Hacker News Reader

Comment by izacus | Hacker News Reader

One of the things that feels a bit problematic here - the webpage is avoiding mention of the fact that this is still Android. In essence, this is still Google's OS and the team has decided to start a fight against Google by taking their opensource and perpetually fight against the main developer by removing their proprietary component.

I don't think this is a fight that's sustainable - a giant graveyard of Android privacy forks shows that. In the end, the major contributor to this OS is and will remain Google.

In that respect, Purism's PureOS seems like a more sustainable effort.

View on HN

I don't think the graveyard of Android privacy forks is that big? All I can think of is CopperheadOS which died because it was company-backed. You could argue CyanogenMod died, though really it's still well alive in LineageOS. (and CyanogenMod wasn't really privacy-focused)

I have a very high respect for all the work that's been done on the various GNU/Linux mobile distributions, but it's still so far away from Android wrt usability...

I agree there is something weird about fighting Google with Android, but still it makes perfect sense.

From a business or engineering PoV, you want best features for the fastest MVP. Android gives you just that. Actually it goes way beyond, /e/ didn't do much of engineering, they mostly re-used what's done by the Android FLOSS community. (Honestly I don't really like /e/ because they basically don't give anything back to the community but well).

If /e/ is ever successful, they can hire many engineers to actually fork Android to have their own. That's what Android did for Linux in the first place anyway! Most OEMs have a lot of changes to their Android, even though they keep using Google apps, and they are just fine. I'm pretty sure that Samsung have an order of magnitude more changes in Android than LineageOS (which /e/ is a pretty direct fork of), and they maintain it just fine.

The original developer of CopperheadOS is continuing the work as GrapheneOS, after a split with his former business partner, over dilutions of the privacy guarantees, among other things. https://grapheneos.org/

Always feels like treading google for some other random developers

> random developers

Micay, of GrapheneOS and original creator of CopperheadOS, is not some random. They have pushed AOSP security ahead and have made many upstream contributions over the years.

I don't think he was the creator. None of the more reliable sources I see say that he is. They all say he was an employee.

I remember when Micay first released CopperheadOS. I spent most of early 2015 learning enough about kernels to eventually successfully port it to the OnePlus One in November of 2015 with near full PaX support. https://github.com/Divested-Mobile/DivestOS-Build/blob/c0083...

You're reading shit/publicly editable sources.

Micay originated the Android Hardening Project, I believe it was called, and is the brains behind what was CopperheadOS, and now the superior GrapheneOS.

He was also a pretty instrumental Rust developer.

Highly recommend this solution.

This is where I ended up after countless hours of research looking for security/privacy.

> over dilutions of the privacy guarantees,

Has anyone found sources for this?

I can't find any.

Simply read the GrapheneOS IRC/Matrix channel. They log.

CyanogenMod, as the name suggests, was explicitly a nod to add in features that didn’t exist before.

That was indeed a losing battle because Google has far more resources to add features ans beat CyanogenMod.

On the other hand, a de googlized and privacy focused platform provides something that Google can never provide.

There’s also a change in the environment surrounding all Of this. Thanks to the weaponization of Android by the American government, every country and company in the world is looking for a De GoogliZed alternative.

Isn't CyanogenMod just AftermarketOS before rebranding?

Cyanogenmod is still alive and thriving as LineageOS. The goal was never to beat (Google) Android, it's just a custom ROM that provides many desirable features.

The e.foundation sponsors MicroG, so it is not entirely true that they don't give back.

Ah I didn't know that thanks. That's still pretty little though, but I guess that's a gesture in the right direction.

> All I can think of is CopperheadOS which died because it was company-backed

CopperheadOS did not die. https://copperhead.co/android

/e/ mostly uses LineageOS code without providing attribution. They have a fair fight ahead of them and the Android FLOSS community benefits from this internal competition.

Copperhead looks interesting, thanks for that link.

This was the conclusion I came to after using android 4-5 for a while.

Android is not designed for the community to be hacking on it. While these projects occasionally appear they don't last because of the incredible amount of work required to maintain them. You're much better off finding a normal Linux distro/phone pair that can make phone calls etc.

Just bought a KaiOS phone, waiting for it to arrive, I will see how it will behave.

It seems like KaiOS would actually be worse for privacy. Same apps but less ability to toggle permissions.

What makes you interested in it?

For example it does not allow apps running on background (something that causes whatsapp web to not work at all).

Nowadays I single-handledly (well almost, I do have some contributors, thanks to them) maintain a pure unmodified Android that works on hundreds (probably thousands) of different devices.

It has become a lot easier thanks to Project Treble.

Hi phh,

Doesn't the DRM stop working once the bootloader is unlocked? That'd be a big concern since most streaming apps would refuse to install or work in that case.

What other such changes is Google pushing into Android that discourages unlocking the bootloader / rooting?

That's a globally incoherent mess, I'll try to summarize, but the TL;DR is that depending on the device and on the streaming service, it ranges from "it'll just work after bootloader unlock" to "nope, there is no way to get it to work", with an intermediate of "shitload of hacks are required".

