Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CalyxOS – De-Googled Android Alternative

calyxos.org

Post reply on HN
Print view View original

431–440 of 496 posts

Re: CalyxOS – De-Googled Android Alternative

#431

Post by atatatat »

_rdvw wrote: post #80
atatatat wrote: post #77

Earlier quoted context omitted.

Very cool! Few quips: Silence was last updated (on F-Droid) a year ago — is this project secure//being maintained? & Mozilla-cousin browser: you're going to lose the security clout these days unfortunately.

Silence is sadly no longer maintained, but it still seems to work for now. I will eventually replace it. Re Mozilla: I do state on my browser comparison page that Chromium browsers are more secure. Also the Bromite repository is included in F-Droid by default on DivestOS.

Very cool!

Thanks for stopping in here!

Re: CalyxOS – De-Googled Android Alternative

#432

Post by joemazerino »

chrisco255 wrote: post #185
oh_sigh wrote: post #182

Earlier quoted context omitted.

Many people run their entire lives off of their phones. Being concerned about security is prudent, not depressing.

Open source software has a better security track record than closed source software run by billion dollar corps.

Does it though? Have you looked at the vast number of vulnerabilities introduced into the Linux kernel in the last 3 years?

Re: CalyxOS – De-Googled Android Alternative

#433

Post by cdesai »

codetrotter wrote: post #418
danvittegleo wrote: post #363

Earlier quoted context omitted.

I investigated EBS snapshot as an option, but there were two problems. 1) cost as i mentioned initially - for just AOSP source tree alone you are looking at > 250GB and at a cost of $0.05 per GB you are already at > $10/month and 2) EBS snapshots lazy load from S3 which gives TERRIBLE performance which means you end up with far far slower builds. AWS released a feature "EBS Fast Snapshot Restore" to workaround this i…

Are you doing partial clone? https://source.android.com/setup/build/downloading Although, an answer at https://stackoverflow.com/questions/33053615/how-to-download... from October 2020 says that even a partial clone is still 73 GB in size!? That’s insane! How the heck come it’s so big?

That's likely the size of the entire checked out tree, which would include all of the files.

I just ran the command here and my AOSP 11.0 checkout is 54GB, minus any git history, since I clone from a local mirror and use '--reference' to avoid having to copy objects.

A lot of the size here is from the various prebuilts, AOSP build is quite self-contained (jdk, clang, etc) and barely uses anything from the host.

Re: CalyxOS – De-Googled Android Alternative

#434

Post by luca020400 »

entropy1111 wrote: post #425
luca020400 wrote: post #378

Earlier quoted context omitted.

Privacy Guard) I was the one who purposely removed it. I spent days ( if not weeks ) trying to get it working properly ( read, it never worked properly and causes many issues we still have tickets for ) futhermore Google basically rewrote the full stack once again, while introducing the, now publicly available in 12, permission hub that somehow gave a better view of permissions and easy access to remove them. We know…

>Privacy Guard) I was the one who purposely removed it. I know that but it was the main selling point of the ROM for me. Also that I didn't even need a firewall because you could block network access. >SafetyNet I was commenting from the POV of a user who needs apps that demand SafetyNet access. You're right. >Bribing I was talking about ROM developers on e.g. XDA, not LineageOS the "company".

1) You can still block network via a native firewall ( it's in app settings ), currently the only issue is that network via VPN bypass the toggle.

3) Never heard of this happening, and I've heard a lot of stuff.

Re: CalyxOS – De-Googled Android Alternative

#435

Post by cdesai »

joecool1029 wrote: post #266
cdesai wrote: post #212

Earlier quoted context omitted.

I've said this in another comment, but I'll duplicate here: The microG creator goes into more detail about signature spoofing at https://github.com/microg/GmsCore/issues/1467#issuecomment-8... The concerns usually raised against that are due to the "default" patch included in their repository, which has a specific purpose. We don't use that, https://calyxos.org/about/tech/microg/ are the precautions we take to try an…

Making it system-only still isn't ideal. It then requires a full OS update to push updates to microg/playservices, cannot just update the app components if vulnerabilities are found in the wild. I would like if there was stronger privacy laws or antitrust orders that force Google to open their service provider API's so people can choose alternative location/push providers, but this doesn't seem like it will exist soo…

> Making it system-only still isn't ideal. It then requires a full OS update to push updates to microg/playservices

It does not, you can update system-apps out of band just fine.

