first link, they've obviously added more features that protect user privacy:
https://e.foundation/wp-content/uploads/2020/09/e-state-of-degooglisation.pdf
They replace Google services and apps with open source and privacy focused services and apps.
While privacy is important to me, the sustainability and general fairness of how fairphone treats their workers and customers and where they get their materials from are at least as important to me.
with fairphone, as far as anyone can tell, they don't source their materials from slave labor, they pay a fair wage, the materials are as sustainable and recyclable as possible, and I can customize my OS and how it operates.
Pixels are Google Phones will full support for a custom OS like GrapheneOS.
Buy the phone, unlock it, flash a real OS onto it.
I think you didnt get that a phone can have a different OS?
You can unlock pixels easily. GrapheneOS extends those permissions, FairphoneOS CANT. Because otherwise they would lose their google certified OS status.
https://discuss.grapheneos.org/d/10712-what-are-stoppers-of-grapheneos-becoming-a-google-certified-os
I hope I explained enough how AOSP sends a tom of data. Please prove that they actually replaced all those things like GrapheneOS did.
The Google Apps on AOSP are open source. What did they do with the preinstalled Chromium for example?
What is that supposed to mean? Either they change the code or they still rely on Google Services. If they selfhost all those things I mentioned then yeah valid.
This doesnt work. Tracking is included in the APK files when building the App with Android studio. You have to decompile the app and remove it, then sign with your own key. You will need to do this on every update, as updates only work if the signing key is the same.
If you mean they use some kind of firewall this may be true. But most tracking goes to central servers (for reliability, these servers distribute the data) which may not be possible to block to keep functionality.
GrapheneOS has a network toggle and reduces the amount of data apps can collect (sensor permission, storage scopes, contact scopes,...), I suppose this is the best you can do.
This will make the OS unusable for many people. Banking, insurance, state stuff all rely on Goofle. Their store, their service framework, their device verification.
Not having any playstore is bad. If they advise to use AuroraStore be aware that it is a legacy app and the "access all files" toggle is not needed. Also you should only use the session installer method.
This is nice, it uses UnifiedNLP and I already contributed a lot using TowerCollector, please do too.
The problem is just that unifiedNLP doesnt exist as a regular user app anymore.
You would need a minimal OS app that redirects location calls by apps to UnifiedNLP, unifiedNLP checks it and redirects it.
Currently it is embedded in microG only (the standalone unifiedNLP has no updates since years), which is an unsandboxed blob of Google Play services, ripped out various components, probably not up to date, with broken features and entirely relying on fake values to get the Play checks right
MicroG is insecure as fuck. I think they cant work with GrapheneOS'ses google play service "run as user app and still work" compatibility layer because they spoof values and more.
UnifiedNLP needs to become a standalone, modern android app again, running as a user app and getting the permission to serve location data by the OS.
GrapheneOS' A-GPS works fine luckily, but GPS may just vanish if the russians decide to bomb our sattelites. Having NLP (Network location provider) is essential and also saves battery.
I think microG still sends unnecessary data to Google when just using UnifiedNLP but no source on that.
I like Mapbox and this is only in microG. Simply microG does not work reliably and should not be used until it is modernized and compatible with gmscompat from GrapheneOS.
They also use Quad9 by default when setting a custom DNS.
Default apps:
They replaced most of the Google server stuff, sounds okay. No info about device attestation and DRM leasing which means you will not be able to use Netflix etc, but this is fine for many privacy conscious people.
So in the end after arguing with GrapheneOS people too, the problem is:
GrapheneOS focuses on simplicity, keeping everything as close to "how it is meant to be" as possible, embracing and patching what android can already do, like more permission toggles or running the Play crap without being able to read your IMEI.
If you buy a new device, just dont buy a phone with that OS, I am sorry.
If Murena would support all the security features of GrapheneOS, or simply take their free code, make it less secure to run on that hardware and add their nice UI stuff on top, it would be acceptable.
But buying a new phone that uses some random chinese OEM model and bundles in a random mix of LineageOS, unmaintained apps and insecure "privacy optimized" play services, just no.
That took hell of a time to write, I hope you appreciate it.
