Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android Developer Verification: Threat masquerading as protection

f-droid.org

Post reply on HN
Print view View original

691–700 of 793 posts

Re: Android Developer Verification: Threat masquerading as protection

#691

Post by baranul »

janvlug wrote: post #530
sambuccid wrote: post #130

It doesn't solve the current issue, but in case we don't manage to push back on this, some people might not know that there are various actual linux OSes for mobile: - SailfishOS: still linux based and seems fairly community inclusive, but the UI part of the stack is closed source. Is the only one officially allowed to run android apps, via emulation. Has existed for a very long time, it's lightweight and I think the…

I'm using a Librem 5 as my daily phone. PureOS is actively developed and based on Debian. Monthly development updates are published here: https://puri.sm/posts/tag/advanced-readers/ Personally, I do not use Android apps on the Librem 5, but Waydroid is available in the PureOS repository. Waydroid is a container-based approach to boot a full Android system on regular GNU/Linux systems running Wayland based desktop env…

The way out is for people to support the various Linux phones. These Linux distros need to support and push Android compatibility, so that people can load F-Droid, Aurora, and Obtainium on them and get most of the Android apps they want. The ability to use both Linux and Android apps should satisfy nearly everyone. A strong message of consumer defiance needs to be sent.

Re: Android Developer Verification: Threat masquerading as protection

#692

Post by HybridStatAnim8 »

baranul wrote: post #691
janvlug wrote: post #530

Earlier quoted context omitted.

I'm using a Librem 5 as my daily phone. PureOS is actively developed and based on Debian. Monthly development updates are published here: https://puri.sm/posts/tag/advanced-readers/ Personally, I do not use Android apps on the Librem 5, but Waydroid is available in the PureOS repository. Waydroid is a container-based approach to boot a full Android system on regular GNU/Linux systems running Wayland based desktop env…

The way out is for people to support the various Linux phones. These Linux distros need to support and push Android compatibility, so that people can load F-Droid, Aurora, and Obtainium on them and get most of the Android apps they want. The ability to use both Linux and Android apps should satisfy nearly everyone. A strong message of consumer defiance needs to be sent.

The Android family of operating systems and the forks made from the android open source project are all linux distributions, and linux phones.

Using desktop linux phones and trying to force that as a norm would set privacy and security back substantially.

The inverse of what you suggest, which is Android with desktop linux app compatibility, would be a huge step forward, and is already much closer than you might think.

Modern phones have substantially better VM support in the hardware than in previous models, and it is maturing at a very fast rate. We would be able to run linux VMs on Android, paired with desktop mode, with evidence for USB passthrough for an externel GPU in AOSP

There is also evidence that we will be able to put desktop linux app icons on the Android homescreen and using them in an app-like fashion.

This would use the more secure host to run the VM for the less secure OS.

Re: Android Developer Verification: Threat masquerading as protection

#693

Post by cromka »

HybridStatAnim8 wrote: post #551
cromka wrote: post #516

Earlier quoted context omitted.

Why don't they support Fairphone and Nothing, then?

These devices fall far behind the industry standard hardware security requirements GrapheneOS has.

Wasn't it just explained they meet the criteria?

Re: Android Developer Verification: Threat masquerading as protection

#694

Post by cromka »

green7ea wrote: post #634
cromka wrote: post #42

Earlier quoted context omitted.

Those reasons are explained clearly and openly. Ironically, your /o/OS is way less open than GOS on Google hardware.

How is /e/ less open than Graphene? As far as I understand, they are both pretty open minus firmware that they can't control? I'm actually curious if there's something I don't know about /e/

Others explained it in this thread already

Re: Android Developer Verification: Threat masquerading as protection

#695

Post by HybridStatAnim8 »

cromka wrote: post #693
HybridStatAnim8 wrote: post #551

Earlier quoted context omitted.

These devices fall far behind the industry standard hardware security requirements GrapheneOS has.

Wasn't it just explained they meet the criteria?

Fairphone and Nothing do not come anywhere close to meeting the criteria for GrapheneOS device support.

Re: Android Developer Verification: Threat masquerading as protection

#696

Post by tsoukase »

Let's see some points:

1) side loading, or however it's called, is used by less than 1-2% of global Android users (we can't be more than 50 million). Google made us a favor leaving it open after an only 24h delay. It could be much worse but now it's nothing in our eternal tinkering with developer options. Thank you from me Google.

