Hacker News Reader

Comment by Hasnep | Hacker News Reader

I recommend NeoStore [1], which is an alternative frontend for F-droid. I can't say it never crashes, but I prefer it to the F-droid app.

[1] https://www.f-droid.org/en/packages/com.machiav3lli.fdroid/

View on HN

From what I was reading recently, NeoStore is also the F-Droid client which supports automatic upgrades on Android 12, without root.

Yes, but it has the limitation that it can only automatically update apps that it installed. So if you've already installed an app through the F-droid app, you can either uninstall and reinstall an app using NeoStore or manually do the first update through NeoStore and then all subsequent updates will be automatic.

This is the reason I use NeoStore to install apps like NewPipe on my family members' phones. Before, when Newpipe broke they wouldn't know how to update it, now it just stays updated all the time.

This is being fixed in Android 14[0], fwiw.

0. https://www.xda-developers.com/android-14-new-apis-app-store...

The lack of automatic updates/upgrades in F-Droid is what keeps putting me off. I completely understand people who want more control over when and which apps get the updates, but this is not a good policy for the general case: I trust the developers of the apps I install from F-Droid to provide me with security, stability and performance updates much more than I distrust them to pull the rug from under my feet.

I also don't think an alternative-to-the-alternative is the right solution. I didn't even know NeoStore or Aurora existed before now, and frankly I don't want to know the difference. F-Droid is already extremely niche, compared to the Play Store. It needs to play every strong card it has available at hand, rather than proliferate the fracturing.

That's an Android restriction, you need root to allow non-play-services to install apps.

Oh.

I haven't rooted an Android device since 2014.

I just did some lazy research for the version of LineageOS I'm using. Am I missing something, or is it normal to find the procedure confusing and somewhat scary? There is github.com/LineageOS/Superuser and github.com/topjohnwu/Magisk, it seems I need to build Superuser from source (yikes); Magisk from F-Droid wants to install a newer version from Github (but that doesn't work); the version that works wants to patch a ROM file, which I don't know where to get from... The app lists changelogs rather than instructions.

I understand it's partly the fault of Android's security architecture, but I wish it was actually manageable for normal people.

This seems to be partly a Lineage problem - with probably some Android culpability mixed in. Lineage had their own very simple to install superuser addon, but that was dropped a few versions ago. Some Android changes prompted this, but probably also their attitude against rocking the boat (no rooting, no signature spoofing, etc).

The remaining solution was Magisk. Magisk was equally easy to install, but recently deprecated that easy install method so that only patching the ROM file remains (you get that file from the ROM you run, unpack the archive, if you are unlucky you need to unpack a second payload.bin file, https://wiki.lineageos.org/extracting_blobs_from_zips#extrac...). But not only is that more complicated, it also does not persist after a Lineage upgrade, which happens every week, see https://github.com/topjohnwu/Magisk/issues/3820#issuecomment.... Totally crazy for a project not in early alpha.

I want root to properly manage my battery via https://github.com/VR-25/acc ( with ideally https://github.com/MatteCarra/AccA as Magisk module). How ridiculously complicated that is now and that the install procedure is broken without them documenting it soured me quite a bit on Magisk, but I also start to develop some bad feelings about Lineage - because it is them that would be in the best position to provide a simple root solution. But they just refuse it, and even forbid discussing such topics on their subreddit - that alone shows me that the project is very user hostile currently. I doubt with that attitude they can make a turnaround, but I'd be happy to be wrong...

Sadly the other bigger ROMs are to my knowledge not better in this category, neither /e/ with their service suite, nor DivestOS with the passionate developer nor CalyxOS or GrapheneOS with their "security" focus are interested in giving the user full access to their device. Android seems to be a dead end here, real Linux is needed.

You make it sound harder than it is. Most (if not all) ROMs offer the boot image as a separate dowload, often referred to as the "recovery"; LineageOS is one of them. You only need to patch and flash it once, after that you can just open Magisk after the OTA update has been installed but before rebooting, and choose the "after OTA update" install option.

Patching the recovery is specifically deprecated now, according to the install instructions. See also the github issue I linked.

Indeed, and I was talking about the boot image, but some still refer to it as the recovery, i.e. LineageOS. I see LOS have changed their download pages now and correctly call the boot image boot.img instead, that's good. So anyway, just download the boot image alongside the ROM instead of extracting it, and rerun Magisk install before rebooting after an OTA, and it's all very doable. Not as easy as before, but not too hard either.

LineageOS seems to make a name change just now with the boot and recovery thing. For reference, https://topjohnwu.github.io/Magisk/install.html is what I reference. The file you get instructed to path is the boot.img. Note how "you have to do something after every ROM upgrade" does not get mentioned - so it is a little bit better than I thought if Magisk has an action in the app that can be run before the reboot, but that's still way too brittle to be useable.

(I vouched for your comment, it was hidden, that's normal for new accounts.)

> But they just refuse it, and even forbid discussing such topics on their subreddit - that alone shows me that the project is very user hostile currently. I doubt with that attitude they can make a turnaround, but I'd be happy to be wrong...

Somehow not surprising to me. Many large open source projects seem to be more about pushing a political agenda of some sort, rather than serving the interests of their users. Especially distributions, as a class of projects, are uniquely positioned to do that, as the role of a systems integrator doubles as the de-facto gatekeeper.

> Sadly the other bigger ROMs are to my knowledge not better in this category, neither /e/ with their service suite, nor DivestOS with the passionate developer nor CalyxOS or GrapheneOS with their "security" focus are interested in giving the user full access to their device.

I have no opinion on any of these except for GrapheneOS, but I totally understand why they wouldn't want the user to root their device - having root is indeed a security nightmare. I wrote about this more extensively in the context of traditional UNIX-like operating systems. I think it's a very good trade-off IF you provide the user with viable alternatives (let's remember, the original goal was to have unattended upgrades).

https://news.ycombinator.com/item?id=32971677

> Android seems to be a dead end here, real Linux is needed.

That was my reflection in 2016, when I changed to SailfishOS full time, and remained the case in 2019, as I switched again, to iOS. I keep an Android device or two around just to keep testing the waters, but for my personal goal of having a usable phone without Google, indeed looks like a dead end.

Or use a distribution that actually gives users control. I'm using CalyxOS for instance and haven't had to fiddle with anti-user settings to be able to use my ohone.

Here's NeoStore's GitHub project page:

https://github.com/NeoApplications/Neo-Store

Haven't used NeoStore, but Aurora Droid works well for me.

https://f-droid.org/en/packages/com.aurora.adroid/

I switched from Aurora Droid to NeoStore and prefer the latter's speed. Of course now that F-droid has made this change Aurora Droid may improve if/when it adapts.

Looks nice! Unfortunately they don't support repositories that use plaintext HTTP. I get the idea, but my repository is private and only accessible over my personal Tailscale network so that's annoying.

I'm curious to see how fast NeoStore will switch to the new format.

Reply on news.ycombinator.com