hardened_malloc VS GmsCore

Relevant copypasta:

Fellow humans, there are alternatives to Google and Apple! Your neck need not be under anyone's boot! You don't even need to give up any functionality:

Data service:

The simplest thing is to buy a prepaid SIM and top it off with cash. The lovely people over at /r/nocontract maintain a big spreadsheet so you can filter by various properties of the available contracts.

Another way to go is to pay for a postpaid plan with a virtual credit card (VCC) like at privacy.com. It won't be linked to your name at the telco, but of course privacy.com knows who you are. There is also Abine Blur, and some others.

Yet a third way to go, which is nascent, is buy an eSIM with crypto. You can also buy prepaid VCCs with crypto.

An interesting new choice is PGPP https://invisv.com/pgpp/ who rotate your IMSI and do some other cool stuff. It works by e-sims.

All these methods make you /pseudo/nymous, but obviously you're still identifiable by subscriber number and possibly IMEI, to put aside correlational things like your traffic profile. You can help this problem by routing everything through a VPN. Then you're pseudonymous but the cell carrier knows nothing about you other than that you use a VPN. Pay for the VPN with crypto. Of course now the VPN provider knows your traffic, but you're much more anonymous to them than you are to a telco. You make your choices. Defense in depth. Etc.

OS:

GrapheneOS: https://grapheneos.org/ Very much like Calyx, but extra-hardened and with no MicroG. No involvement with Google at all by default. You can make a secondary profile in which you install Google Play Services to set up an environment where you can run unprivileged Play services + whatever crapware you need that requires them. Unprivileged here means it's like any other app: if you don't give it access to your location, it won't know where you are. If you end the profile session when you leave, Play Services stops running and stops talking to Google.

CalyxOS: https://calyxos.org/ Privacy-respecting Android distribution that replaces Google spyware with MicroG, so you can have your cake and eat it too. Most everything will work as you're used to, but it does still talk to Google to make that happen.

LineageOS: https://lineageos.org/ The successor to CyanogenMod, will work with many different phones. More privacy and control than stock Android.

There are also many others: Sailfish, Replicant, e

Hardware:

CalyxOS and GrapheneOS run best on Pixels. The path of least resistance is to get one of these phones and run GrapheneOS with Google Services installed in one profile or other.

You could also buy a Librem 5 https://puri.sm/products/librem-5/ If privacy and security and hacking are really important to you.

Or a pinephone: https://www.pine64.org/pinephone/

Neither work very well by regular standards, but they're cool :-)

It might be worth to switch to GrapheneOS if you have Pixel phones: https://grapheneos.org/

It is a more serious project than LineageOS in the sense that they take security very seriously and they take their development more professionally too. There are no disadvantages to using GrapheneOS compared to LineageOS.

You can see a comparison here: https://eylenburg.github.io/android_comparison.htm

If it still powers up but just won't boot you could try installing https://grapheneos.org/.

On 4thgen Pixels and up you can install GrapheneOS which is a security and privacy focused Android build. It does not come with any Google services pre-installed but you can put them on. https://grapheneos.org/

yes... will also de-google it cuz we can install GrapheneOS and also close the bootloader

I, an engineer, am not doing this myself, too. There is a middle ground though: just use a privacy-oriented Android build, like DivestOS. [1]

There are a couple caveats:

1. It is still a bit tricky for a non-technical person to install. Should not be a problem if they know somebody who can help, though. There's been some progress making the process more user friendly recently (e.g. WebUSB-based GrapheneOS installer).

2. There are some papercuts if you don't install Google services on your phone. microG [2] helps with most but some still remain. My main concern with this setup is that I can't use Google Pay this way, but having to bring my card with me every time seems like an acceptable trade off to me.

[1]: https://divestos.org/

[2]: https://microg.org/

I have been running de-googled LineageOS since before it renamed/reformed from CyanogenMod, so since somewhere around 2013/14. That has looked rather different depending on what exactly I need from my phone but I'll share what my current set up looks like.

First, I have don't use any kind of Google/Samsung/Apple Pay wallets so if you do, this may not be helpful; I've never looked into trying to get any of those working. Also, by "de-googled" I mean that I don't have GApps installed on my phone. I do have microG[0] installed as a Magisk[1]/LSPosed[2] module; this allows a few apps to believe I have GApps while most apps do not see/have access. I do not turn on microG for any apps (i.e. no connection to the Google servers/services via microG).

Most of my apps come from F-Droid[3], a few from Aurora Store[4] (a 3rd-part frontend for the Play Store that does not require either an account or GApps installed), a very few from FFupdater[5], and have played with using Obtanium[6] but currently only have one (weather) app updating via it. I have several different repositories configured in F-Droid but I don't generally keep mental track of which repository I am dependent on for which apps; the default, IzzyOnDroid[7], Bitwarden[8], NewPipe[9], microG[10], and Collabora[11] are some of them.

I have two banking apps installed via Aurora Store, one of which requires microG and root-hiding (via Magisk module) while the other doesn't require either. My browsers (Firefox, Firefox Klar, Brave) come from FFupdater and none require microG. My texting (QUIK SMS), email (K-9 Mail), TOTP authenticator (Aegis), password manager (Bitwarden), GPS/Maps (OsmAnd), file syncing (Nextcloud), notes (Nextcloud Notes), HN reader (HN), and Contacts/Calendar sync (DAVx5, ICSx5) apps all come via F-Droid (either the main repo or others). I have many others apps which come from F-Droid or Aurora Store but the above are my most used.

For file, calendar, notes, photo, & contact syncing, I have a Nextcloud server set up and find it to work quite well; the Nextcloud apps are also quite good. Someone who doesn't want to run their own could use a hosted account[12]. Contacts & calendars are synced to Nextcloud via DAVx5 & ICSx5.

The primary challenges I am aware of at this point are hardware (it is increasingly difficult to install LineageOS on most hardware due to bootloader locks), and navigation (OpenStreetMap data usually doesn't include addresses in the USA). For hardware, the solution is essentially just to properly research the phone you want to buy; I always make sure the model is well supported by LineageOS before purchasing and then tend to hang on to it for several years. For navigation, I usually find the address on my desktop or mobile browser (via DuckDuckGo) and then manually input the location into OsmAnd before the trip but I also keep WeGo Here maps installed in case I don't have time for that (it usually takes <2 minutes and rarely more than 5 to manually find & enter the address). Additionally, getting the one banking app to work without GApps was a pain in the butt initially (requiring testing several Magisk & LSPosed modules), but now it just works and I don't really think about it.

Overall, I don't find my version of de-googled to be a detriment; my phone is useful and I have more control over my data and over annoyances (such as unnecessary notifications) than I would otherwise.

[0] https://microg.org

Is anyone here daily-driving microg and can share their experiences? https://github.com/microg/GmsCore/wiki/Implementation-Status does not exactly inspire confidence.

...will need to be rewritten to avoid Google Play Services.

Not true.

All that needs to happen is for open source developers to "re-implement Google’s proprietary Android user space apps and libraries".

https://microg.org/

microG itself connects directly to Google: https://github.com/microg/GmsCore/wiki/Google-Network-Connec...

No shit, of course they do.

>In general, we obviously try to minimize the connections to Google, but some services strictly rely on them and would just not work without.

What exactly do you think they should do instead?

MicroG

In release notes for GmsCore v0.2.29.233013 (https://github.com/microg/GmsCore/releases/tag/v0.2.29.233013), I also see:

Yes, the Xposed module is one way. There are also other ways

Which one should I use? Is this MicroG's official website right? (https://microg.org/)