Btw you find every source on github.com/grapheneos
I did read your entire article, but all of your arguments against murena make are based on theoretical consequences of your worst assumptions rather than the information available.
Fair phone isn't using some Chinese model and lineage OES or any legacy Play store.
There aren't many reported issues with banking apps and there is a whole community page about compatibility with banking app specifically for e/os.
I can find plenty of forum users complaining about not being able to use Android banking, insurance or transportation apps, actually had 2 pretty critical issues with my Google services for about 8 months and another for about a year and a half that have never been addressed and the less critical issue was randomly resolved after 8 months or so, so the possibility that an app might not work perfectly on murena isn't a convincing reason to stay away from an OS that doesn't have those problems so far, or to stay in OS that I know has issues.
I'm not sure why removing the Play store makes you think the OS is unusable when there are hundreds of thousands of people using these phones without the Play store.
I included the part about changing the OS for a couple reasons 1) because you seem so singularly focused on graphene OS, it seems that you didn't know you could switch OSs. And 2) they officially instruct their customers how to unlock the bootloader on their phone, which is another sign of transparency and responsibility.
It also makes it easier for me to try out graphene or some other OS if murena doesn't turn out to be what I was looking for.
You seem similarly focused on chromium, which, is that something other than a browser? Because you don't have to use that browser if you don't want to.
Plus, The guy who writes graphene kind of seems like a dick?
https://www.youtube.com/watch?v=4To-F6W1NT0&t=821
Graphene must be a very secure project, because many people have suggested it, but there are a lot of problems with according to its users, it's not some kind of perfect OS, you can just customize it well and it is more privacy focused than stock Android, which is what I like about murena.
Plus, I can put my money where my mouth is and support sustainability, respect for consumers and corporate responsibility, and try something new.
Trying something new doesn't really worry me too much, and all of those hurdles you theorized could happen on a new OS, I have personally experienced in spades in Android phones (stock OS),. Which one would imagine would be the most compatible version of an OS.
Right now, murena and fairphone make more sense to me than keeping a limited Google phone I have been unimpressed with and switching to grapheneOS, written by someone who publicly speaks so recklessly and rudely so often without the proof that his OS is more secure or robust than murena.
Since you keep mentioning the banking apps that app incompatibility, I looked up "banking app not working murena" and "banking app not working graphene", nothing pops up for murena except a list of explicitly working banking apps and one customer asking if banking apps work and another customer responding "Yeah they work, Here's a list of the ones that definitely work."
Perhaps because graphene has more users, but there are dozens of search results for banking app compatibility issues with graphene OS.
I'm not worried about that myself, but is that why you're so worried about banking apps not working on fairphone? Because they don't work with graphene?
I appreciate different perspectives, but you seem singularly focused on pushing one project that just doesn't seem like a good fit for the social responsibility and ethical privacy-based software that I'm interested in regarding fairphone, that so far there doesn't seem to be any issues with. I'm also confident that I can overcome any compatibility issues that do arise, as they have on every phone I have ever owned and every OS I have bought or flashed myself.
Your arguments are a little tree-focused, while the mobile landscape and what goes into creating and implementing the little omnipresent devices is a vast forest.
Okay I am really confused.
Fairphone ships Google Android
But it seems Murena also sells Fairphones but with their /e/OS?
Yeah I think originally /e/OS came on some Chinese OEM phone. For the rest please read their own specs, it makes no sense to repeat all that. /e/OS is based on LineageOS with minor modifications. They use microG.
Banking apps require many different things, many are not even a problem because of eOS security. GrapheneOS is more secure here and banking apps need exceptions.
But the core problem is Google Play verified OS which both OS are not. MicroG or sandboxed play services may have different problems. MicroG may be broken but is completely unrestricted, sandboxed play may need a path in the compatibility.
For you. My main profile is also clean but I use many prioprietary garbage apps I need on a shelter profile.
There are apps only on Play, all the stuff I mentioned. Its a shitty situation and GrapheneOS doesnt just add the playstore but it is sandboxed as a normal user app.
Every AOSP OS removes the proprietary playstore.
I used debloated Android, LineageOS and GrapheneOS. You install GrapheneOS manually on a phone, you verify its integrity and then install it.
