Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CalyxOS – De-Googled Android Alternative

calyxos.org

Post reply on HN
Print view View original

161–170 of 496 posts

Re: CalyxOS – De-Googled Android Alternative

#161

Post by grifball »

natpalmer1776 wrote: post #115
Koshkin wrote: post #93

Earlier quoted context omitted.

Don't privacy and security go hand in hand?

I think the distinction is such that with a private (but not secure) application, the only person getting my data is a malicious actor. With a secure (but not private) application, the only person getting my data is the owner of the code & anyone they are willing to share it with (Governments, Ad-tech, etc.) So if your hard requirement is 'nobody can know anything about what I do with this software' you are correct.…

Yeah. Mostly, the difference is whether you're protecting against big tech or smaller hackers.

The only other difference is that computersecurity also protects your computer as a resource say against mining trojans.

Re: CalyxOS – De-Googled Android Alternative

#162

Post by WorldPeas »

vbsteven wrote: post #113

I’m thinking about buying a degoogled Android phone to replace my iPhone. The main things I want are: * Spotify needs to work over Bluetooth in my car * WhatsApp needs to work (preferably with push notifications) * I need the Fitbit app to work so my watch can show push notifications from my personal apps * a network-based location provider to be consumed by my personal apps (I’m working on a personal data and automa…

heres what i do and it works great: use the regular google build of android BUT on a fresh install, disable all google apps sans chrome, use it to install fdroid, then uninstall that, from there use TrackerControl to prevent google and others from phoning home, use the aurora store for apps, use organicmaps for maps, signal for sms florisboard for keyboard, etc. you'll have a google-free experience which you can exit for 10 minute periods using the button on the trackercontrol dialog, and things like google pay and notifications will still perform quite well. I've been using this for a year and loving it

Re: CalyxOS – De-Googled Android Alternative

#163

Post by chme »

corty wrote: post #127
Koshkin wrote: post #93

Earlier quoted context omitted.

Don't privacy and security go hand in hand?

No. First, there are security measures that wreck privacy, e.g. sending all your data to some company's servers for virus scanning. Routing all your traffic through some filtering VPN provider. That kind of stuff. There are privacy measures that wreck security, e.g. not using personalized user accounts for certain things. Security is also mostly up to definition, a secure computer system is a system that only does wh…

> No. First, there are security measures that wreck privacy, e.g. sending all your data to some company's servers for virus scanning. Routing all your traffic through some filtering VPN provider. That kind of stuff. There are privacy measures that wreck security, e.g. not using personalized user accounts for certain things.

Aren't those examples more examples of bad security by introducing single points of failure?

Re: CalyxOS – De-Googled Android Alternative

#164

Post by throwaway888abc »

_abox wrote: post #82
nextos wrote: post #74

Earlier quoted context omitted.

How does CalyxOS compare to GrapheneOS?

Calyx has more focus on functionality and privacy rather than security. On Graphene, security is always priority #1. For example: Calyx provides MicroG. This means you can talk to Google Play services, though in a better, more privacy-conscious way. MicroG is an open implentation of Google Play Services. However, MicroG requires signature spoofing: You need to install a fake Google certificate so that it can trick of…

> you don't get push messages and network-based location checks, among others.

This should be advertised as major feature.

Re: CalyxOS – De-Googled Android Alternative

#165

Post by LukeShu »

cdesai wrote: post #156
LukeShu wrote: post #155

Earlier quoted context omitted.

You actually couldn't do that with the original Pixel (which until recently, Android 11, these custom derivatives tended to support). You'd get a warning screen every boot about how the OS has been modified.

You definitely could, we used to support it in a previous iteration. This was also possible on the Nexus devices, although the oldest I've tried it is the Nexus 6P. It just worked slightly differently on those, nowadays you enroll the public key by flashing it to the device, on those (Pixel 1, Nexus) you used to have the public key embedded in the kernel.

Unless I'm mistaken, the Pixel 1 blindly accepts whatever pubkey is embedded in the kernel, but displays the warning screen on boot if it's not Google's pubkey (to clarify, not a click-through screen, just a temporary splash screen). I guess yeah it's technically Verified Boot, but if it just accepts any key you throw at it, then the security guarantees are a lot less. You can't tell it about your pubkey to get the scare screen to go away, and you can't tell it to block other keys to get the security guarantees.

Re: CalyxOS – De-Googled Android Alternative

#166

Post by vngzs »

fitblipper wrote: post #28

The thing which always makes me hesitant about these projects is that they don't receive frequent security audits and not having an expensive brand behind them makes them more at risk to being willing to trash their name at the cost of my privacy and security. I consider these to be a fairly critical part of any project which claims superior privacy and security. I think about it this way: Should I trust A. The compa…

I know people who made it to the final rounds of interviews at Calyx. They are the real deal. I don't think much of anything could get them to compromise their values about privacy [0].

Might they miss something because they're a smaller team? Yeah, maybe. Will they sell out? I don't think so.

[0]: https://en.wikipedia.org/wiki/American_Civil_Liberties_Union...

Re: CalyxOS – De-Googled Android Alternative

#168

Post by prox »

hadrien01 wrote: post #116
vbsteven wrote: post #113

I’m thinking about buying a degoogled Android phone to replace my iPhone. The main things I want are: * Spotify needs to work over Bluetooth in my car * WhatsApp needs to work (preferably with push notifications) * I need the Fitbit app to work so my watch can show push notifications from my personal apps * a network-based location provider to be consumed by my personal apps (I’m working on a personal data and automa…

For you first two questions: Spotify will work with Bluetooth, and WhatsApp will have eventual notifications (real-time if the app was recently opened, up to seven hours later otherwise, at least on my device)

If you degoogle yourself but then hook into FB whatsapp, isn’t that just defeating a bit of the point?

Re: CalyxOS – De-Googled Android Alternative

#169

Post by botwriter »

vngzs wrote: post #166
fitblipper wrote: post #28

The thing which always makes me hesitant about these projects is that they don't receive frequent security audits and not having an expensive brand behind them makes them more at risk to being willing to trash their name at the cost of my privacy and security. I consider these to be a fairly critical part of any project which claims superior privacy and security. I think about it this way: Should I trust A. The compa…

I know people who made it to the final rounds of interviews at Calyx. They are the real deal. I don't think much of anything could get them to compromise their values about privacy [0]. Might they miss something because they're a smaller team? Yeah, maybe. Will they sell out? I don't think so. [0]: https://en.wikipedia.org/wiki/American_Civil_Liberties_Union...

People always say this until CP is put on their computer by an intelligence agency and they don't want to go to prison as a child abuser... Who's going to believe a pedo anyway...

Re: CalyxOS – De-Googled Android Alternative

#170

Post by vbsteven »

_1 wrote: post #158
vbsteven wrote: post #140

Earlier quoted context omitted.

Is there a specific reason for this? Does the Fitbit app rely on Play Services? I don’t care too much for on wrist calls or anything like that. I just want to use the Fitbit app to sync stats and mostly display notifications from WhatsApp and my personal apps.

I don't know how the app works under the hood, but Google owns Fitbit

I should have know that. Now I understand what you meant in your first comment.

As long as the app doesn’t rely on Play Services it shouldn’t be a problem. By “degoogled” phone I mostly mean taking Google out of the critical (privileged) path in the OS for software and app updates.

Post reply on HN