Hacker News Reader

Comment by deng | Hacker News Reader

Has the author of this article ever used a custom ROM? There are so many free alternatives for these apps out there. If I remember correctly, LineageOS ships with their own version of Dialer/Messages anyway. I usually replace them with the versions of SimpleMobileTools, which work just fine.

The main difficulty for custom ROMs are not these standard apps. The real issues are bootloaders which cannot be unlocked, undocumented binary&buggy firmware blobs, SafetyNet, Google Play Services, and so on. Just look how Google effectively broke the AuroraStore App recently. It's getting more and more difficult to use Android without a Google Account.

View on HN

> Just look how Google effectively broke the AuroraStore App recently.

For anyone who has been hit by this, you can workaround the api issue by long pressing on a playstore http link and clicking open in app (aurora icon).

So you can't search using the app anymore, but if you have the link to what you want you can still install without playstore or a google account.

It's frustrating but isn't the end.

It's infuriating how hard Google makes it to manually update apps. We really need to dig down that awful play store. Aurora is just there, at the start. Really hope the community finds a way to keep aurora working

Not a very clean solution but if someone (power user) wants to avoid the playstore entirely, they can perhaps do so by simply force-disabling the app (using tools like adb), and then use something like apkmirror[1] or apkpure[2] or aptoide to install the APKs for the apps directly and bypass the store entirely?

[1] https://www.apkmirror.com/

[2] https://m.apkpure.com/

Have you looked at Obtainium? https://github.com/ImranR98/Obtainium It can use apkmirror and apkpure as sources. Along with lots of others.

I'm not particularly security conscious, but this seems very vulnerable to malware.

How so?

How does one verify the integrity of the APK's?

I mean, no more than getting things from apkmirror/apkpure? This is just an easier way of doing it.

Personally I mostly just use it with github, and checking the integrity of those apks is easy enough.

The problem with installing APKs directly is that you probably never update these apps again, as you'd have to manually check if you still have the current version and then download the new APK and install it again. At least that's what happened with the apps I installed that way.

As someone who loathes auto-updating applications of any sort, this is more of a win than a loss.

But it's not just auto-update. I can disable auto-update in the Google Play Store, but at least I easily see if updates are available and can still selectively update apps with the press of one button.

For me, the better solution would be F-Droid. Easy update process but the apps are mostly open-source etc.

Ah, good point. That convenience is not terribly important to me, so I didn't consider it.

fair :)

It is a win for me not to auto-update, as Termux is very precious (to me) and I would hate to see it lose more functionality or completely stop working.

Actually, it seems they have mostly fixed this, but I had to clean the app data to make it work again. Sometimes you get "Oops, you are rate limited", but that was just temporary.

For anyone who is unable to get the "Open in App" to open in Aurora (and not F-droid), check that you've actually clicked on the App webpage and that you're not just in the search page (play.google.com/search?app=blah, for example is bad)

Search was broken for me a week ago, but it suddenly worked a few days ago.

After spelunking into the dialer source code a bit, it seems the important stuff related to receiving and initiating calls are already handled by android's TelecomManager and the dialer only provides interface for users to interact with TelecomManager.

I haven't really dig into Messages source code these days, but a few years ago I was making an app that can send MMS messages and it was insane how much heavy lifting a messaging apps have to do in order to send MMS reliably on any carrier. Losing the default Message app might be a big blow considering so many 3rd party message app still can't do MMS right (at least the last time I checked). For example, people are still posting MMS issues on the github repo for SimpleMobileTools app you mentioned.

QKSMS which I installed through F-droid works pretty well for me for years, FWIW.

I can second the recommendation for QKSMS, it's simple and reliable in my experience.

Telefonica in Germany is sunsetting MMS end of this year (sending and receiving).

In this problem, RCS is far more of a potential loss than MMS due to how few other apps support that cluster of a standard.

> The real issues are bootloaders which cannot be unlocked

I haven't run in to that lately, but an issue I find much more annoying is the lack of support around re-locking with a custom root of trust. I think a few others support it, but I've only seen mention of it on the Pixel phones (and I won't buy Google hardware after they wouldn't replace my Pixel 3 that was bricked by their EDL hardware issue).

You are right, this is another issue. With an unlocked bootloader, you'll not be able to fully pass SafetyNet, for instance. I've also seen some forum posts that this should be possible for Motorola Moto G phones, but there were some warnings that if you do that, you might not be able to unlock your phone ever again, so I've never tried...

