Our great sponsors
-
-
-
InfluxDB
Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.
-
-
-
-
WorkOS
The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.
-
rattlesnakeos-stack
Discontinued Build your own privacy and security focused Android OS in the cloud.
-
-
rethink-app
DNS over HTTPS / DNS over Tor / DNSCrypt client, WireGuard proxifier, firewall, and connection tracker for Android.
-
serverless-dns
The RethinkDNS resolver that deploys to Cloudflare Workers, Deno Deploy, Fastly, and Fly.io
-
bromite
Bromite is a Chromium fork with ad blocking and privacy enhancements; take back your browser!
-
SaaSHub
SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives
> I did not want to get into this, but you're simply spread falsehoods.
I'm not spreading any falsehoods. I'm not the one being dishonest and putting out a bunch of falsehoods in marketing materials misleading people.
> We do not ship anything proprietary.
You ship integration of proprietary services including Google services and WhatsApp. You provide them with privileged integration unavailable to other apps.
> We ship microG, which is "A free-as-in-freedom re-implementation of Google’s proprietary Android user space apps and libraries." - see https://microg.org/
i.e. an implementation of proprietary Google services.
> We ship an integration with WhatsApp in the Dialer, which is entirely open source code. It is based on the existing contacts mechanism (anyone who has WhatsApp or Signal on any Android will see entries for those in the Contacts app - that is what we expose to the Dialer to make it easy to use those to make end-to-end encrypted calls.
i.e. integration of proprietary services into the OS in a way that isn't available to other apps.
> In fact, you're the one who's promoting your approach of being able to run the proprietary Play Services - and yet you say you don't ship integration of proprietary services. Which is it?
GrapheneOS does not include any form of Play services and has no support for the OS using it. If a user installs Play services, the OS detects it and intercepts the attempts it makes to use privileged APIs and instead returns placeholder data.
With microG, the Play services code is still present in each app using it. microG is an additional trusted party, not implementing the same level of transport security or other security checks and does not avoid trusting the Play services code to exactly the same extent.
> You can't ship Play Services legally anyway.
Not actually true. Do you claim that stuff like firmware cannot be shipped too?
> Aurora Store does not get unattended installation permission, it never has. It can only update installed apps, which is what Google is allowing in Android 12.
No, they're allowing it in a more secure, restricted way rather than what is implemented in CalyxOS. Look at the list of requirements for an unattended app update via the Android 12 API.
> F-Droid Privileged Extension is extended, and both that and F-Droid have received security audits in the past which haven't found issues - and the Privileged Extension itself hasn't changed much since then. We're very careful about making any changes there.
Shallow security audits in the past is meaningless. F-Droid is an API 25 app (Android 7.1) with a a metadata signing system with the same weaknesses as Android's deprecated v1 signature scheme and massive attack surface. It bypasses the standard OS security model for determining sources of apps rather than respecting it. This is incompatible with the expected the security model for unattended app updates in Android 12.
> It is one thing to give constructive criticism to projects, it's another to attack them directly based on falsehoods.
I'm not doing that. Rather, that is what you folks have been doing at every opportunity in these threads. I've only posted here to defend us from malicious misinformation being spread by you folks. You're engaging in that yourself and can't claim to be uninvolved.
Thank you for bringing this up.
We're continuing to fund work on it, both ourselves and also through applying for external funding.
Full Storage backup support (Files / Photos) was recently added thanks to a grant from NLnet - https://nlnet.nl/project/Seedvault/index.html
https://github.com/seedvault-app/seedvault Contributions welcome!
...Well i don't use my phone for much more than that.
Battery Life is great, Security and Privacy is also good. You can lookup App Compatibility to a degree here: https://plexus.techlore.tech/
You're looking for Privacy Dashboard, which is available as a 3rd-party FOSS standalone app[1] or built into Android 12.
[1] https://github.com/RushikeshKamewar/PrivacyDashboard
I purchased a Pixel phone to test this stuff on.
I installed LineageOS and found I couldn't run some google apps. I reinstalled LineageOS with https://opengapps.org added during the install and made the mistake of transferring from my old phone which brought all the google services and everything back to the phone (mostly).