So first point about the DRM itself: - Google here is "benevolent". Devices are allowed to keep working Widevine L1 working after bootloader unlock (without needing relock), and it does work just fine on Pixels. - Some devices clears their key after bootloader unlock, so unlocking means you'll never get Widevine L1 - Some devices have the key tied to being locked, to relocking will work - Some devices doesn't have restrictions, but have poorly written drivers that need to be hacked around to allow to work on unlocked bootloader

And then, there is the extra issue of what streaming apps decide to give you. For instance Netflix will not use Widevine L1 even if it works unless your device is whitelisted. So if you flash a "simple" alternative ROM on a Pixel 5, you still would get only 480p. The ROM needs to lie, and tell it is the original Pixel's ROM. (Also Netflix won't be listed from PlayStore unless the ROM lies and says the app that yes the bootloader is locked)

In my opinion, the biggest vendor lock-in about bootloader unlocking is that you'll loose all your data when unlocking, with no way to properly backup your data on stock ROM.

Just download DRM-free movies from BitTorrent trackers or other sources, and ignore the DRM-encumbered streaming services.

Hi phh, I remember using your software to root my Nexus 5X a few years ago, thanks for that! Good to see you're still in the scene.

Thanks for the ROMs you produce. Do you recommend any particular devices (phones and tablets) to use a device-independent ROM?

As far as I could see in your GitHub project wiki, most devices tend to have a few glitches (probably due to issues in the hardware abstraction layer from the manufacturers side?): https://github.com/phhusson/treble_experimentations/wiki

I could see some that look mostly flawless, like Samsung Galaxy Tab 8.0 2019. It'd be good to have a curated list of preferred devices. Buying Android devices with ROMs in mind is quite frequent, and your generic ROMs are a huge leap ahead!

I guess it depends where your priorities lie, but this effort seems _more_ sustainable to me because it can run most proprietary android apps, and everything on F-Droid right out of the box.

PureOS has to try and reimplement an entire mobile app ecosystem just to get to parity with existing competitors.

PureOS is trying to use desktop apps instead and fit them to the phone screen ("convergence"). I think it is a viable strategy.

The thing is, there aren't any desktop apps—much less Linux desktop apps—for the types of things I need to do on my phone. On an Android phone, I can buy train tickets (NJTransit), deposit checks (Chase), and have telemedecine appointments with my doctor (MyChart).

I don't know if all of these would work in e.foundation, but presumably at least some would run.

This may indeed be a problem. Perhaps one can use webapps for some of those use cases.

Unfortunately, I chose all of those examples explicitly because they can't be done on the web—they can't be done on a desktop device at all! :(

The telemedecine app is a big one I think about. I don't know what I would have done if I hadn't had a modern iOS or Android device when the pandemic hit in March, and my doctor appointments suddenly moved to this remote system.

> I don't know if all of these would work in e.foundation, but presumably at least some would run.

Custom AOSP apps can be supported via Anbox on upstream linux.

The way to go, IMO, is having Android emulation on your device for backwards compatibility.

SailfishOS has this, and doesn't do tracking.

PureOS and Purism One implement some FOSS techniques and rebrand them. I believe Nextcloud does this as well. Not sure why projects don't clearly mention what they're based upon, especially when its a lot like original.

On the other hand by being Android you get to run all the Android apps out there.

What I seek in a phone is control over my privacy, not necessarily a vegan FOSS system.

What that means is things like:

- Fine-grained control of permissions to apps (e.g. access to rear camera only, access to only city-level accuracy of locations, access to read from only directories I specify)

- For apps that insist on having permissions to things like location and wi-fi scans to use them, the ability to make the app think it got said permissions, but receives fake data. And no, Android's mock location feature doesn't work, because apps can check if the feature is enabled or not

- The ability to fake IMEI, phone number, contact list, installed apps, and other identifying data

- Ability to generate fake IMU, proximity, temperature, barometer, and all other sensor data that could conceivably be used for fingerprinting

so much this! I want XPrivacy out of the box, and whats with the blocking me from recording my own calls? I want that too.

Yes, call recording as well. If I own a device, I should be able to command it to do anything that it is technologically capable of.

"Since our OS runs on a totally deGoogled Android" Was that added to their site after you wrote your comment?

izacus' comment is exactly about that. That keeping it deGoogled is a constant uphill battle, and it sounds good in theory, but as previous forks show - according to izacus - it's eventually a losing strategy.

Hrmf, I may have missed that exact part.

https://doc.e.foundation/what-s-e

I think the effort is very good. The result is excellent and it's really addressing a much bigger audience that PureOS.

Except the fact that the result is VERY bad, you are right :)

LineageOS is both more successful and more practical than Purism thingies.

> One of the things that feels a bit problematic here - the webpage is avoiding mention of the fact that this is still Android.

I think they legally can't call it "Android" in this case so it's not really their fault that they aren't mentioning this.

What about LineageOS + MicroG? It seems sustainable to me

LineageOS has sadly been falling behind on device support these days, not sure what's going on there. :/

What do you mean? LineageOS currently supports 164 devices, and LineageOS 17.1 was released a few months ago with 75%[0] of devices moved over to it currently. LineageOS 18.0 is in the works as well [1].

[0] https://docs.google.com/spreadsheets/u/0/d/1bx6RvTCEGn5zA06l...

[1] https://redd.it/jueya4

LineageOS does not support MicroG officially, you will not receive support from them so I don't know what your benchmark for sustainability is.

The officially stated reason (I'm paraphrasing) was because it allows for fudging the signatures of apps and services on the OS, and this breaks the security model.

But I think that in case something isn't working you would get support from MicroG, or not?

Reply on news.ycombinator.com