Google also has instructions on how to unlock the bootloader and GrapheneOS has a cool web installer.
I understand why you would like a fairphone. GrapheneOS is great, Google is not. You still give Google the money.
But that eOS is untrue about what it does. MicroG is not privacy friendly in any way and it is insecure.
Dude you didnt read my last comment. Chromium is the Webview, most apps use it. It is a core part of the OS.
Doesnt matter if the software is the best, most secure and private you can get. Also he stepped back from being the lead and there are at least a handful of people with similarly profound knowledge and involvement in the OS.
He is still very active, he is very honest, fucked up about privacy theatre that other OS and projects like microG do. So may not always be very friendly but okay.
EOS ships stock AOSP which is the Android base of all other manifacturer stock Androids, and slams unrestricted Play services on top. Also they have their own services which people will use to they have less problems.
GrapheneOS is way more secure and does good changes. They also fix stuff like carrier functionality working without needing their garbage apps, or Google Camera (without internet permission) working without any dependencies.
They are not the same as they do things very differently. I would always recommend GrapheneOS as its complete.
As I said, if eOS would base ontop of it and maybe weaken many security fixes only working on Pixels, then they could add their fancy stuff on top and be a good OS.
No they wont. All those devices have google services and are google certified. All apps will work.
Wait, you already have a pixel? Omg please install GrapheneOS and try it out before buying something so much less secure.
The phones may not be impressive and they have many things that suck like no headphone jack and a BS fingerprint sensor and cameras on the 6a at least. But they are very secure.
I gave you the proof, look at their code. MicroG and LineageOS etc are insecure and GrapheneOS is. This is not a one person project since years.
The "drama" came from people that put the personal contact with an autistic person over the actual OS. Imagine maintaining such a huge project...
Btw if you read something about an "AOSP alliance", that never became a thing poorly, because they couldnt agree on things I guess. LineageOS, GrapheneOS, and more derivates like eOS, CalyxOS, DivestOS etc.
GrapheneOS is not based off LineageOS which is a big difference.
Yes because they have more users, a Github bug tracker for every app, multiple websites etc.
GrapheneOS has a different hardware based attestation method that banking apps can use. I suppose eOS would not pass that test. Both apps are not Google certified so some apps will stop working.
GrapheneOS is the only custom Android worth using if you care about security and privacy. I was on a LineageOS phone for years.
If murena forked GrapheneOS that would be okay. It still would have too slow updates probably, and incomplete firmware updates in the future, unlike a Pixel 8 that will last 6 years or so when I buy one.
All that "ethical privacy based software" makes no sense. Both are Android, GrapheneOS is way more privacy friendly and can run the same FOSS apps.
I feel like I wasted an hour or so of writing...
You just ignored anything I wrote if you think there are no issues, lol.
microG relies on proprietary code and is incomplete. I dont think you will.
The rest is just AOSP, so yeah
No idea what that means but there is too little collaboration which sucks.
If projects could agree on stuff that would be great.
GrapheneOS is just the best that there is currently. I would for sure whish to have more UX features but unless I do it myself and maintain it, or projects join effords, GrapheneOS is quick on everything security related (and adoption, they had a Pixel Tablet version in a day!) But very slow in UX-only features.
So please read what I wrote, didnt seem like it. Use what you like but if you already gave Google money I dont see why not install GrapheneOS and try it.
To round it up, I for sure would like an ethical phone, with a damn headphone jack, easily replaceable parts, but all the security features that my threat model requires. Google Pixels have gotten worse, at least they get smaller, but this is a tradeoff that I accepted.
I also want to do a post someday of all the crazy things you can do to customize Android, without needing root.
It's pretty rude and obviously incorrect to accuse me of not reading or ignoring what you wrote when you literally just listed in the same comment all of my points that address nearly every point you made about graphene and murena in your previous comment.
The proof that I read your comment is apparent in the responses that you have listed.
I've read this one too.
"> so the possibility that an app might not work perfectly on murena isn't a convincing reason to stay away from an OS
For you. My main profile is also clean but I use many prioprietary garbage apps I need on a shelter profile. "
Yes, for me. I have no problem customizing or troubleshooting an OS.
