Hacker News Reader

Comment by gigel82 | Hacker News Reader

I'm curious what you think the alternative is, because Apple is definitely a lot worse, and we all know they're very much a duopoly.

BTW, all the GrapheneOS, etc. are still Android phones.

View on HN

I'm curious if GrapheneOS or other custom Android builds would be able to avoid these restrictions reasonably.

Obviously this is going to impact the supply of apps, since the market share of custom Android is smaller than even the market share of people willing to sideload or use an alternative store on a mainstream Android phone. Many developers might quit the game.

The problem with custom ROMs is that many government, banking, and similar apps don't run on them without workarounds. Some of those apps also consider this as a TOS violation as well.

Then I won't run those apps. Seriously. I know not everyone has this option, but it's been my experience that a lot of processes do in fact have workarounds when you show them the cryptic error their poorly behaved app throws.

When Microsoft first proposed a remote attestation scheme for PCs under the name Palladium, it was widely seen as a nightmare scenario. Even the mainstream press was critical[0]. There was barely a whimper when Google introduced Safetynet a decade later.

It wasn't OK in 2003. It wasn't OK in 2014. It isn't OK now. I'm just not sure what anybody can do about it.

[0] https://www.nytimes.com/2003/06/30/business/technology-a-saf...

I don’t use any utility apps (identity, banking, services etc) on my phone and stick to the desktop web. And don’t use services that do require me to have a Google or apple account and phone. (Spoiler: I do)

I hope my tiny datapoint shows up in some aggregated stats somewhere.

It’s use-it-or-lose-it.

I have been a GrapheneOS user since the Pixel 3 and have yet to encounter an app that doesn't work on GOS.

There are many third-party money apps that login to your online banking that are a violation of ToS. That doesn't stop people using them. In fact, when they get really big, they can be legitimised by banks. For example, to get my mortgage, I had to use a third party service that logs in to my online banking account and ingests all my transactions to show that I saved for my deposit legitimately.

GrapheneOS has offical support for hardware attestation[0].

It does require the developer to make minor adjustments, and most banks are simply too risk averse to agree to doing that (I would know, used to be a senior android app dev at a bank).

[0]: https://grapheneos.social/@GrapheneOS/115062761036828110

GrapheneOS uses a sandboxed version of Google Play Services, not the GMS certified devices they mentioned in the article.

Looks like they can avoid these restrictions:

https://grapheneos.social/@GrapheneOS/115090818389369737

> "GrapheneOS doesn't include Google Mobile Services and the requirements for certification aren't relevant to us."

I had a Jolla phone on my hands the other day and I must admit this…

SailfishOS is pretty nice

I might get one next

Buy Xperia 10 III while you still can. It's the best SailfishOS phone at the moment.

I have an Xperia 10 III, but it's running AOSP I built myself.

https://developer.sony.com/open-source/aosp-on-xperia-open-d...

Basically none of this new restriction will bother me, since I don't run anything but stock AOSP and get all my apps from f-droid repos.

Eventually you will need a new phone and by then probably all phones will be locked down.

Hunting for one rn

Thanks for the heads up

It's really nice when you first use it but if you have to use it as a daily driver it's pure pain. Rather go for graphene.

The alternative is just Apple; if Google loses enough users they might reconsider. Essentially the only real advantage Android had over Apple was being a more free platform/ecosystem; if they're going to do away with that, then they should be shown that this means they'll lose a lot of users.

Even with this change, Android is still more free than iOS by far.

GrapheneOS is a beautiful stop-gap, but there are real bona-fide Linux smartphones out there. To be clear, there are not many, the hardware often isn't great, the software often isn't great. PinePhone and Librem come to mind.

https://www.bunniestudios.com/blog/2020/introducing-precurso... This is the most secure phone that has been made recently.

Precursor is neat, but it isn't a phone.

Pretty sure Bunnie named it “precursor” because the plan is to make the actual phone (with a cellular modem) next. If I had the cash to support him and buy a Precursor I would.

Neat concept.

For anyone else failing to resolve DNS for that domain: https://archive.is/q7w0x

Per their spec sheet it doesn't have cellular connectivity, so it's not actually a phone.

And if what you want is a PDA that runs Linux, there are many options, e.g. https://www.clockworkpi.com/home-uconsole.

Cell carriers will just start requiring the attestation as well. And eventually, even an internet connection will - wifi routers will have to attest to ISP equipment, etc.

The final phase is "AI" monitoring everything you do on your devices. Eventually it won't just be passive, either, but likely active: able to change books you read and audio you listen to on-the-fly without your consent. It will be argued that this ok because the program is "objective".

At this point, I would stop using commercial cell carriers and ISP-provided equipment altogether, even if that means setting up mesh networks with an underground community. User control or bust.

I've been keeping an eye on FuriLabs (Furiphone). They maintain FuriOS - Debian with an Android kernel. Has a container for running Android apps. Price is reasonable though I don't know how it'll be affected by tariffs in the US. It's tempting.

https://furilabs.com/shop/flx1/

In addition to the PinePhone and Librem 5, you can also put postmarketOS on some faster Android phones like the OnePlus 6T.

I really wanted to like Librem and almost bought a phone until I saw this video by Louis Rossmann: https://youtu.be/wKegmu0V75s?si=NzevsJgHD188bRkT

>real bona-fide Linux

Android is decades ahead of that in security, functionality, utility, devex, and design. It's a fools errand to try and modernize that, over building on top of AOSP.

Reply on news.ycombinator.com