15 ms·

Review: Copperhead OS

272 points by billpollock 9y ago

meneame2 9y ago
Sadly it has turned its open source license into a code available but non-free one. That, coupled with the fact that Pixel devices are way more expensive than Nexus used to be limits its usefulness.
- JetSpiegel 9y ago
  There's always LineageOS
  - billpollock 9y ago
    I use that but it's all Google based. Not sure if you can decouple it from Play Services without breaking everything.
    - seba_dos1 9y ago
      You can with microG, which even provides preconfigured builds with microG instead of Play Services - https://lineage.microg.org/ https://lineage.microg.org/
      - billpollock 9y ago
        Interesting. I wasn't aware of that. I'll give it a try.
        deleted 9y ago
        [deleted]
      - billpollock 9y ago
        Also the name of a vape :)
      - j_s 9y ago
        LineageOS for microG – Access Google services without closed software | https://news.ycombinator.com/item?id=15617615 https://news.ycombinator.com/item?id=15617615 Supported devices: https://wiki.lineageos.org/devices/ https://wiki.lineageos.org/devices/
    - mpartel 9y ago
      LineageOS runs fine without Play Services. It's actually the default mode. It just limits your app choices. My needs are simple so I don't really mind, and I appreciate the improved battery life and speed. It turns out many apps from the Play Store don't actually have a hard dependency on Play Services. Example: Slack works, except for notifications and (IIRC) receiving calls, which is good enough if you don't need to be reachable all the time.
      - billpollock 9y ago
        I should try it without installing Gapps. I just do the install routinely.
      - clort 9y ago
        "me too" I run LineageOS v13 now (Galaxy Nexus), and before that Cyanogenmod back to v7 (maybe v6 not sure) and have never had Gapps installed, its been F-Droid all the way. I guess that means I can't appreciate the improved battery life or speed..
      - slphil 9y ago
        Same with Discord. I don't get any notifications from Discord on my de-Googled LineageOS devices, but the application works just fine (although I had to silence its constant notifications about Play Services).
      - JetSpiegel 9y ago
        I use Yalp Store to use apps from the Play Store and even though almost all of them "require" Play Services, most work just fine and worst case scenario they have a nagging screen about requiring Play Services but work just fine.
    - jaxondu 9y ago
      There is also eelo https://eelo.io/ https://eelo.io/ based on LineageOS and is Apple and Google free. By Mandrake Linux creator. It has a kickstarter campaign now on: https://www.kickstarter.com/projects/290746744/eelo-a-mobile-os-and-web-services-in-the-public-in# https://www.kickstarter.com/projects/290746744/eelo-a-mobile...
    - craftyguy 9y ago
      By default, LineageOS does NOT include google play services. And it works just fine if you don't expect to use apps which "require" google play services.
      - seba_dos1 9y ago
        And if you expect to use them, try microG - the free software reimplementation of Google Play Services.
        craftyguy 9y ago
        Does this still require you to essentially nerf application signing in order to spoof some google play crap? If so, that's really not a viable solution.
        seba_dos1 9y ago
        The newer version of signature spoofing patch (included in microG's LineageOS fork) allows you to control the spoofing and make sure that it's only used when necessary and permitted, so I'd say the answer is "no".
        craftyguy 9y ago
        Interesting. I know the microG folks tried to upstream a patch to Cyanogenmod, which the devs shot down almost immediately.. So you're saying that the microG folks are now maintaining a fork of LineageOS? If it's not tracking VERY closely to upstream LineageOS, then it's probably not worth it.
        seba_dos1 9y ago
        https://lineage.microg.org/ https://lineage.microg.org/ - tracking very closely, just adding the spoofing patch and preinstalling microG, F-Droid etc.
        floatboth 9y ago
  - notspanishflu 9y ago
    I prefer UBports https://ubports.com/ https://ubports.com/ There's a project now to include anbox to run Android apps http://news.softpedia.com/news/ubuntu-phones-will-soon-run-android-apps-thanks-to-anbox-says-ubports-519118.shtml http://news.softpedia.com/news/ubuntu-phones-will-soon-run-a...
  - cJ0th 9y ago
    is it completely de-googled though (even when play services are not installed)? Honest question. To me it seems as if that's not one of the main interests of the lineage community. I do use lineageOS myself and am generally very content with it but I am always a bit concerned when I see that the data usage of OS components (which are thrown together as one "app" in the settings) is more than a few MB. The system must do more than just checking for updates. Unfortunately, you can't prevent system components from accessing the internet if you don't intend rooting your phone.
    - floatboth 9y ago
      When play services are not installed, it's "never been googled". It's AOSP.
- billpollock 9y ago
  OP here. I actually liked the pointers to F-Droid apps, too. I'm on LineageOS. I've used F-Droid for years but mainly for things like Adaway. Timber and notes apps look interesting, also K-9 of course.
  - chrisper 9y ago
    Are you using Lineage OS on a Pixel? I don't seem to be able to find that on the LineageOS website.
    - iynere 9y ago
      https://forum.xda-developers.com/pixel/development/rom-lineageos-14-1-pixel-mod-t3629402 https://forum.xda-developers.com/pixel/development/rom-linea...
    - billpollock 9y ago
      OnePlus One
      - chrisper 9y ago
        How are you liking it? Considering getting one to replace my Pixel.
        billpollock 9y ago
        I've used it for years. I like it but it feels slow with 7.x. looking at 5T.
iynere 9y ago
its very easy to just not install google play services on any non-stock rom. there doesn't seem to be much that is 'security-focused' about copperhead besides that decision.... i would definitely recommend lineage over this, as it has a much larger development community & works on a much wider range of devices
agentdrtran 9y ago
> do think it will happen, however. The use case involves corporations, especially those involved in privacy sensitive fields such as health care. Wouldn’t it be cool to have a locked down “business” VM that is separate from a “personal” VM with your Facebook, games and private stuff on it. This already exists for businesses with Samsung Knox / Android for Business. No it's not a full OS but it fits all of their needs and separates data. Having one OS in a "vm" on a phone sounds horrible UX wise.
