Dated 18 January 2017, almost a year ago (but not quite long enough to add it to the title) so some info might be out of date.
Review: Copperhead OS
131–140 of 162 posts
Re: Review: Copperhead OS
#132Sometimes I am wondering what Google employees think when they read headlines like this one. I mean they probably have no problem giving the personal data to Google, but at the same time many of them are probably open source proponents and would support a world where the Google services would be entirely optional to Android. A few days ago I was thinking about a new smartphone and because my main problem with my curr…
> Sometimes I am wondering what Google employees think when they read headlines like this one. Hello Google employee here! I suspect we don't all have the same opinion but I can share my own since you asked. Note that I work in Cloud so I work in an area far far away from this stuff and opinions are obviously my own. Frankly the headline makes me a little bit sad because of course I would like to make things which pe…
Thank you for stating your opionion here.
Actually, I think removing Google services by default is not what we have in mind here. So we are okay that most users like Android as it is. Well, I think many of them just don't know which information Google collects and if they would learn about, some would not want to share that information either, but that is something everyone has to care for themselfs.
We just want the options to opt-out of every Google service easily and use alternatives (without having to flash custom roms) and to have up-to-date kernels and drivers. So having closed source drivers actually reduces the security (missing updates after a few month) and life time aspects of the product (the device). With the Android market domination Google has, it could easily force the hardware manufacturers to produce devices with open source drivers.
Re: Review: Copperhead OS
#133Earlier quoted context omitted.
> Having one OS in a "vm" on a phone sounds horrible UX wise I believe most android people are doing this with users. Since Android is now up to the task of docker (kernel 3.10+), it would be very nice to see apps sandboxed with permissions exposed via networked APIs. Then it is impossible for an app (sans exploit) to access private data, and simple for the OS to route certain apps to certain data sets (ie, fake cont…
How would your solution improve on current one, where apps are sandboxed by the permissions system and communicate via Binder which is also RPC based? You just added bunch of layers to architecture for no reason - none of serious Android exploits in years would be mitigated by your approach.
> You just added bunch of layers to architecture for no reason
The sandbox doesn't do the isolation that docker can. It uses user isolation like I mentioned. The difference is that Binder is Java on top of the kernel, while docker is isolating from the kernel itself.
Without access to the service, it is impossible, sans-kernel-exploit, to escape the permissions jail, or even tell if you are in a permissions jail if someone gives your app fake contact information by routing it to a different service.
Docker isn't perfect. It had a serious CVE recently. I'm certainly not saying it is absolutely better. I'm just saying that I think they are fundamentally different and that process level isolation is superior to user level isolation.
Re: Review: Copperhead OS
#134Earlier quoted context omitted.
By default, LineageOS does NOT include google play services. And it works just fine if you don't expect to use apps which "require" google play services.
And if you expect to use them, try microG - the free software reimplementation of Google Play Services.
Does this still require you to essentially nerf application signing in order to spoof some google play crap? If so, that's really not a viable solution.
Re: Review: Copperhead OS
#135Earlier quoted context omitted.
And if you expect to use them, try microG - the free software reimplementation of Google Play Services.
Does this still require you to essentially nerf application signing in order to spoof some google play crap? If so, that's really not a viable solution.
The newer version of signature spoofing patch (included in microG's LineageOS fork) allows you to control the spoofing and make sure that it's only used when necessary and permitted, so I'd say the answer is "no".
Re: Review: Copperhead OS
#136Any idea why all their phones are out of stock? (Are there more on the way???)
Re: Review: Copperhead OS
#137Earlier quoted context omitted.
> Sometimes I am wondering what Google employees think when they read headlines like this one. Hello Google employee here! I suspect we don't all have the same opinion but I can share my own since you asked. Note that I work in Cloud so I work in an area far far away from this stuff and opinions are obviously my own. Frankly the headline makes me a little bit sad because of course I would like to make things which pe…
You might be a Google employee, but you do not seem to be an Open source proponent. That's you prerogative, but you completely miss the point of the discussion if you ask why should users want to be independent from proprietary services. Sure, 99% don't want that and would click any colored and shiny button if it promises them a free Justin Bieber ringtone, but this is not the topic of the thread.
I prefer software that is open source. I like to contribute my time, effort, and money to open source software as well, at least that which I find useful and interesting.
I guess I'm not an open source proponent but just whatever you would call the above?
What would you consider to be an open source proponent? Someone who believes all source code should be open source?
> That's you prerogative, but you completely miss the point of the discussion if you ask why should users want to be independent from proprietary services
Well don't just leave me hanging.. what is the point of the discussion? Please do enlighten me.
> Sure, 99% don't want that and would click any colored and shiny button if it promises them a free Justin Bieber ringtone, but this is not the topic of the thread.
Isn't it? I mean the comment was literally asking for an opinion which I gave. I'm not sure I understand why this is off topic? Most businesses would be unbelievably successful if their product appealed to 99% of people.
Re: Review: Copperhead OS
#138Earlier quoted context omitted.
You might be a Google employee, but you do not seem to be an Open source proponent. That's you prerogative, but you completely miss the point of the discussion if you ask why should users want to be independent from proprietary services. Sure, 99% don't want that and would click any colored and shiny button if it promises them a free Justin Bieber ringtone, but this is not the topic of the thread.
Cloud services are probably the thing that is the farthest away from being open-source non-proprietary software... and he is working on cloud services, so I can understand where he comes from...
While I understand what you were getting at, we actually do open source some of our software as well as contribute to an early open source project so I wouldn't say it's the FARTHEST away..
Re: Review: Copperhead OS
#139I think there are some misconceptions in this thread (due to the title). Personally I use CopperheadOS as my daily driver because it stays continually ahead of Google (and groups like AOKP, LineageOS etc) in terms of Android hardening. It goes well beyond just not having Google Play services. See their details on their approach and design: https://copperhead.co/android/docs/technical_overview They make continued patc…
We've reverted the title above to the article title, since that's what the guidelines call for anyhow, unless it's misleading or linkbait. The submitted title was "Copperhead OS – De-Google Your Phone". https://news.ycombinator.com/newsguidelines.html
A brief summary of what something is can be helpful. I probably wouldn't have noticed this story if it wasn't explicitly mentioned as being about phones; I like hearing about a new OS but since I don't have the time/urge for kernel hacking I've generally stopped reading such stories.
Re: Review: Copperhead OS
#140Earlier quoted context omitted.
Does this still require you to essentially nerf application signing in order to spoof some google play crap? If so, that's really not a viable solution.
The newer version of signature spoofing patch (included in microG's LineageOS fork) allows you to control the spoofing and make sure that it's only used when necessary and permitted, so I'd say the answer is "no".
Interesting. I know the microG folks tried to upstream a patch to Cyanogenmod, which the devs shot down almost immediately.. So you're saying that the microG folks are now maintaining a fork of LineageOS? If it's not tracking VERY closely to upstream LineageOS, then it's probably not worth it.