Google does it with Play Services (and many other apps), and we have our microG builds in our F-Droid repos for out of band updates.

In fact, that is one of the big selling point of Play Services - the fact that it gets updated outside of OS updates, which means that you have a recent / the latest version on all devices regardless of their update record.

And therefore anything implemented in Play Services can be used even on older Android versions.

Re: CalyxOS – De-Googled Android Alternative

#436

Post by cdesai »

strcat wrote: post #321
vngzs wrote: post #171

Earlier quoted context omitted.

GrapheneOS, lacking MicroG in the default install, is therefore more private than CalyxOS. Keeping Google out of the loop entirely is necessary for true privacy.

GrapheneOS doesn't ship integration of proprietary services like CalyxOS, whether that's WhatsApp or Google services. GrapheneOS does have https://grapheneos.org/usage#sandboxed-play-services providing a way to use Play services in a sandbox with zero special privileges. This doesn't provide Play with any access beyond what it has in the client libraries within apps using it. Many of those client libraries aren't sim…

I did not want to get into this, but you're simply spread falsehoods.

> GrapheneOS doesn't ship integration of proprietary services like CalyxOS, whether that's WhatsApp or Google services.

We do not ship anything proprietary. We ship microG, which is "A free-as-in-freedom re-implementation of Google’s proprietary Android user space apps and libraries." - see https://microg.org/

We ship an integration with WhatsApp in the Dialer, which is entirely open source code. It is based on the existing contacts mechanism (anyone who has WhatsApp or Signal on any Android will see entries for those in the Contacts app - that is what we expose to the Dialer to make it easy to use those to make end-to-end encrypted calls.

In fact, WhatsApp is not listed by default, it only shows up if you have it installed. We believe that end-to-end encrypted calls are important, and while this would leak some metadata, if one has it installed already presumably they're fine with that. The network effect is strong!

In fact, you're the one who's promoting your approach of being able to run the proprietary Play Services - and yet you say you don't ship integration of proprietary services. Which is it? You can't ship Play Services legally anyway.

> or example, they give special unattended installation privileges to Aurora Store and F-Droid.

Aurora Store does not get unattended installation permission, it never has. It can only update installed apps, which is what Google is allowing in Android 12.

F-Droid Privileged Extension is extended, and both that and F-Droid have received security audits in the past which haven't found issues - and the Privileged Extension itself hasn't changed much since then. We're very careful about making any changes there.

It is one thing to give constructive criticism to projects, it's another to attack them directly based on falsehoods.

Re: CalyxOS – De-Googled Android Alternative

#437

Post by cdesai »

strcat wrote: post #326
cdesai wrote: post #180

Earlier quoted context omitted.

On CalyxOS you do get an option to disable microG when setting it up for the first time, see https://calyxos.org/features/microg/#1-microg-disabled microG being disabled but present is still enough for some apps to work, which makes sense given that you can disable Google Play Services on the stock OS.

GrapheneOS has https://grapheneos.org/usage#sandboxed-play-services so our users have the option to use Play services too, in a way that will provide more functionality and avoids losing the security checks and key pinning that are missing in microG. We'll be making it easy for users to install via our app repository rather than bundling Google services in the OS. Google's Play client libraries are still used on Caly…

> Google's Play client libraries are still used on CalyxOS by the apps using Play services.

They'd also be used on GrapheneOS, and anywhere else basically.

> WhatsApp is clearly a proprietary service too, and CalyxOS is integrating that into the Dialer app.

The integration is entirely done into the open source Dialer app and generic enough that it could be extended to any apps that have phone numbers. Signal and WhatsApp are simply the most popular amongst those.

Re: CalyxOS – De-Googled Android Alternative

#438

Post by cdesai »

strcat wrote: post #317
_abox wrote: post #76

Earlier quoted context omitted.