- mintplant 9y ago
  I'm a big fan of the "Island" app [0], which lets you set up a locally-administered Android for Work profile. It's great for, say, cloning a second copy of a messaging app for an alternate account. [0] https://forum.xda-developers.com/android/apps-games/closed-beta-test-incoming-companion-app-t3366295 https://forum.xda-developers.com/android/apps-games/closed-b...
  - billpollock 9y ago
    Interesting. A step beyond Xposed and Xprivacy.
  - mtgx 9y ago
    It's too bad Google itself only allows you to do that with a Gmail for Business account. I had to use a profile for my banking app to isolate it from all my personal apps, instead. But it seems that Google doesn't' even care that much about the multi-profile functionality, as it seems to crash quite often and has other issues. I imagine they don't put it through a lot of Q&A with each new Android release. Even so, having to change between profiles often just to get that kind of isolation is quite frustrating.
- chisleu 9y ago
  > Having one OS in a "vm" on a phone sounds horrible UX wise I believe most android people are doing this with users. Since Android is now up to the task of docker (kernel 3.10+), it would be very nice to see apps sandboxed with permissions exposed via networked APIs. Then it is impossible for an app (sans exploit) to access private data, and simple for the OS to route certain apps to certain data sets (ie, fake contacts for apps that shouldn't need your damn contact to begin with). CyanogenMod accomplished some of this through various methods, but they were detectable. If you build it this way, it should be entirely undetectable.
walshemj 9y ago
why that Name in particular did they not know its provenance in English :-) it was what a proslavery northerner was called aka Traitors.
- wccrawford 9y ago
  This is a copperhead. https://en.wikipedia.org/wiki/Agkistrodon_contortrix https://en.wikipedia.org/wiki/Agkistrodon_contortrix
- graton 9y ago
  That is not the provenance (origin) of copperhead, it is another meaning of the word though. https://www.merriam-webster.com/dictionary/copperhead https://www.merriam-webster.com/dictionary/copperhead The first known use of the word "copperhead" was in 1775, well before the US civil war.
- Scriptor 9y ago
  No one uses that definition anymore.
  - Chaebixi 9y ago
    That's never stopped anyone from taking offense if they want to.
  - walshemj 9y ago
    Steve Earl did the title "copperhead row" ?
- cabaalis 9y ago
  Being from the south I've occassionally heard and used the term "carpetbagger" which doesn't have slavery connotations that I know of but is from the same era. I've never heard the term copperhead used with that meaning, maybe only people from the north know it?
wffurr 9y ago
Reviewer touts "security focused" OS, promptly disables "trusted sources" check for installed software. Turn it back on, sure, until the next time you want an APK that's not listed in F-Droid. Seems like a bad idea. How about writing to your favorite app developers and asking them to list on F-Droid instead of sideloading?
- Mo3 9y ago
  Not only this, he won't receive security updates for his apps any more. Thank you, I'm staying with default Android and continuing to read what I am prompted for. He could've just opted out of most data collection, no, he had to skip it without even reading it like a 60 year old office worker at a insurance company.
  - craftyguy 9y ago
    Some of us using Copperhead OS never enable unknown sources. Yes, the author is a doofus for the reasons you specified, but sticking with "default Android" (whatever that is.. you mean AOSP?) is arguably worse than running Copperhead OS.
- ocdtrekkie 9y ago
  FWIW, the "trusted sources" checkbox has been more of a way to scare away people from using Google's competitors (like the Amazon Appstore or F-Droid) than actually indicating any true trustworthiness, given that tons of malware comes from the Play Store, and Google Play Protect ranks dead last on AVTEST.org benchmarks for malware detection. I believe Google finally introduced a way to deem other app stores as trusted on your phone, but given this is just a block on the manual installation feature, I would consider the trusted sources checkbox to be more "anticompetition focused" than "security focused".
JepZ 9y ago
Sometimes I am wondering what Google employees think when they read headlines like this one. I mean they probably have no problem giving the personal data to Google, but at the same time many of them are probably open source proponents and would support a world where the Google services would be entirely optional to Android. A few days ago I was thinking about a new smartphone and because my main problem with my current android is the outdated kernel and driver setup, I was searching for smartphone with open source drivers. Wikipedia tells us since the start of the Smartphone era about 22 phones had open source drivers (with the exception of the proprietary baseband firmware): https://en.wikipedia.org/wiki/List_of_open-source_mobile_phones https://en.wikipedia.org/wiki/List_of_open-source_mobile_pho... Doesn't look like something where you can select the hardware specifications you prefer. So I feel a little lost. In general, I like Android but for my taste the Google services are too intrusive. Uploading my data before I had a chance to deactivate it is just unacceptable. Asking me every day to add photos to Maps sucks too. I can accept giving some of my information to Google to improve the product, but lately Google feels like the data mooch on my smartphone...
- lern_too_spel 9y ago
  Google services are entirely optional to Android. See AOSP. This criticism appears often on HN, despite how little sense it makes. If you don't like the data that Google Maps collects, simply use another map application. I delete all the useless Google apps off my phone as soon as I get it and keep only the ones that are actually useful.
  - paulryanrogers 9y ago
    Lots of third party apps rely upon Google APIs which are not a part of ASOP
    - lern_too_spel 9y ago
