Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LineageOS 18.1

lineageos.org

Post reply on HN
Print view View original

131–137 of 137 posts

Re: LineageOS 18.1

#131

Post by rwmj »

2ion wrote: post #35

Unfortunately, even if LOS supports my device (it does), it's not a viable solution anymore for me as a primary smartphone OS (even though I really appreciate some of its features -- used it for years on previous phones) due to SafetyNet. - Google Pay will stop working. - My banks' (multiple) primary apps and pushTAN solutions will stop working. and that's two of the most important things I use my phone for nowadays.…

I could be a weird outlier here, but smartphones are now cheap enough that I carry 2 (used to have 3 but I dropped one of them and smashed the screen). This means I can physically separate applications, plus run Lineage on one of them with "real" Android on the other. The newest phone I have is some Honor (Huawei) phone that cost £130.

Re: LineageOS 18.1

#132

Post by birksherty »

_e wrote: post #88
arsome wrote: post #80

Earlier quoted context omitted.

Interesting, looks like there's an Xposed solution that passes safetynet easily these days. Might have to give XPrivacyLua a proper go.

I have used XPrivacyLua for years. It is great but not perfect. Daniel Micay,author of GrapheneOS (an Android fork), pointed out some shortcomings of XPrivacyLua on reddit[0]: You do probably want the ability to force apps to see fake data, but this doesn't do that. It's a client-side check inserted into the app that the app can bypass (even unintentionally, by using a different client-side implementation) or disable…

Why does he say client side only, yes it provides fake data to apps and doesn't isolate, that's not what xprivacy says it does anyway. How is that bad? What are those ways client can easily bypass? It definitely improves privacy for me. Looks like he was promoting graphene os without giving any proper information.

Re: LineageOS 18.1

#133

Post by jeroenhd »

NotPavlovsDog wrote: post #114
Flex247A wrote: post #10

I am using an unofficial build of LineageOS 14.1 on my 6 year old tablet (Mi PAD 1 'mocha'). After using it for over a month, the ROM is amazingly stable. The earlier MiUi which the tablet shipped with (7.5.2 Android KitKat) had problems with memory management. For some reason, the 2GB RAM was partitioned into two parts, one for the OS and the other for the running apps. But LineageOS does not have this problem, and…

I have been reviewing security for unofficial builds, and it's pretty abysmal, same for GPL compliance by the ROM creators. Could you share how you reviewed security for the unofficial ROM? I'm putting a list of actions to take, but so far it appears it will take days to review ROMS, alternatively download a rom, review what is in it and build from Lineage official source, with Lineage having the better privacy recor…

I've always been wary of custom Roms that didn't come from somewhat reliable sources like the Lineage team.

The response in that Xiaomi.eu thread has seriously damaged the trust I had in the xiaomi.eu ROM. I've heard good stories about the ROM but if the community, even including a developer respond, like that to an issue like that, I don't think I can trust the website anymore, so I've blacklisted it in my pihole.

I believe custom ROMs published by what comes down to "a guy in a forum thread" are nice for proof-of-concept stuff, but should be considered insecure. Many of these ROMs disable security measures like selinux because these measures make it harder to get Android running correctly on proprietary hardware, removing one of the best security mechanisms the Android sandbox has for the developer's convenience.

I'll never recommend anything other than established brands like Lineage, /e/ or one of the security-focused ROMs to anyone. I mistakenly thought xiaomi.eu was one of the good ones, but it clearly isn't.

Do you have any other sources on popular ROMs to avoid?

Re: LineageOS 18.1

#134

Post by j1elo »

Flex247A wrote: post #129
j1elo wrote: post #123

Earlier quoted context omitted.

I'm in the same boat with my MiPad 1 Mocha! But the build of LineageOS 14.1, exactly from that forum thread you linked, was giving me some major issues: * A very bad one is that the tabled would suddenly reboot, from time to time, for no apparent reason (e.g. it might reboot just after opening the application drawer). * Even worse, using cabled headphones with the audio jack would be dangerous!! because some times a…

Hey, I deleted all the partitions of the device before flashing. Did you try flashing again? Because I did not face any such problems. Sound is a bit quieter, but that's pretty much it.