Many of your points about whether they're Chinese manufactured or sourced or which code murena uses or not, which apps murena uses, you are still making assumptions rather than using the contradicting available data, and then coming to spooky conclusions based on those assumptions.
I agree that if fairphone used different apps then they use, and they used different protocols than they use and if users were upset with fair phone, then it would be a worse idea to try fair phone.
But since fairphone doesn't use many of the apps or services you assumed they did, and they don't have the compatibility problems with these apps that you assumed they did and users don't complain about the phone, and there's no evidence of anything except transparency and responsibility, I'm not going to worry about these non-material anxieties.
And I know I've mentioned this a couple times now, but I'm more interested in the transparency and responsibility of the company themselves than I am about removing every single byte of data potentially sent to third parties.
The nice thing is that with Fair phone, it seems much easier with all of the open source apps and the open source OS to limit that exported data.
Regarding graphene, it is important how the team creating software behaves, I think it's a salient indication of how good the software and especially how strong the actual project is.
It comes down to trust.
If I'm buying a house, and there are two identical houses, except one is a five bedroom with a landlord who is an asshole and one is a 4 bedroom with a landlord who I trust, I'm obviously going to buy the four bedroom.
It doesn't matter if you get the fifth bedroom if you can't trust your landlord not to change the terms of your contract or to abide by them.
As for your parting concerns:
You have no proof murena is insecure, and there is no evidence out there corroborating your claim.
microg is less of a concern for me since I don't use Google apps, so the data that does get sent by micro g will be limited.
I'm not very concerned about rapid updates since the rapid updates that come out on Android, for instance, often corrupt or render features unusable. I'm fine without receiving "feature updates" every 2 weeks.
the fairphone 5 is going to be supported for 8 to 10 years until Android 18. That's the longest supported phone, I believe. Longest I've ever heard of, anyway.
Hey, sorry is I got rude.
Its just really frustrating to name so many points and in the end getting the same statements again that I said where incompatible.
The problem is, this is the typical "Linux is user friendly" perspective too. An OS has to work for anyone. And poorly there are shitty people out there that dont care about privacy and make users depend on Google.
Examples:
These apps dont work if something in the play service stack is broken, and nobody of us can fix that.
MicroG is waay more prone to errors because they begin at the wrong end in my opinion. It is great how they liberate Android by offering alternative providers, but GrapheneOS'ses approach to use the android builtin way of isolation, making the Play services run as user apps, makes so much more sense.
Its a basic method of security I learned a short time ago, from this blog post about bad security ideas
microG is doing some form of badness enumeration. Badness enumeration is what Adblockers use, you list all the bad stuff and allow all the rest. This is inherently flawed because it uses up a ton of resources (which get more and more over time) but the moment a new Domain comes in, you need to patch again.
MicroG does this by disabling random play Service parts. The thing is they still keep the functionality so it is not private at all.
GrapheneOS does it the other way around, instead of allowing everything and blocking some things, they confine the app as a user app. It is used to do what it wants, so to restore that they use gmscompat which is a system app that channels the calls.
What this app then does is the opposite of badness enumeration, it only allows certain calls to be made. And due to the basic Android security model, user apps are already not allowed to read critical identifiable data etc., what I said.
This was never my piont. It is about hardware security features of the Devices, and their compatibility with the OS.
https://grapheneos.org/faq#future-devices
They have to match those requirements, and Fairphone does not.
Afaik Fairphone would be the critical piece between the manifacturers and the custom OS. So if they are late, I suppose any OS can only be late. At least that is how its done with GrapheneOS.
Android has security updates recommended for all devices. But there are more, and Google Pixel integrates all of them. GrapheneOS then uses that AOSP code of the google Pixels and builds GrapheneOS from it.
This means updates are about a day or so delayed, while Fairphone delayed updates for months, even though they get early access, as I said.
Dont confuse Fairphone and Murena here again. Fairphone ships a tracking Google OS. Murena has this appstore which should use modern Libraries etc, as they only support up to date Devices (different than F-Droid).
Still, to be exact you should not use F-Droid builds as a base of your appstore. Look at Obtainium, it is a good base (their UI sucks and is overcomplicated) for a secure appstore.
