Android
DROID DOES
Welcome to the droidymcdroidface-iest, Lemmyest (Lemmiest), test, bestest, phoniest, pluckiest, snarkiest, and spiciest Android community on Lemmy (Do not respond)! Here you can participate in amazing discussions and events relating to all things Android.
The rules for posting and commenting, besides the rules defined here for lemmy.world, are as follows:
Rules
1. All posts must be relevant to Android devices/operating system.
2. Posts cannot be illegal or NSFW material.
3. No spam, self promotion, or upvote farming. Sources engaging in these behavior will be added to the Blacklist.
4. Non-whitelisted bots will be banned.
5. Engage respectfully: Harassment, flamebaiting, bad faith engagement, or agenda posting will result in your posts being removed. Excessive violations will result in temporary or permanent ban, depending on severity.
6. Memes are not allowed to be posts, but are allowed in the comments.
7. Posts from clickbait sources are heavily discouraged. Please de-clickbait titles if it needs to be submitted.
8. Submission statements of any length composed of your own thoughts inside the post text field are mandatory for any microblog posts, and are optional but recommended for article/image/video posts.
Community Resources:
We are Android girls*,
In our Lemmy.world.
The back is plastic,
It's fantastic.
*Well, not just girls: people of all gender identities are welcomed here.
Our Partner Communities:
view the rest of the comments
https://calyxos.org/docs/guide/microg/#:~:text=The%20long%20answer%3A%20microG%20does,Services%20in%20the%20app%20itself).
I can't find out how micro g is a security risk unless you use Google apps.
If I'm not using any Google apps, how is micro g a security risk?
Because certain parts, not apps, of e/OS use micro g?
Fairphone ships a Google os or an e/os.
Lineageos says that the micro g security risk is only present if you explicitly give permission:
"The signature spoofing could be an unsafe feature only if the user blindly gives any permission to any app, as this permission can't be obtained automatically by the apps. Moreover, to further strengthen the security of our ROM, we modified the signature spoofing permission so that only system privileged apps can obtain it, and no security threat is posed to our users."
If I keep this pixel, I can always try grapheneos on it.
Evidence would be if reports come out that something is insecure.
Since there are no reports of murena or fairphone being more insecure than many other OSs, and any reports or user discussions I can find talk about it being more secure, I just don't see the point of worrying about problems that haven't occurred yet or unrelated to my situation (I don't use Google apps or the Play store, so I worry about issues that affect Google apps are the Play store for instance).
I think you're getting the same points because you're concerns and mine are not the same.
Can you show me the updates that are delayed for months by fairphone? I can't find any evidence of that.
I'm not sure I understand that process either, why are updates delayed by months?
I see, I was conflating the fairphone and murena companies.
Any app can choose to embed the play services for displaying ads or sending data. And those are not just passive libraries, they are actively sending tons of stuff to Google. As they are not isolated as user apps you always have to assume the worst, that they send all your stuff to google.
This is the best answer
(Signal sees the faked google play services and automatically uses them for push messages. Its own websocket request thing is only used with a warning, if they are not found)
I am relieved, because I was at first questioning what I told you.
So it is insecure because it allows Google binaries to run without a container.
UnifiedNLP, Mapbox tiles, UnifiedPush, are all great. But if apps implement Google libraries, only official play services will work reliably. Its responsibility you know, it could break and then the project gets flooded with bug reports and gets a bad reputation.
Those have to be internal permissions as microG has to be installed into the system partition and thus doesnt need any permissions.
It is a long time ago that I used microG though.
Proactive security. I wouldnt want to be in a situation where I cannot use my phone anymore suddenly, until the OS has patched a vulnerability that would probably not exist if their entire implementation was different (as a sandboxed app).
The problem is that microG needs to fake values etc. For some reason that means it cannot be a user app, which makes it fundamentally incompatible with the more secure GrapheneOS approach poorly.
I would like to use those service too, GrapheneOS allows redirecting location queries to the OS at least, so the app thinks it gets that fancy Google location data (fine location, NLP) but it actually just gets the A-GPS (rough location).
Probably but that transparency point was interesting.
They have to have release notes for their updates. No motivation to dig them up tbh.
They are an OEM, this is relevant because GrapheneOS "just" takes the complete AOSP updates for the exact phones they produce directly from Google (which is a huge help, they have all the patches, Kernel, vendor code etc. for exactly those phones) and feed it into their build system.
That will all be automatic. So they add the apps and stuff and build the packages, and ship them.
Fairphone needs to patch their own (?) Kernel, as their phones are somewhat unique. No idea how to do that, but they will have a mix of components and the kernel has to work on those. This is a bit more work but doesnt explain months of delay.
Also OEMs get early access exactly for that reason, so that they can patch their custom kernels and code, because Android phones are SOCs, every Android is different.