You can bypass safetynet even with an unlocked bootloader. I'm using Lineage 20 with microg and with a bit of work with magisk modules you can get it to work. I just feel like this is again another "security feature" to make it harder for people who don't want google in their phones.

To my knowledge, there are different levels of passing SafetyNet. I also use Magisk to hide root and use the safetynet-fix-module, but it still detects the unlocked bootloader. However, for instance my banking apps run fine as long as they don't detect root, but I hear stuff like Netflix will not work (which I don't care for).

According to John Wu, author of Magisk, it is not possible anymore to hide the bootloader/safeboot status via Magisk (https://nitter.lacontrevoie.fr/topjohnwu/status/123783055552...). I don't think that situation has changed.

> but I hear stuff like Netflix will not work (which I don't care for)

This is Widevine DRM, most devices with the Magisk workarounds will get at least L3, which gives you standard definition netflix. Need L1 for HD and only a few phones unlock bootloader reliably and keep it (my Oneplus 8T does, 9 pro does not)

Yes, but this title is much more clickbait than just "Google stops developping 2 open source apps".

if only they were open source, then anyone else could take over

Yeah it really shows why the GPL is necessary.

"You can see this apps, and you can develop for them. But you can't use them on your own device ..."

GPL explicitly demands that a method is provided to replace the binaries on devices that the software runs on. Which is one of the reasons the tech giants are so opposed to it. The other reason is cloud.

I was joking, I don't see a reason you can't use them on your own device

>LineageOS ships with their own version of Dialer/Messages anyway.

They use slightly modified AOSP versions. This isn't the first time a major AOSP app was dropped, the biggest was the built-in email client like 4 major Android releases ago. Also the calendar app was replaced by Etar a few releases ago (can't remember if AOSP's calendar was deprecated or just a piece of shit).

> It's getting more and more difficult to use Android without a Google Account.

Good that is how they shoot themselves in the foot. The more they do this, the more people will realise they need alternative and ditch Android.

99.9% of consumers do not care about this and are totally willing (and expect) to connect their phone to their Google/Apple account

Not saying the grievance isn't valid, but don't fool yourself

Well, it's not like they have a choice, isn't it?

Hmm I think it's getting pretty easy today to get a de-Googled Android phone that "just works". You can buy Murena phones that come with /e/OS pre-installed (I did that). Probably the same with GrapheneOS/CalyxOS/etc.

Users are lazy and don't want to take such a risk, but they do have a choice.

> Hmm I think it's getting pretty easy today to get a de-Googled Android phone that "just works".

This is a wild exaggeration.

I literally bought a Fairphone 3+ that came with /e/ OS pre-installed. It gets updates like a normal Android, I never had to care about the fact that it is not a normal Android (i.e. I never had to run a weird installer or anything at all).

How is that not "pretty easy"?

It doesn't take a 100 million people to build a new phone ecosystem. Only a few thousand, if even that. If there is no alternative, it will get built and be usable. I avoid other open phone projects because I don't have the time and AOSP works fine, but if Google breaks it beyond usability, you better believe I'll be jumping onto one of the fully open projects even if it has major limitations.

If Google "breaks" AOSP, I am pretty sure that the next big thing will be a fork of AOSP. But that would probably be bad for Google (they probably wouldn't want Samsung + Huawei + others to start maintaining a fork of AOSP, I think).

As far as I understand the distributor licensing for Googles apps and services outright prohibits manufacturers from selling any unapproved or Google free Android devices in countries where that isn't considered anti competitive.

It's a pretty weird subject: the document that has been mentioned in the press about that requirement doesn't exactly say that Google app are required, it says that when you do an "Android" it must always comply to Android APIs. Which can be done without Google apps. BTW that agreement still exists even where it was deemed anti-competitive, but in domains where Google isn't a monopoly (like cars).

That being said, it's Google. Even you didn't sign anything that says you're not allowed to do Google-less Android, when you launch a non-Google device, Googly devices may just "mysteriously" fall into "oops sorry we are understaffed, we don't have time to handle your requests".

I don't know where you can find that "only a few thousand" people or the funding. I don't know if one can even count the number of failed attempts at a mobile operating system.

Do you not participate in any open source communities? Many have thousands of participants, even obscure Linux window managers.

99.9% of consumers probably have never heard about custom ROMs, and I'd reckon 99.9% of consumers who do hear about custom ROMs have boring old fashioned objections like "will it break my warranty" and "if it ain't broke don't fix it" and "I wonder what's on Netflix tonight/I think I shall be washing my hair".