      In what way does that mean that Google services are required for Android? Lots of Linux games rely on Steam being present. If you don't want Steam, don't use games that require it. If you don't want Google services like Google's Maps widget or its push messaging service or its game leaderboard, use apps that use another data source for maps and another persistent connection for push messages and another leaderboard service. F-Droid and Amazon's App Store are filled entirely with apps that don't (can't) use Google's services, yet many on HN blindly continue to claim that this is not possible.
z3t4 9y ago
I don't think it would be that hard to have two separate CPU's on a phone, then use a hardware switch to wake one OS up and put the other to sleep.
aknfo1341 9y ago
I've used copperhead OS for months.. and believe me when I went back to my 5x that had it and had to attempt to break into my own phone because I forgot the password.. that thing is secure! It does suck to side-load somethings, but the worst part is a lot of things use google play services more than you think.. which is always weird to me. If anyone has any questions let me know, but I enjoyed it. Without google battery life is pretty awesome.
lrvick 9y ago
I think there are some misconceptions in this thread (due to the title). Personally I use CopperheadOS as my daily driver because it stays continually ahead of Google (and groups like AOKP, LineageOS etc) in terms of Android hardening. It goes well beyond just not having Google Play services. See their details on their approach and design: https://copperhead.co/android/docs/technical_overview https://copperhead.co/android/docs/technical_overview They make continued patches to Android as part of a security and privacy first approach. Many of their patches get upstreamed by google months later (if at all) but CopperheadOS users get them right away. Google has their engineering efforts focused mostly on new features and compatibility. They are happy to let firms like CopperheadOS be further ahead in security research and take their patches where it does not break compatibility. It really depends on what you want to optimize for. Security/privacy or being able to run all the latest games and social media apps and the consequences that come with them.
- billpollock 9y ago
  That's helpful insight. Thank you.
- ece 9y ago
  Copperhead uses Grsecurity, and I used to use Grsecurity, when it was widely available, now that it's not and the developer has decided to act in hostile ways to the Linux community(1), it's made me rethink using his work and/or supporting him. Plenty of consultants make do fine without resorting to closing off their source code, and decide to act better with the community and/or companies. (1) https://www.theregister.co.uk/2017/12/22/grsecurity_defamation_perens_dismissed/ https://www.theregister.co.uk/2017/12/22/grsecurity_defamati...
  - LukeShu 9y ago
    Copperhead maintains the -hardened patchset, which is essentially a fork of Grsecurity, largely because of those concerns. (I don't use CopperheadOS on my phone, but I do use their work in the form of linux-hardened on my desktop!)
  - jemsa 9y ago
thatcat 9y ago
It's kind of hilarious that copperhead OS is considered de-googled when all the hw support and firmware updates still rely on google. After google drops hw support for a device copperhead discontinues support.
brightball 9y ago
Anyway to install this on an Amazon Fire tablet?
- jonafato 9y ago
  Unfortunately, it's currently only supported on a handful of devices [1], and that's not among them. Supposedly (based on some threads on /r/copperheados), Project Treble may improve this situation, but I haven't seen any new details on that front recently. [1] https://copperhead.co/android/docs/install#supported-devices https://copperhead.co/android/docs/install#supported-devices
JoshTriplett 9y ago
The article mentions launchers; all the launchers in the app store seem sketchy. Does anyone know of a good Open Source launcher, maybe a version of the AOSP launcher compiled for current Android? I'd love to have something that reclaims the pile of space (thumb-reachable space even) devoted to the Google search bar that now stays on the bottom of the main screen all the time.
- chrisper 9y ago
  Nova launcher has a good reputation and is not bloat. It's free and the prime one is affordable. Just try it out.
  - StavrosK 9y ago
    I'd like to second Nova, it's my favorite. I bought pro, well worth it.
- jonafato 9y ago
  The stock launcher that ships with AOSP (and Copperhead OS) [1] is OK but leaves something to be desired. I used Nova Launcher [2] for years before switching to Copperhead and liked it quite a bit, but after forgetting to back up my settings and being to lazy to reconfigure it just the way I liked it, I switched to KISS Launcher [3]. It took a few days to adjust, but I prefer it now, and it has the added benefit of being open source and available through F-Droid. [1] https://android.googlesource.com/platform/packages/apps/Launcher3/ https://android.googlesource.com/platform/packages/apps/Laun... [2] http://novalauncher.com/ http://novalauncher.com/ [3] http://kisslauncher.com/ http://kisslauncher.com/
- izacus 9y ago
  Perhaps try Lawnchair (https://github.com/LawnchairLauncher/Lawnchair https://github.com/LawnchairLauncher/Lawnchair - available on Play Store) which is closely modeled on Googles Pixel launcher but offers customization.
- bradfa 9y ago
  I use OpenLauncher and like it. F-droid link: https://f-droid.org/en/packages/com.benny.openlauncher/ https://f-droid.org/en/packages/com.benny.openlauncher/ Google play: https://play.google.com/store/apps/details?id=com.benny.openlauncher https://play.google.com/store/apps/details?id=com.benny.open...
Tepix 9y ago
I love Copperhead OS on my Nexus 5X. Amazing battery life, great trustworthy apps and strong security. Frankly I think the project would be a lot more successful with lower prices. I'm willing to pay $50 per year for the OS, right now the price to get Copperhead OS installed on a Pixel phone is $400. That's just out of whack when taking into consideration the phone price (I paid around $180 for a used Nexus 5X a year ago) and the usual software prices. I guess I'm not the only one not buying a Pixel with Copperhead OS for that reason. The Copperhead guys should get a copy of http://www.dummies.com/education/economics/how-to-determine-the-ideal-price-with-price-elasticity-of-demand/ http://www.dummies.com/education/economics/how-to-determine-...
- deleted 9y ago
  [deleted]
- slphil 9y ago
  You don't need to pay them for a phone. You can install it on the device yourself for free.
  - anowlcalledjosh 9y ago
    Builds are only available for free for Nexus devices, though -- if you want to install it on a Pixel, you have to either build from source or pay up.