Yeah GrapheneOS is security over privacy, Calyx is privacy over security (and has a bit more mainstream appeal with MicroG, supporting push messaging and location services etc). GrapheneOS has also pioneered a lot of security measures, a lot of which have been added to Android proper (if you see their feature log, a lot of it says "removed because it was introduced in Android"). I wonder if that wouldn't have been th…

> Yeah GrapheneOS is security over privacy No, GrapheneOS is heavily focused on both privacy and security. See https://grapheneos.org/features for a list of the enhancements compared to the latest Android Open Source Project. GrapheneOS offers substantial privacy advantages over CalyxOS. It has a bunch of nice privacy improvements, carefully designed to work against real adversaries. Bypasses of privacy features are…

> They present it as a firewall app with a fancy name, but it's just a UI for the AOSP firewall and it doesn't really work as they present it.

There is no AOSP Firewall, this is all based on code which originated in LineageOS, and we've been maintaining and extending it since about a year now. We make changes, send patches back upstream (LineageOS), and are talks in that developer.

The bypass is serious, we're looking into it and will have a working patch available shortly. It will work.

We do not muck around with the INTERNET permission and change the android permission model since that has known to crash apps, we did evaluate it before putting effort into this.

The beauty of doing this network side is that apps are unaware and keep working, unlike some apps which crash when you take away their INTERNET permission - that is why we didn't go with that approach.

What use is a toggle if it crashes the app and makes it unsable.

> The fastboot.js library powering it is a project we funded.

Thank you for funding that!

Re: CalyxOS – De-Googled Android Alternative

#439

Post by cdesai »

GekkePrutser wrote: post #402
strcat wrote: post #323

Earlier quoted context omitted.

> Calyx has more focus on functionality and privacy rather than security. That's not true. GrapheneOS is heavily focused on privacy and offers much better privacy than CalyxOS. See https://grapheneos.org/features for the privacy and security features offered beyond AOSP. Unlike CalyxOS, we aren't listing AOSP features as our own. CalyxOS has a leaky firewall which apps can bypass and a leaky VPN tethering implementat…

Like I said in my post below I didn't mean to attack you. I don't even use either Calyx nor GrapheneOS. > That's not true. GrapheneOS is heavily focused on privacy and offers much better privacy than CalyxOS. See https://grapheneos.org/features for the privacy and security features offered beyond AOSP. Unlike CalyxOS, we aren't listing AOSP features as our own. I simply wanted to explain that you will always pick the…

> Does Calyx really include WhatsApp out of the box? That would indeed be a very negative point for me. As I mentioned I haven't used either.

We do not, we would never ship a proprietary app like that.

What we have is a small patch to the open source Dialer / Phone application that lets you make WhatsApp calls directly.

It only shows WhatsApp as an option if you have it installed already, if you don't you won't see it, we don't want to promote using proprietary services.

This was done after a lot of back and forth with our UX team.

Re: CalyxOS – De-Googled Android Alternative

#440

Post by cdesai »

strcat wrote: post #395
commoner wrote: post #329

Earlier quoted context omitted.

While I really appreciate your work on GrapheneOS (and I will be checking out the sandboxed Google Play Services feature), I don't think it's very good form to heavily promote your OS in a discussion about a different OS, especially in such an adversarial way. There's room in the FOSS space for both GrapheneOS and CalyxOS.

Please look at the comments being replied to from that user in this thread. They're spreading misinformation about GrapheneOS in order to promote CalyxOS. This isn't something isolated but rather than community is highly hostile towards our project and has been heavily involved in harassment of our developers, raids on our community and coordinated spreading of misinformation. Every time GrapheneOS or CalyxOS is ment…

I specifically avoided commenting on the comparison threads solely to not have to see this. You will not find me doing that anywhere, anytime (unless perhaps when we were on good terms)

I've done that all this time, the only time I comment on something is when somebody asks us to integrate it into CalyxOS, and that's only within our context.

You're the one here who're responding in a hostile manner, and doing exactly what you're accusing us of. Please stop.

Post reply on HN