Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android/Linux Dual Boot

wiki.postmarketos.org

Post reply on HN
Print view View original

121–130 of 169 posts

Re: Android/Linux Dual Boot

#121

Post by palata »

seba_dos1 wrote: post #118
tom_alexander wrote: post #74

Earlier quoted context omitted.

Could you be more specific on how to circumvent the android permission model + sandbox? So far I have only thought of two ways an XZ-like backdoor could circumvent that: 1. By being baked into the OS itself, which is unavoidable since the OS is the thing providing the sandboxing + security model. It still massively reduces the attack surface. 2. By being run through the android debug bridge, which is far from normal…

The defining aspect of the XZ backdoor was that it was baked into the OS itself, being linked into memory space by about half of the system and activated by being packaged in a specific way in a specific distribution. If you wanted to ignore 1), you would have to choose a different example. If you want to confine yourself in a sandbox, feel free to do it. The past decades have demonstrated that it's only necessary fo…

> If you want to confine yourself in a sandbox, feel free to do it.

I want to confine apps in a sandbox. Android has that, Linux... well not really. I mean "it's possible", but it's not integrated like in Android.

Re: Android/Linux Dual Boot

#122

Post by raw_anon_1111 »

AdmiralAsshat wrote: post #111
embedding-shape wrote: post #95

Earlier quoted context omitted.

My first encounter with "sideloading" I think was loading up a MP3 player with music, for some reason that was called "sideloading" by some people. In that case, "sideloading" was just transferring basically, nothing about installing. But once Android appeared, and there was one Google-approved way of installing applications (Google Store) and one way of installing directly from .apk after enabling "Unknown Sources",…

> My first encounter with "sideloading" I think was loading up a MP3 player with music, for some reason that was called "sideloading" by some people. In that case, "sideloading" was just transferring basically, nothing about installing. Probably influenced by the original iPod, which really wanted you to sync your iPod with your iTunes library (conveniently directing you to purchase all of your music from Apple's pla…

Well actually..

Steve Jobs himself said in his famous “Thoughts on Music” letter that was posted on the Apple home page that less than 10% of users music on iPods were bought from iTunes.

> Probably influenced by the original iPod, which really wanted you to sync your iPod with your iTunes library (conveniently directing you to purchase all of your music from Apple's platform).

iTunes (the software) came out before the iTunes (the music store) and iPods and Apple actually marketed the iMacs as “rip mix burn”.

Re: Android/Linux Dual Boot

#123

Post by jstanley »

Ghoelian wrote: post #31
dugite-code wrote: post #16

Earlier quoted context omitted.

I really wanted to like Graphene OS but I ended up bouncing off it due to a few major pain points that badly effected battery life. - Using the default 5g setting resulted in far worse battery life than stock, telling people to choose 4g isn't a solution. They desperately need something like the adaptive connectivity service. - Using Homeassistant's GPS tracking feature just destroyed the battery life, even switching…

I don't recognise the 5g battery life issues personally. I do 100% agree the GPS thing is such a bad decision. It just becomes noise that no one pays attention to anymore. I ended up using my public ip address in combination with a list of known ips for home and work and such, and building my HA automations around that. I wanted to do it with wifi SSID's, but that also requires the location permission and triggers th…

> I do 100% agree the GPS thing is such a bad decision. It just becomes noise that no one pays attention to anymore.

It's not noise for me, I only ever have GPS on for Google Maps, and I like the indicator because its absence reassures me that nothing is using GPS in the background.

Re: Android/Linux Dual Boot

#124

Post by raw_anon_1111 »

devsda wrote: post #112
cbolton wrote: post #82

Earlier quoted context omitted.

It's bypassing the usual channel for app installations, so the term is technically fitting and the loaded meaning is also appropriate since it's mostly used by nerds (maybe too strong a word) and bad actors. There are legitimate uses of sideloading for regular users, for example if you have solar panels that work with a Huawei app, they can't put it on the Play store because of US sanctions. But that's not Google's f…

> that does mean the app is more risky since it's not monitored by Google. Why is Google the arbitrator of risk here ? As a user I'm capable of assessing the risk directly or indirectly by delegating that responsibility to another store or another program a.k.a anti-virus programs, its my choice in the end. I want Google to build software like Windows Defender and allow others to build similar software. I want the ab…

Yes because that has worked really well in the history of PCs with malware, bundleware, ransomware, etc

Re: Android/Linux Dual Boot

#125

Post by raw_anon_1111 »

charcircuit wrote: post #20
MYEUHD wrote: post #14

Earlier quoted context omitted.