    - slphil 9y ago
      This is true, but building from source isn't very hard. (I also don't care for the Pixel -- I have no desire to upgrade from my Nexus 6 and recommend it to others seeking a de-Googled phone.)
      - kakaorka 9y ago
        I had a nexus 6 for 2 years. Just replaced it last month with an iPhone 8+. My experience with the nexus was horrible and I will never buy another android phone. The quality of the hardware is just abysmal. I hope the iPhone proves itself better.
dweekly 9y ago
Re: having a switchable mobile hypervisor I have some free/unencumbered IP for you courtesy my employer Google in case anyone would like to implement. http://www.tdcommons.org/dpubs_series/500/ http://www.tdcommons.org/dpubs_series/500/
jonafato 9y ago
YalpStore [1,2] makes getting Play Store apps a lot less painful than going through the process of extracting an APK from one phone and side loading it onto another. There are some that simply won't / don't work without Google Play Services, but most do. This made switching to Copperhead OS much easier for me. [1] https://github.com/yeriomin/YalpStore https://github.com/yeriomin/YalpStore [2] https://f-droid.org/packages/com.github.yeriomin.yalpstore/ https://f-droid.org/packages/com.github.yeriomin.yalpstore/
- seba_dos1 9y ago
  And if something doesn't work without Google Play Services, it might work with microG instead.
makepkg 9y ago
I use CopperheadOS on my Nexus 5X and I am extremely happy with it. My job is android development and I have some personal paid apps on Google play and one Foss app on F-Droid. Access clipboard in the background and record audio in the background have been lately added to the security features available on CopperheadOS, and I can't imagine now using my phone without COS hardened implementation. I use FDroid for all the apps I need and yalp for a couple of other apps not available on FDroid. The majority of apps now depends on Google play services and that is flattering and disappointing: all those GPS APIs are very appealing to developers and teams because makes things easier and all but IMHO using all those services is contributing to data mining and I don't think it is fair.
jonafato 9y ago
Copperhead OS is a great project and seems to be short on funding (based on threads on Twitter and Reddit). If you'd like to support it, donations can be made at https://copperhead.co/android/donate https://copperhead.co/android/donate. (I'm not affiliated with the project, I just use it as my primary phone OS.)
Improvotter 9y ago
> CopperheadOS currently supports the Nexus 5X and Nexus 6P as a free offering. Pixel and Pixel XL support is available as a product. They show a Nexus 5 on the landing page for CopperheadOS. Why not show a supported device?
pasbesoin 9y ago
I may have to go this or a similar route, to go back to using WiFi and Bluetooth on my ~5.5 month old Motorola G5+ [1]. I mean, come on! Ship a patch/update, already! 1) That replaced a bootlooped ~1.4 year old Nexus 5X. Wasn't going to spend big bucks after that burn and while waiting for the Pixel 2 or Samsung whatever, or Apple's new line, to drop in a month or two. And now, with all the crap going on with all those various new models... I've griped about this, before, but damn it, they deserve the criticism. And the only time they make positive changes seems to be when the public image and pressure get bad enough. (And things get worse again, as soon as that pressure relents -- or gets distracted.)
parfamz 9y ago
Ain't here maps a good alternative to google maps? I use both of them 50/50 and I love the offline capabilities of here maps
gman83 9y ago
A hypervisor on a mobile OS you say? https://techspecs.blog/blog/2017/3/15/fuchsias-hypervisor https://techspecs.blog/blog/2017/3/15/fuchsias-hypervisor
orblivion 9y ago
I'm overall quite pleased with my Copperhead phone, and very much appreciate getting actual OS updates. I have one issue however that I thought I'd put out there from a customer service standpoint. If you buy a phone from them, you pay what seems to me like a nice premium (Pixel XL $1,269.00; though it's hard to find a good comparison point), and it comes with a service plan. Copperhead (as I understand) takes stock AOSP and (among other things) swaps out some of the default applications. Notably, the SMS application is something called Silence (silence.im). Here's the issue. I've had a problem or two with Silence, and I contacted their customer support. They suggested trying other SMS apps to see if that solved my problem, which is in itself fine. However, at that point they closed the issue, because they claim that they're not responsible for 3rd party apps, even ones that they bundle and (I presume) update with system upgrades. The reason given is that they don't control the source for those, unlike the OS. I don't accept this at all. I paid a good premium (unless I'm mistaken) for the phone, I expect a _working phone_. This, these days, includes a functioning SMS client. How they go about making that happen is _their_ responsibility. They can work with me to find a suitable replacement, they can submit a pull request or a bug report, etc. But I argue they should consider the issue open until it's fixed or I decide it doesn't matter. Anyway, not a big deal, I worked around it. Perhaps if I pressed enough they would have been okay with me returning the thing on these grounds, but it's nowhere near worth it. I just disagree with their philosophy on this issue. I understand it must be _really_ hard to deal with all this as such a small operation. But then they should put this point in big bold letters when you buy it, or something. ¯\_(ツ)_/¯
forapurpose 9y ago
Dated 18 January 2017, almost a year ago (but not quite long enough to add it to the title) so some info might be out of date.
hedora 9y ago
Any idea why all their phones are out of stock? (Are there more on the way???)
squarefoot 9y ago
Hardening the OS is not enough. As the infamous Intel ME taught us in a different context, unless one uses only 100% open hardware, security cannot be guaranteed by software. We need open (documented, reproducible) hardware rather than alternative OSes; until that day security on current platforms is to be considered a myth.
yakans 9y ago
In the post the author complains about the lack of a VM inside current phones to run Google instances in it. I believe BB10 had that feat to overcome the limits of its native app ecosystem. My old Passport nowadays could almost reach the objectives of the author. Too bad due to licensing the Android kernel is stuck on 4.3