I then installed CalyxOS - much easier install process than lineage. Really liked the defaults. Could not get many apps that relied on google play services though. If I didn't need so many Google-tied apps I would pick this as my phone OS for basic stuff like messaging and browsing.
Installed LineageOS again, found there were a couple apps I could not get working after all (50 different apps installed).
In the end I gave up and re-flashed Google firmware back onto the phone. I though I could get away from Google but I didn't realize how much my apps needed Google.
Mozilla Location Services is crowdsourced, and you can contribute data from your area with the Tower Collector app to make geolocation faster for you:
https://github.com/zamojski/TowerCollector
> Yeah GrapheneOS is security over privacy
No, GrapheneOS is heavily focused on both privacy and security. See https://grapheneos.org/features for a list of the enhancements compared to the latest Android Open Source Project. GrapheneOS offers substantial privacy advantages over CalyxOS. It has a bunch of nice privacy improvements, carefully designed to work against real adversaries. Bypasses of privacy features are taken very seriously and prioritized as security vulnerabilities. GrapheneOS also doesn't integrate proprietary apps/services into the OS. We'd never stick WhatsApp support in the Dialer or ship Google services integrated into the OS in a special way not available to other apps. Services should be on an equal playing ground. That's the real issue with Play services and with iOS too.
GrapheneOS has full MAC randomization, DHCP anonymity and doesn't reuse IPv6 addresses across networks.
GrapheneOS has the Network permission toggle for disallowing both direct and indirect network access. Calyx takes an approach that allows apps to bypass it via APIs gated by the INTERNET permission. It also has other bypasses. They present it as a firewall app with a fancy name, but it's just a UI for the AOSP firewall and it doesn't really work as they present it. https://gitlab.com/CalyxOS/calyxos/-/issues/454 acknowledges the issue but presents an unworkable plan to address it. The approach doesn't work. Similarly, fine-grained filtering of domains/addresses in most firewalls even as a whitelist doesn't work due to DNS acting as 2-way communication via a permitted IP to arbitrary third parties. These indirect forms of access can't simply be ignored.
GrapheneOS has the Sensors toggle to disallow apps from accessing the miscellaneous sensors usable for coarse movement (which can map to location) and audio recording among other things.
It has substantially privacy improvements beyond these things, but they're some nice examples. I strongly recommend looking through https://grapheneos.org/features and keep in mind it does not list AOSP features as most projects would. Avoiding bundling third party apps and services is explicitly listed as a feature rather than listing out integrating proprietary services and assorted apps.
GrapheneOS is also focused on usability, and it's hard to deny that https://grapheneos.org/install/web is a very nice way of performing the install. The fastboot.js library powering it is a project we funded.
> and has a bit more mainstream appeal with MicroG, supporting push messaging and location services etc
Location works properly on GrapheneOS, as do notifications.
https://grapheneos.org/faq#notifications
GrapheneOS has a sandboxed Play services compatibility layer for running Play services with zero special privileges:
https://grapheneos.org/usage#sandboxed-play-services
Despite being very new, it's already rapidly moving beyond what microG supports. It doesn't require making the security sacrifices of microG by losing the standard security checks and key pinning. It also doesn't make privacy sacrifices: it provides Play with zero additional access. Apps using Play include the Play client libraries. Many of these fully work without Play services installed, including Google's Ads library. That only has a hard dependency on Play services if apps use the Lite variant: https://developers.google.com/admob/android/lite-sdk. The claims about microG privacy/security benefits are not just overstated but backwards. It also only implements a tiny subset of the API.
Sandboxed Play services compatibility layer is another much more broadly application project funded by us, among others.
> GrapheneOS has also pioneered a lot of security measures, a lot of which have been added to Android proper (if you see their feature log, a lot of it says "removed because it was introduced in Android").
We're also implemented a lot of substantial privacy measures. There aren't really distinctions between these things. GrapheneOS helped get substantial app sandbox restrictions into AOSP restricting the information available to apps.
CalyxOS is an awesome project. I have worked with the lead developer a bit over the past few years and it's been such a pleasure. We share some bits of code between our projects here: https://github.com/AOSPAlliance.
If anyone is interested in building their own custom android OS in the cloud (AWS) with same ability to lock your bootloader like CalyxOS, you can checkout my project I've been maintaining for a few years now called RattlesnakeOS: https://github.com/dan-v/rattlesnakeos-stack.
