Hacker News Reader

> there's open source alternatives to Play Services that Google neither litigates against nor seems to actively fight against

AFAIK these are reverse-engineered. Do you sincerely believe that developers' time is best spent reverse engineering and maintaining play services alts to undo a blockade that Google put in, just to be able to get full freedom over their android derivative? Wouldn't it be better spent in playing with cool new tech (as Google engineers seem to be doing)?

What freedom are they lacking without Play Services?

The ability to get notifications.

yeah there are many options but if 99.99% uses gms on android. Its majority rule as a app developer i would push other services way back down in priority.

It's possible to get notifications without Play Services. See ADM, OpenPush, etc.

It's not about what is possible, it's about what developers eventually pick. While some privacy-focused companies seem to use more open alternatives or even implement the system themselves, most of developers simply stick with Play Services, which makes use of many (even FOSS) apps cumbersome without them.

You can easily sideload an app, sure. But recent version of Android restricted background running of the apps, making developers dependent on push notifications, and FCM notifications won't work without Google services.

On the first hand, I really appreciate the 30 - 40 hours of battery runtime my Pixel 5 has now. Restricting background apps is a big part of this.

If only there were some way to let the phone's owner decide what apps were allowed to run in the background, we could all be happy.

It takes about 15 seconds of googling to find out that yes, the user can decide what apps are allowed to run in the background. It's just that now, it's not "every app by default" and instead "what apps a user selects".

If instead of googling for 15 seconds you had any real experience about developing apps that need to run in the background (like I do), you would know that this 'background running' is a joke.

The only way to run an app non-stop is to have a persistent notification. And even then, apps are killed off left and right by the likes of Samsung. See https://dontkillmyapp.com for more details

It depends on the phone. Lots of problems with eg the COVID-19 exposure notification apps where firmware updates from Android OEMs were needed to whitelist the apps, the user accessible background settings weren't enough to keep them working.

Nope. It's Google apps. Users aren't asked for a choice there.

And then maybe "what app a user selects", if the user manages to follow the procedure.

There is. You can disable battery optimizations per-app, if that's what you mean.

Is this possible on a rooted device?

I more or less agree with everything except

> that developers didn't lose interest in the platform in favor of iOS.

Developers go where users are. Some developers sell their apps on the store, others get hired to build apps that are distributed for free to make people use services they buy outside the store. Banking, business apps, etc. It's impossible to lose interest in Android. It's too big. Compare it with Windows phone which died for lack of users.

I'm losing interest in it, for actually some of the reasons sited. Chinese manufacturers are slowing increasing market share, and their version of Android is completely broken, to the point where if you are not a major whitelisted app, you simply can't do anything unless the app is in the foreground. It's maddening.

Project Treble didn't fix anything (I'm very happy with Project Treble, because it lets me hack stuff I couldn't begin to imagine with 4 yrs ago, but that's just hack). It didn't even fix Nexus/Pixels that still have the same upgrade track record as a Samsung 100$ device. (Pixel 1 and Pixel 2 users, feel free to come and use my Generic System Image, I'll keep upgrading you as long as I can with my bare hands!)

ATM OEMs are NOT allowed to use Project Treble. There is only one OEM in the whole world that did an upgrade using Project Treble. What does this OEM have special? Well it's Meizu, they ship only in China, and doesn't care about Google certification. The certification that you say helped prevent Android from being fragmented. Turns out it actually helps fragmentation.

Meizu, Amazon, and Huawei are not Google certified. I have yet to hear developers say they are specifically worse than other Android devices. Last time I had an Android device with stupidly broken video aspect ratio (I'm a multimedia developer amongst other things), it wasn't a Meizu, Amazon or Huawei device. It was a properly certified Philips TV.

Project Treble is sincerely a superb engineering project. But the truth severely lags behind.

If you don't care about Google certification, you can upgrade an Android 8 device to Android 11 finger in the nose, keeping Android 8. It's bootable in a day, usable in a week, production ready in a month. If you care about Google certification? Well, you need to upgrades your drivers to Android 11 base, which is a non-sense when mentioning Project Treble.

How to upgrade drivers? Well it depends. Usually the first step is to upgrade your build scripts. Because well of course, every two major upgrades Android build system is "upgraded". Well, OEM got the trick, now they are building their drivers out of Android, and their build system is a giant shell script. Way to go! Makes upgrading to newer Android version much better!

Now you've managed to build your Oreo drivers into Android 11, congrats! Now let's start them! Oh, new "security" features have appeared, and now half of your code no longer works. (fdsan I believe is way more annoying that it is meant to be)

Let's not forget about Android 9 Go mess as well. (Hint: The only post-Oreo Samsung devices that didn't get their 2 upgrades are Android Go devices) Basically Google cares about RAM consumption two weeks every 2 year, so only this exact release is usable on low-end devices.

Is Google evil? I don't believe it is. Hell I believe that every Google engineers believe they are working towards a better future. However I do believe that even within Android itself, there are many units, that are (mostly unwillingly) shooting at each other's foot. So yes having AOSP is awesome, Project Treble is beyond any hope I had back then. Still, overall the improvement is far from what has been advertised.

To come back to Fuchsia, I believe it is going to be pushed to Android devices in two years (so Android T). OEMs won't have a word to say in this: Google gave a try at such a big change through GKI, and OEMs have been complying nicely, so going to Fuchsia should be pretty easy too. I'm expecting some Android features to be offloaded to Fuchsia for "security" reasons, like Window Manager, which will constraint OEMs even further down as to what they can change, because the Fuchsia "core" image will be like Google Services, mandatory Google-signed. (There'll be Fuchsia app images as well, which people will be able to do whatever they want with, but that's something else) I hope I'm wrong.

