Hacker News Reader

Comment by knaik94 | Hacker News Reader

Termux singlehandedly makes me feel like I'm living my childhood dream of having a full computer in my pocket. I use git to blog from my phone, I have ffmpeg and yt-dlp installed to download videos for when I am going to be away from internet access for a while, and I even have some home automation scripts setup that control the lights over the local network. But I am concerned about the direction Android is headed, Google policies have been aligning closer to Apple's. I don't like having to stay on a previous generation OS just to make sure I don't lose "power user" fuctionality. Just recently I had to install a root mod to allow apps complete access to SD cards, a recent update caused me to get the dreaded "To protect your privacy, choose another folder" while trying to give a gallery app permissions. I am grateful for Termux devs for working hard to maintain functionality via workarounds.

https://github.com/termux/termux-app/issues/2366

View on HN

I really wish Android would properly enable containers like they've done for Chrome OS. It's silly we run little Linux machines and can't pop a fully isolated container shell on them!

Not quite the same, but interesting:

https://www.xda-developers.com/android-13-dp1-google-pixel-6...

I think it hasn't happened because much of the sandboxing of Android is part of the Android runtime, thereby only sandboxing code compiled for the Android runtime. If you could spawn a native Linux executable (that hasn't been compiled for Android the way the Termux executables have) from an Android application, then that process can escape the application's sandbox and do stuff it shouldn't be able to do given the permissions granted to the Android application.

That just means no container-based virtualization, though. There's nothing stopping a sufficiently-powerful Android device from running a Linux virtual machine, presuming that the hypervisor is implemented as a regular Android application using regular Android-runtime APIs.

Android 13+ includes a crosvm based virtulization setup: https://source.android.com/docs/core/virtualization

> ...then that process can escape the application's sandbox and do stuff it shouldn't be able to do given the permissions granted to the Android application.

Android's sandboxing is not limited to ART and has multiple layers [0]. Native apps cannot bypass sandboxing, I don't think.

[0] https://hernan.de/blog/tailoring-cve-2019-2215-to-achieve-ro...

> Android 13+ includes a crosvm based virtulization setup

Interesting; but I feel that their choice of a hypervisor-based design here supports my point of plain container-based isolation (or even containers + gVisor) being insufficient to achieve true sandboxing on Android.

> Android's sandboxing is not limited to ART and has multiple layers [0]. Native apps cannot bypass sandboxing, I don't think.

Yes, but when I say "sandboxing", I mean just the ART sandbox, not the other layers. I don't care whether you can get root / jailbreak the device. I (and presumably Google, in not publishing apps that do this in the Play Store) care about whether an application that, upon installation, doesn't request permission to e.g. read your contacts, can actually read your contacts. There are certain capabilities like that (not sure if "reading your contacts" is one of them, but you get the idea), that are only prevented from being accessed by ART, not by Linux ACLs. This is especially true when there's one level of permission that gets you access to a certain database file through an API, but then another level of permission that gets you access to certain special records in that database file through the same API. The lower level of permission is already granting you Linux filesystem ACLs to the database file; the only difference between the two permissions comes down to what ART will allow you to request through the higher-level API.

Google does, in fact publish apps that require root access in the play store. Titanium Backup is a popular example (though I'd recommend the open source Neo Backup instead).

They presumably don't publish apps that use exploits to help the user gain root without unlocking the bootloader and wiping the data partition.

There are many file explorer apps ( MiXplorer is my favorite https://play.google.com/store/apps/details?id=com.mixplorer.... ) on Google Play that have optional root access as well. You can use it w/o root, but if you have root it prompts for elevation and then lets you use it.

I also use MiXplorer, and wouldn't be able to read my camera's SD cards on my phone without it because Android doesn't support exfat for some reason. Root is required for it to use its own filesystem drivers of course.

I don't think I knew it was on the Play store. It's a free download from the website, but paid on the Play store. I'd like to make a donation without giving Google a cut - the author deserves to get paid.

Now thats an app I miss using, but unfortunately its much harder to get root on phones now, or if you do a lot of functions like banking apps will not work.

Androids built in app backup functions are woefully incomplete, and switching to a new phone recently I had to relogin to most apps and re-set up nearly everything, except for stuff like contacts and anything from google. At least some apps supported exporting settings to external files and allowed re-importing them.

It's rare I run into an app I want to use that has more than trivial root detection, including my two banks. I would probably change banks before giving up root or mobile banking.

When I do run into apps that are difficult to run, I make sure to give them 1-star reviews. I consider attempts to block rooted devices from running an app to be malware.

