Hacker News Reader

I've said this in another comment, but I'll duplicate here:

The microG creator goes into more detail about signature spoofing at https://github.com/microg/GmsCore/issues/1467#issuecomment-8... The concerns usually raised against that are due to the "default" patch included in their repository, which has a specific purpose.

We don't use that, https://calyxos.org/about/tech/microg/ are the precautions we take to try and prevent "weakening overall package security"

In addition, microG is optional and can be disabled on first install, see https://calyxos.org/features/microg/#1-microg-disabled

> see http://127.0.0.1:4000/features/microg/#1-microg-disabled

As someone who also accidentally pastes my local dev URLs from time to time, I feel your pain ;)

For everyone else: that's https://calyxos.org/features/microg/#1-microg-disabled

I edited the comment to fix it, thank you!

Making it system-only still isn't ideal. It then requires a full OS update to push updates to microg/playservices, cannot just update the app components if vulnerabilities are found in the wild.

I would like if there was stronger privacy laws or antitrust orders that force Google to open their service provider API's so people can choose alternative location/push providers, but this doesn't seem like it will exist soon.

For many users, it's going to be the best usability compromise to use minimal play services and use apps that don't send content over the push networks (signal is like this, element can be configured this way).

> Making it system-only still isn't ideal. It then requires a full OS update to push updates to microg/playservices

It does not, you can update system-apps out of band just fine.

Google does it with Play Services (and many other apps), and we have our microG builds in our F-Droid repos for out of band updates.

In fact, that is one of the big selling point of Play Services - the fact that it gets updated outside of OS updates, which means that you have a recent / the latest version on all devices regardless of their update record.

And therefore anything implemented in Play Services can be used even on older Android versions.

Funny that you’re using “tin foil hat crew” the day after Apple announced snooping on everyone’s pictures

Yeah more like a "baseball cap crew" these days.. lol i dont trust corporations.

Also google has never ever used users' data to turn a buck or anything.

Especially since tinfoil would be like an antenna.

Everyone knows that.

If signature spoofing is confined to apps that I designate as spoofed (such as microg), then I'm okay with it. No security problem as far as I'm concerned.

I'd like to see people make their own apps that don't rely on Google services (or faked Google services) of course, like the Linux ecosystem.

On CalyxOS only microG can signature spoof, no other app can.

* and it can only spoof one signature, that of google play services

In my experience, LineageOS without gapps or microg is plenty usable. I get all my apps from F-Droid and have for years. I don't feel like I'm missing anything major. I'm sure this won't work for some people, but it's an option worth mentioning.

Also, for this reason I shy away from alternatives to LineageOS which include microg by default. I don't want it.

> This will of course break some functionality (apps will have to poll instead of relying on push)

It seems like what we really want here is for the app to implement its own notifications without going through Firebase. All you need for push rather than polling is an open socket...

I worry that these projects are asking me to either turn the phone into an ipad touch or a dumb phone.

Do push notifications require microg/google? A communications device (as opposed to a media player) that didn't have push notifications would be missing something required, in my use.

It's my understanding that alternatives to google's location services exist.

I'd just like a phone that allows me to chat/use apps/gps (let's put cell service to the side of a second) without being an OS-wide, logged-in, analytics tracker.

But I don't want Google Play stuff. I'm just using microG for location services in /e/.