For the few people who distrust Google enough to install LineageOS or some such, they probably distrust Google enough to not care too much about not using Google. Who is in this sweetspot where they want (i.e. install and use, not merely aspire to installing and using) a custom ROM but having no access to proprietary Google APIs is a bridge too far?

I have been using GrapheneOS for a couple of years and I feel frustration about this announcement. At the same time, sounds like not much of a biggie, but I'd prefer the burden of updating the apps not to be on the GrapheneOS contributors.

On the other hand, I can see Google's arguments and "plausible deniability" that this is not Embrace, Extend, Extinguish: really nobody expects them to "Don't be Evil" anymore, security vulnerabilities in these apps are probably the last thing in their priorities, and the target audience for these apps is really small.

Those apps have been forked any number of times already, there are plenty of dialers the grapheneos maintainers can use.

"What is Android ? Well you see, there are various operating systems out there. An operating system is the software that allows you to use your hardware. So for example you may be familiar with Windows, macOS or Linux..."

- Stopped listening 30 seconds ago

> they probably distrust Google enough to not care too much about not using Google

I think you probably greatly overestimate how much normal people worry about things like that.

Look out your window and count how many tinfoil hats you see people with. If there's more than maybe one or two, you live in a fairly atypical part of the world and it might be time to move house.

It's part of the recurring pattern of blindness towards the actual level of caring among average service users. Reddit is another example of this pattern. Mind you I say this as the minority who cares.

Less "blindness" and more "active hostility" in my opinion. Unpopular updates? Bad licensing? Privacy problems? Just double and triple down. There's no realistic alternative, so why listen to those pesky users?

I absolutely loathe today's smartphone landscape. You can have a semi-locked-down phone from a company that wants you to put all your data in the clown, or you can have a fully-locked-down phone from a company that wants you to put all your data in the clown. Worse, the only alternative that had a chance just had to be Microsoft. Watching the horror show of post-7 Windows, I think we dodged a bullet with Windows Phone going nowhere.

The masses aren't going to flock to any potential alternative unless it offers something they find truly compelling.

And go where? Apple? How exactly is that any better in this regard? It's even more of a walled garden. If you mean custom ROMs, they have huge issues of their own making them a non-starter for 99.99% of the population.

Just like they've ditched Windows?

People don't care about Android. They care about their apps. Some are fun, some are necessary. In my country, cash has been almost replaced by an app (just one), and it's getting harder to exist here without it (as I try to). That's just one example. I've heard of other places where compulsory national ID systems only exist as apps. And so on.

Unless those apps becomes available outside official app stores, switching is going to be de facto impossible, and people will take whatever shit Google and Apple roll out.

Where do you live?

A compulsory national ID system already means they are living in a police state, so they have worse issues to worry about than this.

Also, maybe at some point the UE countries will start to enforce the CJUE directive that banned US companies (and especially GAFAMs) in 2015 (after the war is over ?), this would open quite a space for competition !

> A compulsory national ID system already means they are living in a police state

Such a bizarre take.

Many countries have national ID systems that are compulsory (or effectively compulsory) and do not fall under any reasonable definition of a "police state"

I never understood this. Do you have a driver's license? Do you have a job? Do you but stuff? Have a bank account? a credit card? health insurance? Do you use the internet? Do you pay taxes?

You are already in a lot of national databases, you're easily trackable already. You already are subject to all of your alleged downsides without the benefits of having a single document.

Do you really believe that an American has more freedom than, let's say, a Switzerland citizen? Really????

To be fair, other OSes can use the Google Play store, at least. Way back, Blackberry was somehow able to run Play Store apps, and as I understand it, many of the alternative Android roms can also use the Play Store if you wish. I'm not sure how well apps from that actually work on these phones, but most of these custom roms are AOSP anyway, so in theory it should be fine.

Apple is completely different of course: you're either in or you're out.

It would be nice if the alternative Android roms were better supported.

But you're completely correct; some apps really are almost necessary for daily life these days, depending on where you are.

Following the death of Windows phone and the earlier death of Symbian, the two options are "Android" or "iOS". This is apparently "not a monopoly".

Well, it's a duopoly. Which, since it is not literally a monopoly, often gets a pass.

Have a country with a single party you can vote for? This country will be called a dictatorship, dystopian shithole, undemocratic, whatever... Have a country with two parties which are marginally different you can vote for? Now it's just a normal democracy.

For all practical purposes, customers don't care about that. And the minority who cares is going to do what? move to an even more restrictive walled-garden?

Reply on news.ycombinator.com