The Android security models builds on the fact that Developers sign their APKs themselves. Its about trust, and here you need to only trust the Dev. F-Droid takes the code (that nobody really reads) and compiles it. All the apps have the same key.
If F-Droid got hacked, you would have a huge breach, unlike if one Developer got hacked.
But that is just a thing on the side.
No idea what that should mean. I had many points?
They complain about the hardware. But nobody knows about all that low level security stuff. Do you know what hardware memory tagging is? Or what version of ARM the Fairphone 5 uses?
I have no idea so I trust GrapheneOS developers if they repeatedly answer questions over questions with valid points.
Wtf is evidence?? You this "evidence", this is open source code, anyone can look at it. GrapheneOS is way more secure than LineageOS, period.
jerboah deleted my draft, writing again... luckily had a copy
Please just look at the code. Some killer features are
Its all under the hood stuff you dont easily notice.
Fairphone ships a Google OS and massively delays updates. Murena advertizes privacy features that are insecure and untrue, because microG is a security risk and privacy invasive. Fairphones will not get firmware updates for their supposedly supported lifetime.
Comment 2, Lemmy had a limit I guess
They are not transparent about the fact that they include actual, unrestricted Play services, but call it "private".
GrapheneOS is ENTIRELY open source. Look at their Github. Every site, even every Server configuration is there. Every app they do, everything.
You said you flashed phones, and I dont get thid scentence? These apps are all just apps, you can install them anywhere.
The other way around, (learned this after discussions with GOS devs), if you preinstall random apps, they are yours. You need to maintain them. If you remove them, with an update, data may be lost!
They ship Bromite and QKSMS which are both unmaintained projects.
Also, these are possibly system apps. Those have no permissions, they can do everything, which is crazy insecure.
GrapheneOS is bad at guiding users what apps they should use, and where to get them. Basically because F-Droid is insecure and recommending apps could make them be liable for them.
But GrapheneOS ships minimum apps. There is no good AOSP calendar, so they extracted the core of the AOSP calendar and only ship that, its needed to make other apps work. Their other apps can all be disabled, they are in the system partition and dont take up usable space.
Daniel Mikay is not the lead of the project for quite some time. He is still active and doing very very valuable work (that nobody else does) but he is not head anymore.
You dont live with an OS developer, you dont even see them. Also you dont have to fear they increase cost because GrapheneOS is free software (that really needs funding). If you have issues, you have issues with a gift you get by them for free.
This comparison makes no sense. But as I said, the devs may always sound a bit similar in their way they think, but its for the best of the project.
Wtf it is free software and will alway be. This makes no sense but is actively accusing of untrue stuff.
Yeah I dont need to read source code to you. Take what I wrote above, research the things, look what the difference is.
This "give me evidence" makes no sense. It is open source code, you just have to look.
MicroG is play services. They connect to Google and send them lots of data inaccessible to for example sandboxed play.
It is preinstalled and cannot be removed, unlike sandboxed play.
Every app from the playstore basically uses them, and many more. Chat apps will use it automatically for push notifications.
Not using Google Apps to mitigate that is very naive.
These are monthly security updates. No idea what feature updates you are talking about, this is not Samsung.
This is also not about biweekly, but delayed for months and probably still incomplete, as I mentioned already, Pixels get all Patches, other OSses only need to implement the minimum requirements.
The kernel may get updates until then. But the firmware not. I dont have numbers, but they used some IOT part that gets longer updates, but it was already a year old and it will not get updates for 10 years.
Many security patches are firmware, and this will not get updates.
So a Google Pixel 8 is way more expensive and only gets updates for 8 years, but they are actually and fully 8 years, for every component.
Internet search engines are really bad nowadays. You need to get the specs of every part of the phone and then check how many years they will get updates.
https://calyxos.org/docs/guide/microg/#:~:text=The%20long%20answer%3A%20microG%20does,Services%20in%20the%20app%20itself).
I can't find out how micro g is a security risk unless you use Google apps.
If I'm not using any Google apps, how is micro g a security risk?
Because certain parts, not apps, of e/OS use micro g?
Fairphone ships a Google os or an e/os.