272 points by billpollock 9y ago

Sadly it has turned its open source license into a code available but non-free one. That, coupled with the fact that Pixel devices are way more expensive than Nexus used to be limits its usefulness.

JetSpiegel 9y ago
There's always LineageOS
- billpollock 9y ago
  I use that but it's all Google based. Not sure if you can decouple it from Play Services without breaking everything.
  - seba_dos1 9y ago
    You can with microG, which even provides preconfigured builds with microG instead of Play Services - https://lineage.microg.org/ https://lineage.microg.org/
    - billpollock 9y ago
      Interesting. I wasn't aware of that. I'll give it a try.
      - deleted 9y ago
        [deleted]
    - billpollock 9y ago
      Also the name of a vape :)
    - j_s 9y ago
      LineageOS for microG – Access Google services without closed software | https://news.ycombinator.com/item?id=15617615 https://news.ycombinator.com/item?id=15617615 Supported devices: https://wiki.lineageos.org/devices/ https://wiki.lineageos.org/devices/
  - mpartel 9y ago
    LineageOS runs fine without Play Services. It's actually the default mode. It just limits your app choices. My needs are simple so I don't really mind, and I appreciate the improved battery life and speed. It turns out many apps from the Play Store don't actually have a hard dependency on Play Services. Example: Slack works, except for notifications and (IIRC) receiving calls, which is good enough if you don't need to be reachable all the time.
    - billpollock 9y ago
      I should try it without installing Gapps. I just do the install routinely.
    - clort 9y ago
      "me too" I run LineageOS v13 now (Galaxy Nexus), and before that Cyanogenmod back to v7 (maybe v6 not sure) and have never had Gapps installed, its been F-Droid all the way. I guess that means I can't appreciate the improved battery life or speed..
    - slphil 9y ago
      Same with Discord. I don't get any notifications from Discord on my de-Googled LineageOS devices, but the application works just fine (although I had to silence its constant notifications about Play Services).
    - JetSpiegel 9y ago
      I use Yalp Store to use apps from the Play Store and even though almost all of them "require" Play Services, most work just fine and worst case scenario they have a nagging screen about requiring Play Services but work just fine.
  - jaxondu 9y ago
    There is also eelo https://eelo.io/ https://eelo.io/ based on LineageOS and is Apple and Google free. By Mandrake Linux creator. It has a kickstarter campaign now on: https://www.kickstarter.com/projects/290746744/eelo-a-mobile-os-and-web-services-in-the-public-in# https://www.kickstarter.com/projects/290746744/eelo-a-mobile...
  - craftyguy 9y ago
    By default, LineageOS does NOT include google play services. And it works just fine if you don't expect to use apps which "require" google play services.
    - seba_dos1 9y ago
      And if you expect to use them, try microG - the free software reimplementation of Google Play Services.
      - craftyguy 9y ago
        Does this still require you to essentially nerf application signing in order to spoof some google play crap? If so, that's really not a viable solution.
        seba_dos1 9y ago
        The newer version of signature spoofing patch (included in microG's LineageOS fork) allows you to control the spoofing and make sure that it's only used when necessary and permitted, so I'd say the answer is "no".
        craftyguy 9y ago
        Interesting. I know the microG folks tried to upstream a patch to Cyanogenmod, which the devs shot down almost immediately.. So you're saying that the microG folks are now maintaining a fork of LineageOS? If it's not tracking VERY closely to upstream LineageOS, then it's probably not worth it.
        seba_dos1 9y ago
        https://lineage.microg.org/ https://lineage.microg.org/ - tracking very closely, just adding the spoofing patch and preinstalling microG, F-Droid etc.
        floatboth 9y ago
- notspanishflu 9y ago
  I prefer UBports https://ubports.com/ https://ubports.com/ There's a project now to include anbox to run Android apps http://news.softpedia.com/news/ubuntu-phones-will-soon-run-android-apps-thanks-to-anbox-says-ubports-519118.shtml http://news.softpedia.com/news/ubuntu-phones-will-soon-run-a...
- cJ0th 9y ago
  is it completely de-googled though (even when play services are not installed)? Honest question. To me it seems as if that's not one of the main interests of the lineage community. I do use lineageOS myself and am generally very content with it but I am always a bit concerned when I see that the data usage of OS components (which are thrown together as one "app" in the settings) is more than a few MB. The system must do more than just checking for updates. Unfortunately, you can't prevent system components from accessing the internet if you don't intend rooting your phone.
  - floatboth 9y ago
    When play services are not installed, it's "never been googled". It's AOSP.
billpollock 9y ago
OP here. I actually liked the pointers to F-Droid apps, too. I'm on LineageOS. I've used F-Droid for years but mainly for things like Adaway. Timber and notes apps look interesting, also K-9 of course.
- chrisper 9y ago
  Are you using Lineage OS on a Pixel? I don't seem to be able to find that on the LineageOS website.
  - iynere 9y ago
    https://forum.xda-developers.com/pixel/development/rom-lineageos-14-1-pixel-mod-t3629402 https://forum.xda-developers.com/pixel/development/rom-linea...
  - billpollock 9y ago
    OnePlus One
    - chrisper 9y ago
      How are you liking it? Considering getting one to replace my Pixel.
      - billpollock 9y ago
        I've used it for years. I like it but it feels slow with 7.x. looking at 5T.