Yes, I merged the 2 partitions and also installed the binary blobs... I've been using alternative ROMs for my Android devices for some years, so I know the drill. I even tried installing a couple times, but the issues persisted.

Re: LineageOS 18.1

#135

Post by anoncake »

ddalex wrote: post #44
tumblewit wrote: post #42

Earlier quoted context omitted.

DRM is a problem everywhere including linux and running ChromiumOS. There is a protected path from the stream to the display that needs to be "certified" in order to support something like 1080p. I guess for payments it's similar. Its really unnecessary and waste of resources imo. But creators probably want some kind of assurances and so we are stuck with it.

> payments it's similar Without the protected path, how do you know that a malicious program doesn't use a low-level API to start a payment from your account without you noticing ?

The problem is that people have to run untrustworthy software to begin with.

Re: LineageOS 18.1

#136

Post by NotPavlovsDog »

jeroenhd wrote: post #133
NotPavlovsDog wrote: post #114

Earlier quoted context omitted.

I have been reviewing security for unofficial builds, and it's pretty abysmal, same for GPL compliance by the ROM creators. Could you share how you reviewed security for the unofficial ROM? I'm putting a list of actions to take, but so far it appears it will take days to review ROMS, alternatively download a rom, review what is in it and build from Lineage official source, with Lineage having the better privacy recor…

I've always been wary of custom Roms that didn't come from somewhat reliable sources like the Lineage team. The response in that Xiaomi.eu thread has seriously damaged the trust I had in the xiaomi.eu ROM. I've heard good stories about the ROM but if the community, even including a developer respond, like that to an issue like that, I don't think I can trust the website anymore, so I've blacklisted it in my pihole. I…

I'm glad that that xiaomi eu incident I shared has served as a warning for you and perhaps others, but saddened that it took place and perhaps represents the broad state of android custom ROM development.

I've avoided Android development as much as I could - it's a mess. Right now I am actively reviewing what my options are for some older hardware that I would hate to toss just because of no updates. So far I unfortunately don't have any other positive suggestions, outside of Lineage and the few software/app developers that have a serious approach to development, such as Magisk for root access.

What I have seen on XDA forums was not inspiring, unfortunately. I regret not being able to suggest anyone else, so I suppose it's the unsatisfactory general "do your own research and be extremely wary" recommendation/warning.

XDA forums even have a sticky post for developers about respecting the GPL, yet most custom ROM builders don't share code nor a build manifest nor a report of what different licensed code / binary is included in their build, thinking that linking to the original GPLd code, such as xiaomi's GNU/Linux kernel github page, is enough.

Is this a satisfactory approach to you? Let us leave out the whole "spirit of the thing" debate, Free Software etc -

knowing what code your application includes, crediting it, listing the different licenses and having a manifest of binary blobs is mandatory if not for the reason of keeping track and having a sane development workflow.

So, if the majority of the ROM developers don't do it, that is an avoid them sign to me.

Re: LineageOS 18.1

#137

Post by scintill76 »

Mediterraneo10 wrote: post #48
yaomtc wrote: post #43

Earlier quoted context omitted.

What benefit does this restrictive bank offer over, say, a credit union? Or another big bank without this app requirement?

In many countries, all banks are moving towards apps that require Google Play Services and passing Safety Net. (And a diverse ecosystem of "credit unions" is a USA-specific thing.) Banks are phasing out other means of 2FA like code cards or code calculators, and expecting all customers to have an Android or Apple phone.

I’m not sure credit unions’ tech is diverse, anyway. I’ve noticed some of their online banking sites look like different themes of the same software. So it wouldn’t surprise me if the apps are the same, so eventually the base vendor will push SafetyNet or w/e and all credit union apps will then require it.
Post reply on HN