aosp-build VS hardened_malloc

I've been using LineageOS since the good ol' CyanogenMod days and I am very grateful for how much work the developers put into it day in and day out.

Thanks to them, I managed to get rid of Google Apps in my day-to-day life almost[0] entirely and drastically improve privacy for me: Instead of Google Play Services I use MicroG[1] and instead of Play Store, I use Aurora Store[2] and F-Droid. For syncing files there is Syncthing[3] and for backups there is Seedvault[4]. To isolate apps I don't trust I use NetGuard[8] and Shelter[9] and practically no internet-facing app has access to my internal "SD card" on which my photos and documents reside. As a bonus, getting rid of GApps and using LineageOS has increased my phones' battery life and their overall lifetime tremendously. (I've only owned three smartphones in my entire life, the original T-Mobile G1, the HTC One M8 and the BQ Aquaris Pro.) I couldn't be happier.

That being said, I've closely been following GrapheneOS[5] because I find its additional security guarantees very attractive. In fact, just a few hours ago my new Pixel 5 arrived and I'm looking forward to giving it a try. Though I already know I will miss MicroG… Maybe I'll end up building my own custom Android ROM, using Hashbang or RattlesnakeOS[6, 7]?

Overall, I don't really understand people who criticize Android for not being open while loudly claiming a "pure" Linux phone would be so much better. (There was yet another discussion here on HN just a few days ago.) Yes, Android is a not your typical open-source project and clearly in the hands of Google. Yes, most phone and chip manufacturers still haven't open-sourced their hardware binary blobs. We definitely have to fight these fights. But with a Linux phone I'd probably be struggling with window-manager-related bugs in the worst possible moments (say, an emergency call) and risk all my data getting stolen whenever I install a new app.

As much as I like Linux – I dabbled with it the first time almost two decades ago and have been using it as a daily driver for more than a decade – but its stability and, especially, security guarantees are orders of magnitude worse than Android's.

I secretly hope that Fuchsia will find its way to the desktop at some point and be able to replace my Linux system.

[0]: I still use Google Maps every now and then

[1]: https://microg.org . See https://lineage.microg.org/ for LineageOS images that come with MicroG pre-installed.

[2]: https://auroraoss.com/

[3]: https://syncthing.net

[4]: https://github.com/seedvault-app/seedvault

[5]: http://grapheneos.org/

[6]: https://github.com/hashbang/aosp-build

[7]: https://github.com/dan-v/rattlesnakeos-stack/

[8]: https://netguard.me/

[9]: https://f-droid.org/en/packages/net.typeblog.shelter/

Relevant copypasta:

Fellow humans, there are alternatives to Google and Apple! Your neck need not be under anyone's boot! You don't even need to give up any functionality:

Data service:

The simplest thing is to buy a prepaid SIM and top it off with cash. The lovely people over at /r/nocontract maintain a big spreadsheet so you can filter by various properties of the available contracts.

Another way to go is to pay for a postpaid plan with a virtual credit card (VCC) like at privacy.com. It won't be linked to your name at the telco, but of course privacy.com knows who you are. There is also Abine Blur, and some others.

Yet a third way to go, which is nascent, is buy an eSIM with crypto. You can also buy prepaid VCCs with crypto.

An interesting new choice is PGPP https://invisv.com/pgpp/ who rotate your IMSI and do some other cool stuff. It works by e-sims.

All these methods make you /pseudo/nymous, but obviously you're still identifiable by subscriber number and possibly IMEI, to put aside correlational things like your traffic profile. You can help this problem by routing everything through a VPN. Then you're pseudonymous but the cell carrier knows nothing about you other than that you use a VPN. Pay for the VPN with crypto. Of course now the VPN provider knows your traffic, but you're much more anonymous to them than you are to a telco. You make your choices. Defense in depth. Etc.

OS:

GrapheneOS: https://grapheneos.org/ Very much like Calyx, but extra-hardened and with no MicroG. No involvement with Google at all by default. You can make a secondary profile in which you install Google Play Services to set up an environment where you can run unprivileged Play services + whatever crapware you need that requires them. Unprivileged here means it's like any other app: if you don't give it access to your location, it won't know where you are. If you end the profile session when you leave, Play Services stops running and stops talking to Google.

CalyxOS: https://calyxos.org/ Privacy-respecting Android distribution that replaces Google spyware with MicroG, so you can have your cake and eat it too. Most everything will work as you're used to, but it does still talk to Google to make that happen.

LineageOS: https://lineageos.org/ The successor to CyanogenMod, will work with many different phones. More privacy and control than stock Android.

There are also many others: Sailfish, Replicant, e

Hardware:

CalyxOS and GrapheneOS run best on Pixels. The path of least resistance is to get one of these phones and run GrapheneOS with Google Services installed in one profile or other.

You could also buy a Librem 5 https://puri.sm/products/librem-5/ If privacy and security and hacking are really important to you.

Or a pinephone: https://www.pine64.org/pinephone/

Neither work very well by regular standards, but they're cool :-)

It might be worth to switch to GrapheneOS if you have Pixel phones: https://grapheneos.org/

It is a more serious project than LineageOS in the sense that they take security very seriously and they take their development more professionally too. There are no disadvantages to using GrapheneOS compared to LineageOS.

You can see a comparison here: https://eylenburg.github.io/android_comparison.htm

If it still powers up but just won't boot you could try installing https://grapheneos.org/.

On 4thgen Pixels and up you can install GrapheneOS which is a security and privacy focused Android build. It does not come with any Google services pre-installed but you can put them on. https://grapheneos.org/

yes... will also de-google it cuz we can install GrapheneOS and also close the bootloader