iynere 9y ago

its very easy to just not install google play services on any non-stock rom. there doesn't seem to be much that is 'security-focused' about copperhead besides that decision.... i would definitely recommend lineage over this, as it has a much larger development community & works on a much wider range of devices

agentdrtran 9y ago

> do think it will happen, however. The use case involves corporations, especially those involved in privacy sensitive fields such as health care. Wouldn’t it be cool to have a locked down “business” VM that is separate from a “personal” VM with your Facebook, games and private stuff on it. This already exists for businesses with Samsung Knox / Android for Business. No it's not a full OS but it fits all of their needs and separates data. Having one OS in a "vm" on a phone sounds horrible UX wise.

mintplant 9y ago
I'm a big fan of the "Island" app [0], which lets you set up a locally-administered Android for Work profile. It's great for, say, cloning a second copy of a messaging app for an alternate account. [0] https://forum.xda-developers.com/android/apps-games/closed-beta-test-incoming-companion-app-t3366295 https://forum.xda-developers.com/android/apps-games/closed-b...
- billpollock 9y ago
  Interesting. A step beyond Xposed and Xprivacy.
- mtgx 9y ago
  It's too bad Google itself only allows you to do that with a Gmail for Business account. I had to use a profile for my banking app to isolate it from all my personal apps, instead. But it seems that Google doesn't' even care that much about the multi-profile functionality, as it seems to crash quite often and has other issues. I imagine they don't put it through a lot of Q&A with each new Android release. Even so, having to change between profiles often just to get that kind of isolation is quite frustrating.
chisleu 9y ago
> Having one OS in a "vm" on a phone sounds horrible UX wise I believe most android people are doing this with users. Since Android is now up to the task of docker (kernel 3.10+), it would be very nice to see apps sandboxed with permissions exposed via networked APIs. Then it is impossible for an app (sans exploit) to access private data, and simple for the OS to route certain apps to certain data sets (ie, fake contacts for apps that shouldn't need your damn contact to begin with). CyanogenMod accomplished some of this through various methods, but they were detectable. If you build it this way, it should be entirely undetectable.

walshemj 9y ago

why that Name in particular did they not know its provenance in English :-) it was what a proslavery northerner was called aka Traitors.

wccrawford 9y ago
This is a copperhead. https://en.wikipedia.org/wiki/Agkistrodon_contortrix https://en.wikipedia.org/wiki/Agkistrodon_contortrix
graton 9y ago
That is not the provenance (origin) of copperhead, it is another meaning of the word though. https://www.merriam-webster.com/dictionary/copperhead https://www.merriam-webster.com/dictionary/copperhead The first known use of the word "copperhead" was in 1775, well before the US civil war.
Scriptor 9y ago
No one uses that definition anymore.
- Chaebixi 9y ago
  That's never stopped anyone from taking offense if they want to.
- walshemj 9y ago
  Steve Earl did the title "copperhead row" ?
cabaalis 9y ago
Being from the south I've occassionally heard and used the term "carpetbagger" which doesn't have slavery connotations that I know of but is from the same era. I've never heard the term copperhead used with that meaning, maybe only people from the north know it?

wffurr 9y ago

Reviewer touts "security focused" OS, promptly disables "trusted sources" check for installed software. Turn it back on, sure, until the next time you want an APK that's not listed in F-Droid. Seems like a bad idea. How about writing to your favorite app developers and asking them to list on F-Droid instead of sideloading?

Mo3 9y ago
Not only this, he won't receive security updates for his apps any more. Thank you, I'm staying with default Android and continuing to read what I am prompted for. He could've just opted out of most data collection, no, he had to skip it without even reading it like a 60 year old office worker at a insurance company.
- craftyguy 9y ago
  Some of us using Copperhead OS never enable unknown sources. Yes, the author is a doofus for the reasons you specified, but sticking with "default Android" (whatever that is.. you mean AOSP?) is arguably worse than running Copperhead OS.
ocdtrekkie 9y ago
FWIW, the "trusted sources" checkbox has been more of a way to scare away people from using Google's competitors (like the Amazon Appstore or F-Droid) than actually indicating any true trustworthiness, given that tons of malware comes from the Play Store, and Google Play Protect ranks dead last on AVTEST.org benchmarks for malware detection. I believe Google finally introduced a way to deem other app stores as trusted on your phone, but given this is just a block on the manual installation feature, I would consider the trusted sources checkbox to be more "anticompetition focused" than "security focused".

JepZ 9y ago

Sometimes I am wondering what Google employees think when they read headlines like this one. I mean they probably have no problem giving the personal data to Google, but at the same time many of them are probably open source proponents and would support a world where the Google services would be entirely optional to Android. A few days ago I was thinking about a new smartphone and because my main problem with my current android is the outdated kernel and driver setup, I was searching for smartphone with open source drivers. Wikipedia tells us since the start of the Smartphone era about 22 phones had open source drivers (with the exception of the proprietary baseband firmware): https://en.wikipedia.org/wiki/List_of_open-source_mobile_phones https://en.wikipedia.org/wiki/List_of_open-source_mobile_pho... Doesn't look like something where you can select the hardware specifications you prefer. So I feel a little lost. In general, I like Android but for my taste the Google services are too intrusive. Uploading my data before I had a chance to deactivate it is just unacceptable. Asking me every day to add photos to Maps sucks too. I can accept giving some of my information to Google to improve the product, but lately Google feels like the data mooch on my smartphone...

lern_too_spel 9y ago
Google services are entirely optional to Android. See AOSP. This criticism appears often on HN, despite how little sense it makes. If you don't like the data that Google Maps collects, simply use another map application. I delete all the useless Google apps off my phone as soon as I get it and keep only the ones that are actually useful.
- paulryanrogers 9y ago
  Lots of third party apps rely upon Google APIs which are not a part of ASOP
  - lern_too_spel 9y ago
    In what way does that mean that Google services are required for Android? Lots of Linux games rely on Steam being present. If you don't want Steam, don't use games that require it. If you don't want Google services like Google's Maps widget or its push messaging service or its game leaderboard, use apps that use another data source for maps and another persistent connection for push messages and another leaderboard service. F-Droid and Amazon's App Store are filled entirely with apps that don't (can't) use Google's services, yet many on HN blindly continue to claim that this is not possible.

