Hacker News Reader

Comment by zachberger | Hacker News Reader

Disclaimer: I work at Google. In cloud, not on Android.

I am privacy conscious so I though I would give a try at Graphene OS, it was brutal. It was overall stable and the stock android R was refreshing. The app selection available through F-droid was very limiting and the quality of apps was a struggle compared to those in the app store.

I wish there was some incentive for the better apps to open source and publish on F-droid. I donate to many apps on Patreon, should I just message to the devs and ask them to go open source and publish on f-droid?

View on HN

Gotta step in as a GrapheneOS User. You have multiple options.

The easiest and most approachable one is: install Aurora Store from F-Droid. It gives you access to Google Play + App Updates without logging you into Google. This almost feels identical to Google Play itself.

Next: think about install the Experimental GMS Support that GrapheneOS offers. If you e.g. absolutely need an App that has troubles working without Google SDKs embedded, this might be an option. This is documented in the Usage Guide of the Website.

https://grapheneos.org/usage

However, just dont forget that you wanted a Google-FREE Phone. So dont overdo installing proprietär stuff.

Oh and stay as far away from MicroG as possible, it seriouly cripples the security of GrapheneOS by a lot.

> Oh and stay as far away from MicroG as possible, it seriouly cripples the security of GrapheneOS by a lot.

Doesn't this severely limit which apps you can install?

Severely? Not even close.

> stay as far away from MicroG as possible, it seriouly cripples the security of GrapheneOS by a lot.

Do you mind sharing some details on this? I did not hear strong statements like this one before.

IIRC It requires allowing apps to mimic other app's signatures and pretend to be them, "signature spoofing". MicroG mimics the Google play services signature.

But that is really crippling, because apps can now spoof other apps signatures, essentially apps can pretend to be other apps. That opens a lot of opportunities for an attacker.

With the set of patches used eg in lineageos4microg, spoofing is restricted to the microG core app.

You're still taking a risk. its a risk that I won't take but you're welcome to for the sake of convenience.

> Oh and stay as far away from MicroG as possible, it seriouly cripples the security of GrapheneOS by a lot.

I'm using MicroG on an unrooted stock Android just to be able to use Youtube Vanced.

What am I risking here?

> The app selection available through F-droid was very limiting and the quality of apps was a struggle compared to those in the app store.

That's funny because I would say the exact opposite. On the Play store it's extremely easy to accidentally install apps that have nothing to do with what you were looking for, never mind the absolute garbage it helpfully suggests on the start screen.

First thing I tell people around me is to get Fdroid and look there first. Seems much safer to me.

Off topic question, but what is the sentiment towards employees who want to protect their privacy at Google?

They didn't encrypt comms between DC's until after 2013.

Easy guess, it seems.

  > I donate to many apps on Patreon, should I just message to
  > the devs and ask them to go open source and publish on f-droid?

Yes, you should. This is actually a very effective measure.

> should I just message to the devs and ask them to go open source and publish on f-droid?

Yes!

> I donate to many apps on Patreon, should I just message to the devs and ask them to go open source and publish on f-droid?

Definitely! In addition, offering your time to set up the F-Droid build pipeline would go a long way

Reply on news.ycombinator.com