Hacker News Reader

Comment by ausjke | Hacker News Reader

How does this compare to CyanogenMod? Security is definitely important but how much should I trust this OS?

Both CyanogenMod and CopperheadOS should be able to run smoothly withoug google-specific apps I believe, which is nice for some.

View on HN

CyanogenMod's priority is not security; it prioritizes things like stability, compatibility, non-technical end-user experience, and relationships with developers. For example:[1]

Rule #1 of CM is "Don't break apps".

We recognize that there are nefarious apps out there, and many of our users would actually understand how to use permission controls (and the implications of using them). With our huge userbase, we have a responsibility to ensure that applications aren't running in a hostile environment, and work as designed.

We are all privacy advocates at CM, but I am not willing to compromise our good relationship with application developers in order to implement features like this.

Much more here:

https://plus.google.com/+SteveKondik/posts/iLrvqH8tbce

[1] See Kondik's 29 May 2013 message in https://jira.cyanogenmod.org/browse/CYAN-28?page=com.atlassi...

And unlike Debian[1], RedHat[2], OpenSUSE[3], FreeBSD[4] they don't even have a documented list of security advisories and what update fixed them—and given the haphazard nature of CyanogenMod stable builds (including some devices receiving none for months when there are high profile security issues, yet no statement anywhere that those devices have any less security support than any other), I have little faith in the security processes of CyanogenMod. And that's before you even start to touch on the privacy aspects which his post is mostly about, as far as I can tell!

[1] https://www.debian.org/security/ [2] https://access.redhat.com/security/security-updates/#/securi... [3] https://www.suse.com/support/update/ [4] https://www.freebsd.org/security/advisories.html

The problem is the vast majority of applications actually require Google services to run on Android devices. Running an Android device without GApps is pretty much pointless unless you are really using it for a very very specific purpose.

F-droid apps disagree

The vast majority of apps on the Play Store do not actually require Play Services. There are also plenty of open-source apps on F-Droid without any such dependency, and other mostly proprietary alternatives like the Amazon app store.

It would be (relatively) easy to put together another suite of utilities offering the same API as the standard GApps, in order to allow 3rd party apps that depend on that API to function. Rumor has it Samsung has just such a project in the works, in case they need to punch the eject button on their relationship with Google: http://www.digitaltrends.com/mobile/samsungs-secret-mission-...

It's in progress.

https://microg.org/

> Running an Android device without GApps is pretty much pointless unless you are really using it for a very very specific purpose.

This is an exaggeration; you can find plenty of solutions that don't require Gapps, AFAIK. However, I don't know that the typical end-user would be happy solving that problem or using imperfect workarounds. For one thing, you need some sort of GApps solution to access the Play store, AFAIK.

> the vast majority of applications actually require Google services to run

There are plenty of GApps subsitutes for people who want them; I've done some homework on it, but haven't gotten around to trying them and all of the following is "AFAIK"; it's just based on a bunch of reading.

----

These appear to be the two leading substitutes:

* TKApps: 6 editions containing varying subsets of Google Apps

http://forum.xda-developers.com/android/software/tk-gapps-t3...

http://forum.xda-developers.com/android/help/qa-tk-gapps-hel...

* MicroG Project: My impression is that this is most carefully engineered option. In addition to its full suite I think it gives you the option of installing only one component, the stripped down GMSCore, which provides substitutes for several Google Play Services APIs.

https://github.com/microg

http://forum.xda-developers.com/showthread.php?t=1715375

http://forum.xda-developers.com/android/apps-games/app-micro...

----

Also of interest:

* Blankstore: For minimal Play Store access, or maybe just the API to keep other apps happy.

https://github.com/mar-v-in/BlankStore

http://forum.xda-developers.com/showpost.php?p=29115263&...

* Fakestore: (I don't have a link, but it's the same concept as Blankstore)

* BeansTown106's Gapps: (I don't have a link, but your search engine should find it), "very complete and work quite well" per a dev of OmniROM, a leading Android fork

* GApps Browser: Google Apps sandboxed, so can login there without being logged on in web browser, for confidentiality

https://f-droid.org/repository/browse/?fdfilter=browser&fdca...

Reply on news.ycombinator.com