For more context, if I recall correctly, phh is the first person outside of Google to figure out this Generic System Image thing, and has been tinkering around Project Treble ever since.

(And I just learned about the GSI image for Pixel 1/2, thanks for that!)

Thx

GSI isn't specifically for Pixel 1 and 2, but they can use those, just like every other device whose OEM have abandonned them, since it is a generic image.

And not just that, Android also severely lags behind upgrading its mainline kernels, so you can't even avoid the issues by upstreaming your drivers. You have to fork them. People get mad at vendors that they don't upstream their drivers but there is currently zero benefit in that. Google should reward vendors for that, and maybe we'll start seeing more drivers upstream.

They are working on Kernel Issues, which while not the exact solution to the problem you mentioned but goes a long way https://source.android.com/devices/architecture/kernel/gener...

That is just Google reinventing a stable kernel API for certain drivers. It will be Android specific and will never be mainlined. Drivers that use this will probably not be part of mainline either. It is just Google splitting of from vanilla Linux and going their own way, what they want is to be able to use 5 year old drivers on new kernels.

Thank you for sharing your experience and for the lengthy reply, it was really enlightening!

Ah, then nothing's changed (re the messiness) since Android 2/4/5. Sounds like they're still moving toward locking down everyone's hardware to ensure their ad platform revenue.

The couple of devices I've broken down a release for and rebuilt just to clean out Trojans included in the firmware were devilishly difficult. And does it ever piss me off that there's nothing generic and updated to run on them.

As a hacker, Android feel much more free than before. Because I can flash whichever ROM on pretty much whichever device I want. (assuming OEM didn't lock down bootloader unlock, which is pretty rare those days) I have my own ROM on small device (kTouch i9), long device (Qin 2 Pro), keyboard device (Unihertz Titan), device with a FLIR and endoscope (Ulefone Armor 9), assistant/speaker (Archos Hello 7), comfortable in hand device (Pixel 5), premium device (ROG Phone 3). Those devices (except those last two) wouldn't ever have seen custom ROM. But here we are, thanks to Project Treble, the same ROM works on all of them without breaking a sweat. Nowadays when I buy a device to hack with, the only question I have to ask is "can the bootloader be unlocked?" (small photo to make my case https://twitter.com/phhusson/status/1308299188153643008/phot... )

As a user, however, it is severely locked down. Installing apps from 3rd party app store was okay-ish years ago. Nowadays, Android just frightens you as much as possible so that you don't install 3rd party apps. The battery thing that has already been mentioned is an issue as well. Nowadays you can't even use an alternate Camera app, you have to stick to whatever OEM gave you.

Jeez. Remind me not to express an opinion on here.

Thank you for the clarification! I haven't had the extra time to tinker with the latest devices since it's a bit outside my day to day. That's a bit more nuanced and it's good to hear from someone who develops on the platform regularly.

> Google were so convinced of the value of open source

It is as black and white as, "Chinese market."

"evil" is a non-sensical model. Corporations are amoral.

"Is Google still primarily an advertising company that tracks its users? Of course."

A primary reason why I would choose open over closed source is the ability to avoid ads and tracking. Can the user remove all the phone home nonsense from Fuschia. Of course not. This defeats the purpose of open source for me -- control. With this, I have to share control over the computer with Google.

generate_204 is used to check if a network has internet connection or need to login at captive portal, not sure about Fuchsia but on Android if you don't want to use google server for that, you can disable the feature or change it to use a different url https://android.stackexchange.com/questions/186993/captive-p...

Apple and Microsoft both have something similar but with their own website, and AFAIK there's no way to change the url on iOS.

What I meant was remove the code to make these automatic connections to Google servers from the OS source, re-compile and re-install.

That is what I look for in "open source". If I cannot edit, re-compile and re-install, much of the value to me of "open source" is lost.

But this is not always a fair label to apply. If I release a device running Android that prevents you from using your own Android, that's a problem with me and the device I released, not with Android. This seems to be conflating hardware and software -- which is understandable in the context of operating systems -- but we should be clear about the cause of the problem, which has nothing to do with the openness of the code.

What's the generate_204 thing? Low effort web searching revealed something about a default path on google services for clients to check network status. Is it more nefarious than that?

Also, please tell me the ":wq" was unintentional.

I believe they should have closed source the OS, Android being open-source is the number one reason for its fragmentation. What i dont understand is the "security" logic given by fuchsia. How is Linux less secure ? I dont think anyone starting a new kernel now can guarantee its security to be superior to Linux, because Linux had 25 yrs of evolution to where it is now. That logic is pure garbage, the real reason probably is NIH. And if Google ever actually hopes to compete with iOS technologically it better choose a superior stack and fuchsia is far from it.

I do believe building a new OS from scratch - taking the learnings of the past 25+ years into consideration - will lead to a better and safer OS. I mean for Linux they had to invent a lot of new concepts, replace a ton of things for security reasons, etc. It's secure NOW, and it was secure enough since its inception (I presume?), but it's the cumulative effect of years of polishing.

I mean search the kernel for references to use-after-free or null pointer dereference.

Since then, there's been big improvements in development practices, tooling, and languages to prevent security issues from occurring in the first place.

Sure but thats a lot of work and things arent as simple as they seem there is always a risk of introducing newer bugs. So why switch?

I think this assumes that all OS designs have equivalent levels of security, but if this is true then why are there security-focused operating systems like seL4? Also I think that without the backwards compatibility requirements of Linux, one could probably have features that improve security (eg sandboxing of some kind)

Linux container is a sandboxing feature.