> Going to simply interpret this as unhelpful sarcasm.
I think it is helpful to convey the emotion that goes through me when I read such a remark.
> It includes a compatibility layer for users to run it in the full, strictest API 32 app sandbox with all the standard GrapheneOS enhancements.
How does it handle Doze? In original Android, no app is allowed to keep a TCP connection open forever. And without that, FCM is useless. Also I believe that having Google Play Services running permanently has an impact (more on that later in this comment)
> You can see for yourself that the full featured Google Maps app completely works without Google Play, and that their Ads SDK and other libraries work without it.
That's an interesting point, thanks, I'll probably spend some time exploring those things. That Google garden does such things doesn't really surprise me.
> Only apps using the Lite variant of the Ads SDK need Google Play services for it to work.
From the description of Lite Ads SDK, it sounds like something that every app developer should want, yet it looks like Google is down-publicizing it a lot, so noone actually use it, nice workaround from Google, thanks for the info.
I see you're focusing your whole speech on Ads SDK. Does it mean only the ads SDK has this behavior?
My personal use of microg is for apps I trust (mostly opensource, or where I'm a paying customer), which work (much) better with cloud messaging. (I have to admit, I trust those apps enough to know they don't have ads, but not enough to trust they don't have ads sdk). So I do believe that for my usecase, microg gives me a much better privacy than Play Services, because most apps won't contain the infinite list of trackers Google Play Services include. But if you have proofs of otherwise, please do enlighten me, you're more knowledgable than me on SDKs.
FWIW, I have one metric (a rather stupid one, I agree) which is IMO showing that there is a huge difference: the data transferred and the battery usage. I have an order of magnitude difference in data transferred, and I get at least 3 times more battery life in suspend. Which IMO definitely highlights the fact that Google Play Services running permanently has its own privacy impacts, even when giving them minimal permissions.
> CalyxOS doesn't simply include microG with users encouraged to use it. They use Google services by default, with no way to turn them off.
"Google services" are 100MB+ proprietary code, sending god knows what to Google. CalyxOS doesn't have 100MB+ proprietary code, with microg you exactly know which data is sent. And actually if I'm not mistaken, microg doesn't do google registration or cloud messaging by default, so I don't think it does any Google connection by default? I'm not exactly sure there. I'm sure cloud messaging is disabled by default though, so no permanent connection
> They recently went almost 4 months without shipping the browser or Android security updates, including multiple vulnerabilities caught being exploited in the wild and announced as such in bulletins.
Just like the biggest (or maybe second or third, I don't really track that) corporation in the world on their flagship, while they are 50000 times smaller? But anyway, you're right: again, I said that on security grounds, I'd always pick GrapheneOS, and that the relation between privacy and security is pretty complicated, and I understand that some privacy threat models requires stronger security than trust.
----------------
Edit: Removed this part which is no longer relevant.
> They significantly roll back the security model of the OS.
I'm guessing you're speaking of microg implementation when you say "roll back the security model". I'm curious why you didn't answer to the comment where I ask to point out precisely how that roll backs the security model.