It is prevented by killing any process that makes API calls not part of the official set of public NDK APIs and file locations.

Which is one of the reasons why Termux has issues on modern Android versions.

https://github.com/termux/termux-packages/wiki/Termux-and-An...

> It is prevented by killing any process that makes API calls not part of the official set of public NDK APIs and file locations.

This is not something Android does.

How much Android experience do you happen to have actually?

"Starting in Android 7.0, the system prevents apps from dynamically linking against non-NDK libraries, which may cause your app to crash. This change in behavior aims to create a consistent app experience across platform updates and different devices. Even though your code might not be linking against private libraries, it's possible that a third-party static library in your app could be doing so. Therefore, all developers should check to make sure that their apps do not crash on devices running Android 7.0. If your app uses native code, you should only be using public NDK APIs."

-- https://developer.android.com/about/versions/nougat/android-...

"Improving Stability with Private C/C++ Symbol Restrictions in Android N"

-- https://android-developers.googleblog.com/2016/06/improving-...

"Namespaces for Native Libraries"

-- https://source.android.com/docs/core/permissions/namespaces_...

I work on Android. Opinions my own, etc.

The things you’ve linked are attempts to discourage people from depending on private implementation details. They are not a security boundary, nor are they really the kinds of APIs we’re talking about in this context. Since they run in your process there is no sandboxing or isolation involved here; you can call them if you really want to by looking them up manually. (Don’t do this.)

> The lower level of permission is already granting you Linux filesystem ACLs to the database file; the only difference between the two permissions comes down to what ART will allow you to request through the higher-level API.

I get what you're trying to say, but perhaps you mean the ContextManager / ServiceManager, which isn't tied to ART at all, but Binder (Android's primary IPC mechanism), instead.

Re: Linux ACLs: Yes, those flaws existed, but don't think they do anymore (see also the blog I linked above).

No. Android will not grant you direct access to databases, for exactly the reason you’ve mentioned.

If it works like crosvm on ChromeOS, you can launch a KVM virtual machine and then run containers inside that. It even supports nested virtualization (at least it does on my framework Chromebook) so you can then run vms inside the VM for stuff like multipass or gnome-boxes. It actually works really. Would be amazing if this same pattern is enabled for Android devices with proper vmx/vt extensions on the CPU.

This is not how sandboxing works on Android: it’s SELinux -based. The Linux ABI is explicitly supported by Android, though generally not recommended.

> But I am concerned about the direction Android is headed,

Over securing systems seems to be the modern trend, and mercy, it's such suffocating paternalism.

We have incredible phones and Android/Google just keeps making them less and less capable.

I'm sure security is part of the reason for the ever increasing locking-down of android ... but I'm more sure it's an excuse and that security FROM the user is a huge factor in google's thinking.

I agree & I don't.

I'm sure that being an app store owner exposes you to the absolute worst just most constant stream of really really awful people doing the worst things, like, forever & ever.

There are some warped incentives too, for sure. But I do think Occam's razor explains why app stores get to be worse & worse & worse: because they are responding to horrors.

I'd love to see some better mechanisms for trust emerge. Software as it is is basically unobservable. You grant or don't grant some permissions & otherwise have no idea what's actually happening. So app stores are the only arbiters of trust.

You have to weight the aggressive security posture against the fact that there are nearly 1.5 billion smart phones sold every year. [0]

In addition to having ridiculous computing power and storage capabilities, they carry microphones, cameras, WiFi, Bluetooth, NFC, lidar, radar...

If you can grasp not just the power of the device but the scale of its reach the only responsible and ethical action is to security harden it every chance you get as much as you can.

0: https://www.zippia.com/advice/us-smartphone-industry-statist...

I get it, but building a prison for computing is a horrible fate to trap us in. Bad use constantly being used to consign us all to worse & worse forms of computing is a godforsaken trend.

> Termux singlehandedly makes me feel like I'm living my childhood dream of having a full computer in my pocket

I still remember the first time I successfully SSHed to something from my Handspring Treo 180 over GPRS data, and felt like I was living in some kind of cyberpunk future.

> But I am concerned about the direction Android is headed

I'm with you, but we'll always have AOSP. And the cellphone market is now segmented enough that we'll probably also always have rootable phones.

We'll always have the versions of AOSP Google has released, but they're not forced to do so in the future. And I'm not sure anyone else is interested in maintaining it.

Google only releases AOSP for Pixel devices, for most devices you need to rely on (and trust) some dude on a forum and it might not have 100% compatibility.