And if you prefer to not build in the cloud, there is also a really great project called robotnix (https://github.com/danielfullmer/robotnix) which provides a way to build many flavors of OS (AOSP, GrapheneOS, LineageOS, etc).
CalyxOS is an awesome project. I have worked with the lead developer a bit over the past few years and it's been such a pleasure. We share some bits of code between our projects here: https://github.com/AOSPAlliance.
If anyone is interested in building their own custom android OS in the cloud (AWS) with same ability to lock your bootloader like CalyxOS, you can checkout my project I've been maintaining for a few years now called RattlesnakeOS: https://github.com/dan-v/rattlesnakeos-stack.
And if you prefer to not build in the cloud, there is also a really great project called robotnix (https://github.com/danielfullmer/robotnix) which provides a way to build many flavors of OS (AOSP, GrapheneOS, LineageOS, etc).
RethinkDNS + Firewall: https://github.com/celzero/rethink-app
TrackerControl has a tad better UX, but is built on top of NetGuard and hence inherits its flaws and merits.
For instance, it does not support DoH/DoT/DNSCrypt.
It also leaks DNS connections over TCP (this happens when a DNS question or answer payload is too big to fit in a single UDP packet). In fact, all userspace DNS clients on Android I have taken a look at, leak DNS over TCP.
TrackerControl does not trap all packets over port 53, which RethinkDNS does by default.
TrackerControl isn't geared towards bypassing censorship. RethinkDNS can bypass stateless firewalls employing a similar trick to GreenTunnel, but we plan to implement a couple more such mitigations.
Unimplemented but soon, RethinkDNS would let users block connections if apps don't resolve DNS with a resolver of their choosing.
RethinkDNS has open-sourced both its client app and a pi-hole like stub resolver: https://github.com/serverless-dns/serverless-dns
There's three of us working on RethinkDNS full-time, so it is likely to see feature development at a faster clip than TrackerControl and NetGuard (the latter's been put under maintanence mode by the original developer).
RethinkDNS + Firewall: https://github.com/celzero/rethink-app
TrackerControl has a tad better UX, but is built on top of NetGuard and hence inherits its flaws and merits.
For instance, it does not support DoH/DoT/DNSCrypt.
It also leaks DNS connections over TCP (this happens when a DNS question or answer payload is too big to fit in a single UDP packet). In fact, all userspace DNS clients on Android I have taken a look at, leak DNS over TCP.
TrackerControl does not trap all packets over port 53, which RethinkDNS does by default.
TrackerControl isn't geared towards bypassing censorship. RethinkDNS can bypass stateless firewalls employing a similar trick to GreenTunnel, but we plan to implement a couple more such mitigations.
Unimplemented but soon, RethinkDNS would let users block connections if apps don't resolve DNS with a resolver of their choosing.
RethinkDNS has open-sourced both its client app and a pi-hole like stub resolver: https://github.com/serverless-dns/serverless-dns
There's three of us working on RethinkDNS full-time, so it is likely to see feature development at a faster clip than TrackerControl and NetGuard (the latter's been put under maintanence mode by the original developer).
You can access and download apps from Google Play Store with Aurora Store.
https://gitlab.com/AuroraOSS/AuroraStore#aurora-store-a-goog...
> Google is doing their level best to make it harder to get APKs any other way.
They are making it easier with Android 12 by letting third-party stores do automatic updates without user interaction.
https://developer.android.com/about/versions/12/features#aut...
> You used to be able to download them from the store; no longer possible.
It has always been the case that OEMs need to bundle Play Services in the OS and that you need an account to access Google Play. Things like Raccoon, Yalp Store, Aurora Store, etc. to access Google Play have always existed.
> They've announced some other package format, support for which I assume won't be released to AOSP.
It's not a new format, it's open source and Aurora Store supports it just fine.
> The point strcat brought about impersonation was that a person from the Calyx community went and impersonated the Bromite developer, attempting to start conflict between Bromite and GrapheneOS.
The chat logs[0] say different.
I don't see how one person joining a room on Telegram somehow implicates the whole project in some sort of conspiracy to attack / spread misinformation about Bromite or GrapheneOS.
[0]: https://github.com/bromite/bromite/discussions/1186#discussi...