> That's already happening today. That's not a hard fork. They always rebase on top of AOSP when there's a new AOSP source release

It doesn't have to be. Most of Android is fine.

Outside of China, to a first approximation no one once to use an Android device without Google Play Services.

Re: Android/Linux Dual Boot

#126

Post by charcircuit »

realusername wrote: post #116
palata wrote: post #94

Earlier quoted context omitted.

I actually wonder: if Google stopped pushing to AOSP and "the community" had to fork... the whole Android SDK/NDK is not open source, so I wonder if AOSP could survive at all without Google, even though it is open source.

I think if Google would stop pushing AOSP, there's a very high risk for Google that a consortium of manufacturers would continue themselves as they need it and they would lose control.

I think that is unlikely reality because from manufacturers perspective they don't get AOSP from the public. They get it from their chip provider like Qualcomm who gets private releases from Google. Everything is already set up such that people aren't using the public version, so the more likely reality is that the public version goes away, and google partners keep doing what they are doing. Maybe things are different on the Chinese side of things. So if it were to be created, it would be over there.

Re: Android/Linux Dual Boot

#127

Post by ysnp »

ianso wrote: post #102

I think this stuff is super important, simply because there is a ton of stuff we can't do using our phones today. Think mesh networking, resilient ad-hoc application clustering, non-Internet P2P, like Freifunk but everywhere. We shouldn't have to depend on Google or any of the big tech companies for anything except the hardware. That would offer much more freedom. There are also contexts where this kind of thing coul…

>Think mesh networking, resilient ad-hoc application clustering, non-Internet P2P, like Freifunk but everywhere.

(if dumbed down) What's are the gaps in features and functionality between what you're describing and what might be achievable today (given enough software glue) with an SDR transceiver and something like Reticulum [1] on an Android?

Re: Android/Linux Dual Boot

#128

Post by greentea23 »

Scene_Cast2 wrote: post #90

My biggest worry is that it's harder and harder to find a phone with an unlockable bootloader.

Lineageos maintains a list and you can filter for devices with official bootloader unlock https://wiki.lineageos.org/devices/. Buy only these devices to signal to these companies that this matters.

Noteably OnePlus 13 and Pixel 9a, both 2025 phones, can be unlocked.

Re: Android/Linux Dual Boot

#129

Post by charcircuit »

seba_dos1 wrote: post #53
charcircuit wrote: post #26

Earlier quoted context omitted.

At least in regards to the security model, it is decades out of date. For example any app can listen to your microphone and spy on you at anytime. Programs can act as ransomeware or destroy all of your files. Stealers can steal your login credentials and access tokens for all your sites including banking ones.

...except in virtually any case where you'd run something untrusted there you'd use Flatpak or something similar where what you wrote doesn't apply.

>where what you wrote doesn't apply

You can configure your flatpak app so that it will have permission to read microphone in the background or have full access to the disk. Many flatpaks of real apps request dangerous permissions that users have been conditioned to ignore. For example Blender is such an app which has full disk access and background microphone access, and I'm sure many people have installed that. This is unlike Android where these are locked down for every app.

Re: Android/Linux Dual Boot

#130

Post by eikenberry »

zorked wrote: post #32
charcircuit wrote: post #26

Earlier quoted context omitted.

At least in regards to the security model, it is decades out of date. For example any app can listen to your microphone and spy on you at anytime. Programs can act as ransomeware or destroy all of your files. Stealers can steal your login credentials and access tokens for all your sites including banking ones.

I think people don't realize how inadequate the Unix security model is.

Linux doesn't solely rely on the Unix security model. Linux security is mostly based on trust, the trust of the distribution and its maintainers. But if you want to run random, untrusted apps you'll want a different model. Linux is slowly addressing that need w/ a variety of different approaches which could be picked up and used for a mobile OS.
Post reply on HN