Isn't Fuchsia google's attempt to move phone off open systems, and onto all-google-no-license code? If it becomes a big thing, then only increasingly obsolete open-systems for us :(

Fuchsia is about as open as Android is today.

Thanks - there was talk when Fuschia first became visible that it was to be locked down. The project site does not agree with that.

Whether it is “locked down” depends on your opinion of what Android is currently, I guess.

Ironically, I specifically have a Google Pixel so that I can mod it and gain more control over my phone.

What are some examples of these types of mods?

Custom ROMs? GrapheneOS or LineageOS come to mind.

is anybody outside of google able to maintain aosp though

One of the most unfortunate things in the US is locked bootloaders. AT&T has even started whitelisting phones for Wifi Calling and VoLTE. And with 3g shutting down, it means international phone variants won't work at all on the network, regardless of the underlying band support. Many companies, including Samsung don't allow you to unlock your bootloader to root your phone even if you bought it outright. I found that midrange phones are now the best option if you want things like AOSP. The only true flagship left, that I know of, with a headphone jack and sd card and good rooting support is the Sony Xperia phones.

Why would I want to install termux? You basically need a keyboard to use it; at which point you might as well grab a laptop.

You don't. I almost always use termux with virtual keyboard and it feels fine for doing something quick and on the go. Modal UIs (like vim) work better than modifier- and functional keys-heavy though.

You really don't need a keyboard, I use it just fine with onscreen and even wrote some simple scripts in vim with it. Tab completion in the shell helps a lot too and termux's keyboard has a button for it right there.

But if you _do_ need a keyboard... it's android and it perfectly supports USB or Bluetooth input devices including mice, keyboards, etc. If you have a Samsung or some other devices you can even get a nice HDMI output to a monitor and desktop experience out of the box. It's really like a little laptop in your pocket at all times.

And if you need a GUI Termux runs X11, vnc, etc and GUI apps just fine. Just download a X11 server or vnc app from the play store (there are tons) and you're good to go.

It has additional keys above the standard keyboard for tabs, Ctrl, arrow keys etc. It also has good scroll support, even in vim. Definitely fine for quick jobs.

You do not! You can use volume down as a Ctrl key, and volume up also unlocks other keys (volume up + wasd for example gives you arrows.) It also gives you an extra row above the touch keyboard with escape, tab, and some other keys, and a text input for pasting/IME/swiping/etc.

And even if that sounds uncomfortable there's still plenty of useful things you can do with minimal typing! For example... You could run Tailscale as a normal Android app, then use SSH forwarding in Termux to get a local port that goes to a web server on another computer in your tailnet, and browse to that locally on the phone using Fennec F-Droid (Firefox). All of that works just fine. If I leave one of my computers on and I'm in bed or away from home I can ssh in and run systemctl suspend. Wayland/X server locked up? You can use your magic sysrq keys of course, OR you can ssh in with termux and kill it, which doesn't depend on magic sysrq being enabled (or remembering how to get it on your keyboard.) You could also run yt-dlp to download some video or audio content from the internet; everyone hates the Reddit video player, so why not just get the MP4 out of it? Admittedly, there's a better solution here: you can get an app called Seal on F-Droid which is a pretty good yt-dlp frontend. But, the fact that you can easily do it in Termux using their package manager is testament to just how useful Termux is.

I honestly only want one thing; an SSH Agent implementation built into the app, so I can import SSH keys and not have to enter the passphrase constantly. Not a huge deal really, but having a built-in agent would be super convenient.

Take a look at https://github.com/aeolwyr/tergent

tergent is a ssh agent for termux that uses the Android keystore, meaning your private keys are kept in your phone's secure enclave for a bit of nice extra security.

There is quite a difference in size there! Find me a 7 inch laptop with phone battery life and pocket availabilty.

The closest option is probably the GPD MicroPC. It's 6", but pretty damn close to the ideal of a truly tiny PC. I think they're making a successor to this finally, dunno what the status is.

https://www.gpd.hk/gpdmicropc

Thanks for the link. It looks pretty cool. Form fact wise it looks to be competitive with an Android phone and a portable keyboard. So it's not clear immediately which is better.

I use termux daily, and you can stand up pretty much anything including a production grade PostgresDB. It's not a toy.

As an ex Psion 5 user, I've often been tempted by the devices from Planet Computers: https://store.planetcom.co.uk/products/gemini-pda-1

The keyboards on them are excellent, but the software/firmware stories for their devices are awful. Frozen kernels due to proprietary blobs, and support for running full Linux distros is limited and lags by months to years. And they're expensive as hell.