z3t4 9y ago

I don't think it would be that hard to have two separate CPU's on a phone, then use a hardware switch to wake one OS up and put the other to sleep.

aknfo1341 9y ago

I've used copperhead OS for months.. and believe me when I went back to my 5x that had it and had to attempt to break into my own phone because I forgot the password.. that thing is secure! It does suck to side-load somethings, but the worst part is a lot of things use google play services more than you think.. which is always weird to me. If anyone has any questions let me know, but I enjoyed it. Without google battery life is pretty awesome.

lrvick 9y ago

I think there are some misconceptions in this thread (due to the title). Personally I use CopperheadOS as my daily driver because it stays continually ahead of Google (and groups like AOKP, LineageOS etc) in terms of Android hardening. It goes well beyond just not having Google Play services. See their details on their approach and design: https://copperhead.co/android/docs/technical_overview https://copperhead.co/android/docs/technical_overview They make continued patches to Android as part of a security and privacy first approach. Many of their patches get upstreamed by google months later (if at all) but CopperheadOS users get them right away. Google has their engineering efforts focused mostly on new features and compatibility. They are happy to let firms like CopperheadOS be further ahead in security research and take their patches where it does not break compatibility. It really depends on what you want to optimize for. Security/privacy or being able to run all the latest games and social media apps and the consequences that come with them.

billpollock 9y ago
That's helpful insight. Thank you.
ece 9y ago
Copperhead uses Grsecurity, and I used to use Grsecurity, when it was widely available, now that it's not and the developer has decided to act in hostile ways to the Linux community(1), it's made me rethink using his work and/or supporting him. Plenty of consultants make do fine without resorting to closing off their source code, and decide to act better with the community and/or companies. (1) https://www.theregister.co.uk/2017/12/22/grsecurity_defamation_perens_dismissed/ https://www.theregister.co.uk/2017/12/22/grsecurity_defamati...
- LukeShu 9y ago
  Copperhead maintains the -hardened patchset, which is essentially a fork of Grsecurity, largely because of those concerns. (I don't use CopperheadOS on my phone, but I do use their work in the form of linux-hardened on my desktop!)
- jemsa 9y ago

thatcat 9y ago

It's kind of hilarious that copperhead OS is considered de-googled when all the hw support and firmware updates still rely on google. After google drops hw support for a device copperhead discontinues support.

brightball 9y ago

Anyway to install this on an Amazon Fire tablet?

jonafato 9y ago
Unfortunately, it's currently only supported on a handful of devices [1], and that's not among them. Supposedly (based on some threads on /r/copperheados), Project Treble may improve this situation, but I haven't seen any new details on that front recently. [1] https://copperhead.co/android/docs/install#supported-devices https://copperhead.co/android/docs/install#supported-devices

JoshTriplett 9y ago

The article mentions launchers; all the launchers in the app store seem sketchy. Does anyone know of a good Open Source launcher, maybe a version of the AOSP launcher compiled for current Android? I'd love to have something that reclaims the pile of space (thumb-reachable space even) devoted to the Google search bar that now stays on the bottom of the main screen all the time.

chrisper 9y ago
Nova launcher has a good reputation and is not bloat. It's free and the prime one is affordable. Just try it out.
- StavrosK 9y ago
  I'd like to second Nova, it's my favorite. I bought pro, well worth it.
jonafato 9y ago
The stock launcher that ships with AOSP (and Copperhead OS) [1] is OK but leaves something to be desired. I used Nova Launcher [2] for years before switching to Copperhead and liked it quite a bit, but after forgetting to back up my settings and being to lazy to reconfigure it just the way I liked it, I switched to KISS Launcher [3]. It took a few days to adjust, but I prefer it now, and it has the added benefit of being open source and available through F-Droid. [1] https://android.googlesource.com/platform/packages/apps/Launcher3/ https://android.googlesource.com/platform/packages/apps/Laun... [2] http://novalauncher.com/ http://novalauncher.com/ [3] http://kisslauncher.com/ http://kisslauncher.com/
izacus 9y ago
Perhaps try Lawnchair (https://github.com/LawnchairLauncher/Lawnchair https://github.com/LawnchairLauncher/Lawnchair - available on Play Store) which is closely modeled on Googles Pixel launcher but offers customization.
bradfa 9y ago
I use OpenLauncher and like it. F-droid link: https://f-droid.org/en/packages/com.benny.openlauncher/ https://f-droid.org/en/packages/com.benny.openlauncher/ Google play: https://play.google.com/store/apps/details?id=com.benny.openlauncher https://play.google.com/store/apps/details?id=com.benny.open...

Tepix 9y ago

I love Copperhead OS on my Nexus 5X. Amazing battery life, great trustworthy apps and strong security. Frankly I think the project would be a lot more successful with lower prices. I'm willing to pay $50 per year for the OS, right now the price to get Copperhead OS installed on a Pixel phone is $400. That's just out of whack when taking into consideration the phone price (I paid around $180 for a used Nexus 5X a year ago) and the usual software prices. I guess I'm not the only one not buying a Pixel with Copperhead OS for that reason. The Copperhead guys should get a copy of http://www.dummies.com/education/economics/how-to-determine-the-ideal-price-with-price-elasticity-of-demand/ http://www.dummies.com/education/economics/how-to-determine-...