There are steps towards mainline kernel support, which means that the phones can run on regular Linux with less trouble. This improves the patching and modification process, ensures longer updates, ... and of course also saves money. Google is doing things in that direction.
Also idk if Murena gets early access from Fairphone, because Fairphone is using a Google certified OS and Murena doesnt. So this may be a problem.
Got it, plan was to avoid adding my Google profile onto this phone. Anyway, I don't use Gmail or gsearch or Google maps or any of that.
And it looks like as long as I don't have a profile, the minimal data that is sent out from micro g would be anonymized.
Proactive security is important, but obviously use case is also pretty important.
Agree that graphene OS seems like a pretty secure option, but for me personally it wouldn't add much more security than how I already use my phone.
I still like the idea, and when I get a new phone, I'll probably be experimenting on this one a lot more, and I'm sure that'll include graphene OS at some point.
I'll have to get a new non-pixel phone anyway, since non-expandable storage was already absurd 5 years ago, but graphene OS does look like it's worth playing around with on my older phone.
Oh, and I do have to make it perfectly clear that the ethical supply lines, corporate responsibility and transparency, as well as consumer respect from fairphone is the larger reason I'm intent on buying a fairphone, the added privacy and security is just a bonus to that.
Keep in mind that if you download apps from the playstore (no idea if /e/ proxies those apps or something) many include Google Play libraries and SDK.
I think I linked that comment under the microG post in the GOS discuss. Apps dont even need any play services to communicate to Google.
MicroG downloads official Google binaries, e.g. their tracking BS. These are able to read persistent device identifiers like IMEI etc. Under many circumstances these are personal identifiers, and if you for example would create a seperate user profile for banking or Google crap, Google could easily link those activities.
It never worked well. Either it was unencrypted, or it could only be read by this device, making it useless as a backup solution if your device dies.
I think they are transparent in the hardware area. I didnt find it very easy to find out where exaclty who is getting how much money, with what companies they share production facilities etc. But I understand that point.
Just want to stress that their software and their de facto limitations due to standars hardware suppliers like anyone else, are not really transparent.
Cheers!
At this point, minimal anonymized data is fine by me. I equate it with walking down the sidewalk and people who don't know me being able to know what color I want my hair to be. Not what color it is, but what I would like it to be.
Honestly even minimal non-anonymized data doesn't really bother me relative to the changes that an ethical company makes.
I'm not sure what e specifically uses, I know that murena allows you to choose your app store according to whether you want to use open source apps or not, or tethered to play services or not.
Yeah, non-expandable storage is incomprehensible to me, having used phones with expandable storage and having used phones with non-expandable.
Keep an eye on DivestOS. It seems to be somewhat similar to GrapheneOS but on more devices.
I think the changes are a bit too many though. They support microG in the GrapheneOS sandbox, which may be pretty cool (until it breaks, or you need stuff not included in microG)
I think 128GB is enough, but a small phone with a headphone jack, good cameras and a working fingerprint sensor...
I am pure Bluetooth, I was very happy to get rid of the headphone jack.
Thanks for the OS recommendation.
Oh, if you're interested in cameras, you should check out the side by side videos of fairphone cameras with pixels and iPhones. At least half the time, I prefer the fair phone camera shots I'm seeing.
I don't know if it's less processing or what, but something about the fair phone photos look better to me, even without umpteenth megapixel updates.
128 GB is way too small for me. I can work with it, but it's like 12 minutes of video and I take a lot of video.
7 years ago I had an oppo with their proprietary usb charging that went zero to 80 in 30 minutes and had up to four gigabytes expandable storage, I had 512 gb on there, 6gb ram.
The state of phone tech today is crazy to me, the one percent increase in CPU processing power every month means nothing to me if I can't take more than 20 minutes of HD video and edit it without the phone crashing.
Also, not really relevant, bring back front facing speakers! I want a phone with front facing speakers again so bad.
https://discuss.grapheneos.org/d/4290-sandboxed-microg/25
GrapheneOS is a bit slower due to security improvements btw. Secure app spawning and often enhanced randomization. 100% worth it though
I read about that on the graphene forum, i wouldn't mind waiting a few seconds for a higher level of security
No, not at all.
I am on Secureblue now on my Laptop, which also takes way longer to start. This is a different thing, but in general, "performance improvements" are often dangerous security drawbacks.
Like this Zygote thing in Android where all Apps share some memory parts or the layout or whatever (already forgot it) which makes them similar to each other and predictable for memory exploits.
On Linux there is something like "zero trust randomization" which increases startup time, because the OS doesnt trust the hardware to do good randomization and instead does it itself.
That quick startup on Linux and just how much faster it is in general. Then centralized OS systems is why I switched.
I've never heard of the zygote thing, it's a Android service? Or a shared Android process?
https://developer.android.com/reference/android/app/ZygotePreload
https://developer.android.com/topic/performance/memory-overview
https://medium.com/@voodoomio/what-the-zygote-76f852d887d9