Lineageos says that the micro g security risk is only present if you explicitly give permission:
"The signature spoofing could be an unsafe feature only if the user blindly gives any permission to any app, as this permission can't be obtained automatically by the apps. Moreover, to further strengthen the security of our ROM, we modified the signature spoofing permission so that only system privileged apps can obtain it, and no security threat is posed to our users."
If I keep this pixel, I can always try grapheneos on it.
Evidence would be if reports come out that something is insecure.
Since there are no reports of murena or fairphone being more insecure than many other OSs, and any reports or user discussions I can find talk about it being more secure, I just don't see the point of worrying about problems that haven't occurred yet or unrelated to my situation (I don't use Google apps or the Play store, so I worry about issues that affect Google apps are the Play store for instance).
I think you're getting the same points because you're concerns and mine are not the same.
Can you show me the updates that are delayed for months by fairphone? I can't find any evidence of that.
I'm not sure I understand that process either, why are updates delayed by months?
I see, I was conflating the fairphone and murena companies.
Any app can choose to embed the play services for displaying ads or sending data. And those are not just passive libraries, they are actively sending tons of stuff to Google. As they are not isolated as user apps you always have to assume the worst, that they send all your stuff to google.
This is the best answer
(Signal sees the faked google play services and automatically uses them for push messages. Its own websocket request thing is only used with a warning, if they are not found)
I am relieved, because I was at first questioning what I told you.
So it is insecure because it allows Google binaries to run without a container.
UnifiedNLP, Mapbox tiles, UnifiedPush, are all great. But if apps implement Google libraries, only official play services will work reliably. Its responsibility you know, it could break and then the project gets flooded with bug reports and gets a bad reputation.
Those have to be internal permissions as microG has to be installed into the system partition and thus doesnt need any permissions.
It is a long time ago that I used microG though.
Proactive security. I wouldnt want to be in a situation where I cannot use my phone anymore suddenly, until the OS has patched a vulnerability that would probably not exist if their entire implementation was different (as a sandboxed app).
The problem is that microG needs to fake values etc. For some reason that means it cannot be a user app, which makes it fundamentally incompatible with the more secure GrapheneOS approach poorly.
I would like to use those service too, GrapheneOS allows redirecting location queries to the OS at least, so the app thinks it gets that fancy Google location data (fine location, NLP) but it actually just gets the A-GPS (rough location).
Probably but that transparency point was interesting.
They have to have release notes for their updates. No motivation to dig them up tbh.
They are an OEM, this is relevant because GrapheneOS "just" takes the complete AOSP updates for the exact phones they produce directly from Google (which is a huge help, they have all the patches, Kernel, vendor code etc. for exactly those phones) and feed it into their build system.
That will all be automatic. So they add the apps and stuff and build the packages, and ship them.
Fairphone needs to patch their own (?) Kernel, as their phones are somewhat unique. No idea how to do that, but they will have a mix of components and the kernel has to work on those. This is a bit more work but doesnt explain months of delay.
Also OEMs get early access exactly for that reason, so that they can patch their custom kernels and code, because Android phones are SOCs, every Android is different.
There are steps towards mainline kernel support, which means that the phones can run on regular Linux with less trouble. This improves the patching and modification process, ensures longer updates, ... and of course also saves money. Google is doing things in that direction.
Also idk if Murena gets early access from Fairphone, because Fairphone is using a Google certified OS and Murena doesnt. So this may be a problem.
Got it, plan was to avoid adding my Google profile onto this phone. Anyway, I don't use Gmail or gsearch or Google maps or any of that.
And it looks like as long as I don't have a profile, the minimal data that is sent out from micro g would be anonymized.
Proactive security is important, but obviously use case is also pretty important.
Agree that graphene OS seems like a pretty secure option, but for me personally it wouldn't add much more security than how I already use my phone.
I still like the idea, and when I get a new phone, I'll probably be experimenting on this one a lot more, and I'm sure that'll include graphene OS at some point.
I'll have to get a new non-pixel phone anyway, since non-expandable storage was already absurd 5 years ago, but graphene OS does look like it's worth playing around with on my older phone.
Oh, and I do have to make it perfectly clear that the ethical supply lines, corporate responsibility and transparency, as well as consumer respect from fairphone is the larger reason I'm intent on buying a fairphone, the added privacy and security is just a bonus to that.