But they keyboards are good enough that I'd still kinda like to try the Astro Slide 5G. I just don't want to order one only to wait years for it to arrive.

As an owner of Cosmo, I can confirm all of the above. The form factor is great and the keyboard is amazing, but the software story kills it all dead in the water. I wish someone could just do a dedicated Linux machine like that.

I mainly use termux for the script API (which is incredible btw). I usually write the scripts in bash or ruby on my computer and scp them over, but I also have a small keyboard that I can plug in to type directly on the phone.

Even if you don't use the CLI part of Termux often, it's still an incredibly neat piece of hackery goodness. I once needed to text about 50 people and have it be from my real phone number. Rather than hack around with Twilio or AWS, I spent 5 minutes writing a ruby script to send the texts from Termux. If you aren't familiar yet with the API, it will take a little longer than 5 mins the first time. Once I had that script, I kept finding neat usecases for it. I sometimes still just text from the CLI because it's easier than using the built-in messages app depending on what I'm doing.

You can definitely get an amazing experience on Android without Termux, but Termux is like if Android were a really nice bicycle, Termux is a small powered motor you can bolt on somewhere to automate parts of your life.

Aside: I find Termux easier to use than Tasker. I'm a CLI native old man though, so don't take this as a knock against Tasker.

I had no idea Termux had access to APIs that allowed you to do that, this changes a lot.

You can SSH to your phone and rnu tmux and ffmpeg on it, which is more powerful than my netbook.

Because I don't want or can't use my shitty corporate issued laptop to access my personal projects from work.

Termux allows the same kind of scripting ability you would expect from a desktop. Termux-api almost rivals tasker in what you can automate with it. I use the "share with termux" function and git pull/push shortcuts more than anything else, and they are both effectively 1 touch functions. The share with termux function allows you to script how termux will respond to shared urls, I have it set up to auto-start yt-dlp and fill in certain formats and details and starts downloading. It was a little bit inconvenient to set up, but I managed without a fullsized keyboard. There's an app called hacker keyboard that makes it easy.

The original script I wrote was initially set up with youtube-dl, the most recent change was to yt-dlp. For a lot of little things, like to SSH/reboot my rpi, wget a link I want to archive/send, small python programs (and yt-dlp), the keyboard is perfectly adequate. I've even converted a couple of audio files to send to a friend on iOS, from opus to mp3 on the phone. Bash alias are really useful, and because the phone isn't also general use, they can be very specific.

Termux also makes the phone into a very powerful network diagnostics and pen testing tool. But even something as basic as ifconfig makes my phone feel as powerful as a computer. https://github.com/may215/awesome-termux-hacking

Chromebooks have the ability to install and run android apps. The lightweight environment afforded by Termux is perfect for them. I do use VIM with my chromebook. I know I can use crostini, and in the past I was running crouton, but I realized I can handle 99% of those things in termux, and I can use VSCODE dev for the remaining 1%. I appreciate how much more flexibility termux gives me.

https://wiki.termux.com/wiki/Termux:API

https://github.com/klausw/hackerskeyboard

In a pinch I've used it to ssh onto a box to fix something. I also have a script that backs up a few folders from the phone to a NAS using rsync.

Install Hacker's Keyboard from Google Play or F-Droid.

Some phone models supports docking. So you can attach screen, keyboard, etc

It's hostile that Android doesn't let you modify things like the host file. It's running Linux but it feels like it's not your device.

> I have ffmpeg and yt-dlp installed to download videos for when I am going to be away from internet access for a while

Have you tried NewPipe for that use case?

Yt-dlp exposes all of the codecs, I think I remember newpipe hiding some options when I last used it. I struggled to find how to download just the ~140k opus audio (-f251) or maybe the combination audio+video I wanted wasn't there. I'm sure things have changed since the last time I checked.

But Yt-dlp is still more powerful, it has extractors for way more sites. If I download a video, I usually care to archive it for a longer term, so I add things like subtitles and metadata. For opus files, I don't like the webm container, so I would end up installing ffmpeg for that anyway. I also make heavy use of the regular youtube app, I appreciate the interface. Although I haven't had the need, Termux + yt-dlp also allows using aria2c for downloading. And yt-dlp has also been useful in bandwidth starved situations, because the url and format flags are enough to get the video, it doesn't hang while waiting to download related/recommended video metadata.

FWIW I ran into the "To protect your privacy..." thing when using Syncthing. I was able to manually specify the path to one of those "protected" folders in the text input. It worked. Might be just the native file picker that's protecting users from granting access to folders albeit in a very shallow manner.