2) GMS is a huge convenience for any app developer that needs tight control, including governments. They can secure their apps against users of any hat color. Add to that the possibility of hidden backdoors to support surveillance and Google's direct lobbying in EU. This makes it very difficult to go without it, even under the current anti-US EU direction and it will be the last that will be replaced in Europe.

3) There are various levels of "degoogling". From installing a totally open OS without or with microG, to just don't login to a Google account in stock Android. It's a spectrum but someone at the free edge will never have the same rights with one in the jailed edge.

4) Developer verif is NOT to prevent ad blocking. There is a simple and free method to block anything you like at DNS level: just select Private DNS and insert an appropriate URL for ads/trackers/porn etc, eg from controld.com. Find some other justification, like tight user control to continue sleeping with the governments or reach ultimate user surveillance with the upcoming children ident.

Re: Android Developer Verification: Threat masquerading as protection

#697

Post by kuschku »

HybridStatAnim8 wrote: post #688
kuschku wrote: post #686

Earlier quoted context omitted.

> You would install your own build of GrapheneOS. Not the official images. Awesome, so you're advising against installing GrapheneOS for anyone that wants control over their own data. Sorry for twisting the words slightly, but that's the essence of the issue here, isn't it? > Its not advisable to run anything as root, at all. Or expose access to it in any form. And then you advise for exposing access to it in pretty…

No, official GrapheneOS is an ideal method to control data. As a part of this, they also provide build documentation for whatever you want to do. It is FOSS, after all. To be clear, I am NOT advising root access. I am not contradicting myself. I am telling you it is dangerous but still telling you how it can be done in a less terrible way. To withhold that info would be senseless gatekeeping. GrapheneOS supports bein…

So let me get this straight.

An app developer getting access to send my files to a random server somewhere? That's just a simple permission prompt, no unlock needed.

But me getting access to my own files? That's an absolute no-go. Even with adb and unlock, absolutely impossible

Seriously, you need to explain the difference. Because I don't see how apps being a one-way street (they can access my data, but I can't access theirs) is in any way reasonable.

Re: Android Developer Verification: Threat masquerading as protection

#698

Post by qsxfthnkp2322 »

grapheneos wrote: post #663
qsxfthnkp2322 wrote: post #658

Earlier quoted context omitted.

The amount of work that goes into tracking you is insane

It's not accurate, see https://news.ycombinator.com/item?id=48767176 .

Thank you for everything you all do. I recently installed graphene for the first time two weeks ago. :)

Re: Android Developer Verification: Threat masquerading as protection

#699

Post by kuschku »

armadyl wrote: post #660
kuschku wrote: post #625

Earlier quoted context omitted.

If I hand my windows laptop to someone, they can also install a keylogger. But no one said we have to copy that flawed concept. macOS and Linux already have a good solution, requiring your full unlock password in a privileged dialog to authorize changes. It's ridiculous that changing the settings on my device is protected 10× more than transferring all my money to a random person.

> But no one said we have to copy that flawed concept. macOS and Linux already have a good solution, requiring your full unlock password in a privileged dialog to authorize changes. You use operating systems that have significantly worse security than GOS, iOS and even stock Android as your examples? Also you literally are the owner with GrapheneOS, lacking security is not "full ownership." You can create your own bu…

Even in your flawed analogy, I can stop at any time and adjust my wheels. Without losing the contents of my trunk.

Re: Android Developer Verification: Threat masquerading as protection

#700

Post by unknownfuture »

tsoukase wrote: post #696

Let's see some points: 1) side loading, or however it's called, is used by less than 1-2% of global Android users (we can't be more than 50 million). Google made us a favor leaving it open after an only 24h delay. It could be much worse but now it's nothing in our eternal tinkering with developer options. Thank you from me Google. 2) GMS is a huge convenience for any app developer that needs tight control, including…

> 1) side loading or however it's called is used less than 1-2% of global Android users (they can't be more than 50million). Google made us a favor leaving it open after an only 24h delay. It could be much worsa and is nothing in our eternal tinkering with developer options. Thank you from me Google

It's wild how far we've come, from IBM trying to lock down the PC to truly open hardware, to you now thanking Google for only mostly restricting what you can do with a device that you bought and own...

The rest of your content is just other forms of Google apologia.

This is honestly deeply disheartening... And on "hacker" news of all places...

Post reply on HN