deleted 9y ago
[deleted]
slphil 9y ago
You don't need to pay them for a phone. You can install it on the device yourself for free.
- anowlcalledjosh 9y ago
  Builds are only available for free for Nexus devices, though -- if you want to install it on a Pixel, you have to either build from source or pay up.
  - slphil 9y ago
    This is true, but building from source isn't very hard. (I also don't care for the Pixel -- I have no desire to upgrade from my Nexus 6 and recommend it to others seeking a de-Googled phone.)
    - kakaorka 9y ago
      I had a nexus 6 for 2 years. Just replaced it last month with an iPhone 8+. My experience with the nexus was horrible and I will never buy another android phone. The quality of the hardware is just abysmal. I hope the iPhone proves itself better.

dweekly 9y ago

Re: having a switchable mobile hypervisor I have some free/unencumbered IP for you courtesy my employer Google in case anyone would like to implement. http://www.tdcommons.org/dpubs_series/500/ http://www.tdcommons.org/dpubs_series/500/

jonafato 9y ago

YalpStore [1,2] makes getting Play Store apps a lot less painful than going through the process of extracting an APK from one phone and side loading it onto another. There are some that simply won't / don't work without Google Play Services, but most do. This made switching to Copperhead OS much easier for me. [1] https://github.com/yeriomin/YalpStore https://github.com/yeriomin/YalpStore [2] https://f-droid.org/packages/com.github.yeriomin.yalpstore/ https://f-droid.org/packages/com.github.yeriomin.yalpstore/

seba_dos1 9y ago
And if something doesn't work without Google Play Services, it might work with microG instead.

makepkg 9y ago

I use CopperheadOS on my Nexus 5X and I am extremely happy with it. My job is android development and I have some personal paid apps on Google play and one Foss app on F-Droid. Access clipboard in the background and record audio in the background have been lately added to the security features available on CopperheadOS, and I can't imagine now using my phone without COS hardened implementation. I use FDroid for all the apps I need and yalp for a couple of other apps not available on FDroid. The majority of apps now depends on Google play services and that is flattering and disappointing: all those GPS APIs are very appealing to developers and teams because makes things easier and all but IMHO using all those services is contributing to data mining and I don't think it is fair.

jonafato 9y ago

Copperhead OS is a great project and seems to be short on funding (based on threads on Twitter and Reddit). If you'd like to support it, donations can be made at https://copperhead.co/android/donate https://copperhead.co/android/donate. (I'm not affiliated with the project, I just use it as my primary phone OS.)

Improvotter 9y ago

> CopperheadOS currently supports the Nexus 5X and Nexus 6P as a free offering. Pixel and Pixel XL support is available as a product. They show a Nexus 5 on the landing page for CopperheadOS. Why not show a supported device?

pasbesoin 9y ago

I may have to go this or a similar route, to go back to using WiFi and Bluetooth on my ~5.5 month old Motorola G5+ [1]. I mean, come on! Ship a patch/update, already! 1) That replaced a bootlooped ~1.4 year old Nexus 5X. Wasn't going to spend big bucks after that burn and while waiting for the Pixel 2 or Samsung whatever, or Apple's new line, to drop in a month or two. And now, with all the crap going on with all those various new models... I've griped about this, before, but damn it, they deserve the criticism. And the only time they make positive changes seems to be when the public image and pressure get bad enough. (And things get worse again, as soon as that pressure relents -- or gets distracted.)

parfamz 9y ago

Ain't here maps a good alternative to google maps? I use both of them 50/50 and I love the offline capabilities of here maps

gman83 9y ago

A hypervisor on a mobile OS you say? https://techspecs.blog/blog/2017/3/15/fuchsias-hypervisor https://techspecs.blog/blog/2017/3/15/fuchsias-hypervisor

orblivion 9y ago

I'm overall quite pleased with my Copperhead phone, and very much appreciate getting actual OS updates. I have one issue however that I thought I'd put out there from a customer service standpoint. If you buy a phone from them, you pay what seems to me like a nice premium (Pixel XL $1,269.00; though it's hard to find a good comparison point), and it comes with a service plan. Copperhead (as I understand) takes stock AOSP and (among other things) swaps out some of the default applications. Notably, the SMS application is something called Silence (silence.im). Here's the issue. I've had a problem or two with Silence, and I contacted their customer support. They suggested trying other SMS apps to see if that solved my problem, which is in itself fine. However, at that point they closed the issue, because they claim that they're not responsible for 3rd party apps, even ones that they bundle and (I presume) update with system upgrades. The reason given is that they don't control the source for those, unlike the OS. I don't accept this at all. I paid a good premium (unless I'm mistaken) for the phone, I expect a _working phone_. This, these days, includes a functioning SMS client. How they go about making that happen is _their_ responsibility. They can work with me to find a suitable replacement, they can submit a pull request or a bug report, etc. But I argue they should consider the issue open until it's fixed or I decide it doesn't matter. Anyway, not a big deal, I worked around it. Perhaps if I pressed enough they would have been okay with me returning the thing on these grounds, but it's nowhere near worth it. I just disagree with their philosophy on this issue. I understand it must be _really_ hard to deal with all this as such a small operation. But then they should put this point in big bold letters when you buy it, or something. ¯\_(ツ)_/¯

forapurpose 9y ago

Dated 18 January 2017, almost a year ago (but not quite long enough to add it to the title) so some info might be out of date.

hedora 9y ago

Any idea why all their phones are out of stock? (Are there more on the way???)

squarefoot 9y ago

Hardening the OS is not enough. As the infamous Intel ME taught us in a different context, unless one uses only 100% open hardware, security cannot be guaranteed by software. We need open (documented, reproducible) hardware rather than alternative OSes; until that day security on current platforms is to be considered a myth.

yakans 9y ago

In the post the author complains about the lack of a VM inside current phones to run Google instances in it. I believe BB10 had that feat to overcome the limits of its native app ecosystem. My old Passport nowadays could almost reach the objectives of the author. Too bad due to licensing the Android kernel is stuck on 4.3