The restrictions are regarding specifying the root folders, /emulated/0 and /sdcard as well as android/data and /obb folders. You are able to pick folders, other than data and obb, manually one by one but that would be over a hundred folders on my sdcard to use a gallery app. The /data and /obb folders are inaccessible to users even though it's in user space. As of android 13, third party apps can't open /data or /obb, you have to install an app that creates a shortcut to the hidden AOSP files app and drag/drop manually. Rooting/usb gives you access, but play store guidelines about android app api targets make things difficult for third party apps.

By "protecting" users from security threats, they are pushing power users to daily drive a rooted device, which is a bigger security risk. I expect incomplete/broken file storage access from Apple devices, not Androids.

The thing I hate the most is that certain apps only store files in their respective android/data/ folder and delete that data on uninstall. These workarounds are the only way to backup that data.

https://www.reddit.com/r/Android/comments/j3zgmm/managing_fi...

> feel like I'm living my childhood dream of having a full computer in my pocket

While Android can provide such feel, GNU/Linux smartphones (Librem 5 and Pinephone) are such computers. And they do not depend on Google in any way. (I'm a happy owner of both.)

I understand the sentiment, but I disagree. From the last time I checked, the big compromise with GNU/Linux phones is still the lack of social media and messaging apps and appstore ecosystem. Android, with root, is every bit as much a computer as a Pinephone and Librem 5, but the opposite isn't true. Termux has PRoot, a user-space implementation of chroot allowing a full distro install. I personally don't have any problem depending on Google, I have a problem with things being locked away with no alternative. Given the option, I will happily accept the risks and void my warray to root.

https://wiki.termux.com/wiki/PRoot

> Android, with root, is every bit as much a computer

Can you install a completely different OS on your Android phone? AFAIK no, whereas on Pinephone you can choose among 15+ systems and on Librem 5 currently among 4 or more. What about installing a mainline kernel?

> lack of social media and messaging apps

You can use Waydroid for Android apps, or install one of a few Matrix and Mastodon clients. Telegram works, too. Also, Flatpak apps work natively.

> I personally don't have any problem depending on Google, I have a problem with things being locked away with no alternative

To me these sound like the same problem. Google is restricting your freedom, not someone else.

> Can you install a completely different OS on your Android phone?

You could in 2012, not sure about in 2023:

https://bonedaddy.net/pabs3/log/2012/12/03/debian-mobile/

> What about installing a mainline kernel?

I think Sony were working on that for their Xperia devices:

https://developer.sony.com/develop/open-devices/guides/kerne...

I think we fundamentally value different things from our mobile devices. Waydroid is a low level compatiblity layer, but that's still not native and not guaranteed compatibility. I want all social media apps to work, I don't want to ask others to change apps.

If you want full freedom from google, GrapheneOS feels like the best de-googled solution. In some ways, PRoot is to android what waydroid is to linux, except PRoot is way more capable. Google free AOSP, like GrapheneOS exists so it's not fair to say it's the same problem. I appreciate having access to things like Kali NetHunter and value that over being able to install and run a mainline kernel on bare hardware. I don't see a difference in installing a completely different OS vs PRoot, because I am focused on the functionality. I wouldn't be able to tell you a meaningful difference in function between iperf3 running on a Librem phone vs native termux vs PRoot.

Here's someone that's installed Termux on waydroid, installed on manjaro installed in Termux on an android phone. https://www.reddit.com/r/termux/comments/y0kupg/termux_on_ma...

https://github.com/termux/proot-distro

You should check out GrapheneOS as an alternative to regular Android.

I hadn't checked out GrapheneOS in a while. Based on the current trajectory, in a few years it might become more practical to add play services back into GrapheneOS rather than continue to fight Google's android releases. I have been doing the worst alternative possible, refusing to upgrade. I was even considering of upgrading to an older flagship. I require a phone with a microsd card and headphone jack on my phone, so that rules out a new GrapheneOS device for now, but I hope that changes.

I'm not sure I totally understand your Google Play Services comment but they do allow you to enable it and it's "sandboxed" whatever that means. Do you have specific gripes about their implementation?

They can switch to provide an UNIX like experience rewritten in Java/Kotlin instead, CLI and stuff, their option.

Google has been quite clear since NDK was introduced in Android 2.0, that is only for games and native methods implementations.

I felt the same way when I got my Nokia N900 back in the day

The Nokia n900 still seems almost mythical to me, because it has an fm transmitter. The galaxy note with an ir transmitter is a close second.

ok this is a really cool idea.

Reply on news.ycombinator.com