Keep in mind that if you download apps from the playstore (no idea if /e/ proxies those apps or something) many include Google Play libraries and SDK.
I think I linked that comment under the microG post in the GOS discuss. Apps dont even need any play services to communicate to Google.
MicroG downloads official Google binaries, e.g. their tracking BS. These are able to read persistent device identifiers like IMEI etc. Under many circumstances these are personal identifiers, and if you for example would create a seperate user profile for banking or Google crap, Google could easily link those activities.
It never worked well. Either it was unencrypted, or it could only be read by this device, making it useless as a backup solution if your device dies.
I think they are transparent in the hardware area. I didnt find it very easy to find out where exaclty who is getting how much money, with what companies they share production facilities etc. But I understand that point.
Just want to stress that their software and their de facto limitations due to standars hardware suppliers like anyone else, are not really transparent.
Cheers!
At this point, minimal anonymized data is fine by me. I equate it with walking down the sidewalk and people who don't know me being able to know what color I want my hair to be. Not what color it is, but what I would like it to be.
Honestly even minimal non-anonymized data doesn't really bother me relative to the changes that an ethical company makes.
I'm not sure what e specifically uses, I know that murena allows you to choose your app store according to whether you want to use open source apps or not, or tethered to play services or not.
Yeah, non-expandable storage is incomprehensible to me, having used phones with expandable storage and having used phones with non-expandable.
Keep an eye on DivestOS. It seems to be somewhat similar to GrapheneOS but on more devices.
I think the changes are a bit too many though. They support microG in the GrapheneOS sandbox, which may be pretty cool (until it breaks, or you need stuff not included in microG)
I think 128GB is enough, but a small phone with a headphone jack, good cameras and a working fingerprint sensor...
I am pure Bluetooth, I was very happy to get rid of the headphone jack.
Thanks for the OS recommendation.
Oh, if you're interested in cameras, you should check out the side by side videos of fairphone cameras with pixels and iPhones. At least half the time, I prefer the fair phone camera shots I'm seeing.
I don't know if it's less processing or what, but something about the fair phone photos look better to me, even without umpteenth megapixel updates.
128 GB is way too small for me. I can work with it, but it's like 12 minutes of video and I take a lot of video.
7 years ago I had an oppo with their proprietary usb charging that went zero to 80 in 30 minutes and had up to four gigabytes expandable storage, I had 512 gb on there, 6gb ram.
The state of phone tech today is crazy to me, the one percent increase in CPU processing power every month means nothing to me if I can't take more than 20 minutes of HD video and edit it without the phone crashing.
Also, not really relevant, bring back front facing speakers! I want a phone with front facing speakers again so bad.
https://discuss.grapheneos.org/d/4290-sandboxed-microg/25
GrapheneOS is a bit slower due to security improvements btw. Secure app spawning and often enhanced randomization. 100% worth it though
I read about that on the graphene forum, i wouldn't mind waiting a few seconds for a higher level of security
No, not at all.
I am on Secureblue now on my Laptop, which also takes way longer to start. This is a different thing, but in general, "performance improvements" are often dangerous security drawbacks.
Like this Zygote thing in Android where all Apps share some memory parts or the layout or whatever (already forgot it) which makes them similar to each other and predictable for memory exploits.
On Linux there is something like "zero trust randomization" which increases startup time, because the OS doesnt trust the hardware to do good randomization and instead does it itself.
That quick startup on Linux and just how much faster it is in general. Then centralized OS systems is why I switched.
I've never heard of the zygote thing, it's a Android service? Or a shared Android process?
https://developer.android.com/reference/android/app/ZygotePreload
https://developer.android.com/topic/performance/memory-overview
https://medium.com/@voodoomio/what-the-zygote-76f852d887d9
Btw we are mixing up Fairphone and murena all the time.
Fairphone has a different OS. This is murena with their /e/ stuff, which is less fair, more "LineageOS privacy optimized".
Fairphone runs a Google certified OS, which means they cannot harden it, have to preinstall Google apps and cannot add permission toggles for example.
https://discuss.grapheneos.org/d/10712-what-are-stoppers-of-grapheneos-becoming-a-google-certified-os