10 ms·

Using only open-source software on Android

96 points by axiomdata316 9y ago

_bxg1 9y ago
Also, the Brave browser is a great FOSS option. It's a chromium fork that only adds privacy/adblocking features and doesn't require google services.
- jhasse 9y ago
  Unfortunately not on F-Droid.
  - _bxg1 9y ago
    It is on APKMirror, a trusted (run by Android Police) mirror of the Play Store, which has been essential to ditching the latter.
voltagex_ 9y ago
>Unfortunately, there's a catch - microG only works with custom ROMs that support signature spoofing. The LineageOS project is against adding support for that feature, citing security concerns, so microG offers its own ROM called 'LineageOS for microG.' Jesus - this is what the patch does: https://github.com/microg/android_packages_apps_GmsCore/blob/master/patches/android_frameworks_base-N.patch https://github.com/microg/android_packages_apps_GmsCore/blob... So this allows other applications to appear in the com.google namespace? This can't be good. Can't I have this kind of feature and still be secure? Edit: https://github.com/microg/android_packages_apps_GmsCore/issues/336#issuecomment-284036039 https://github.com/microg/android_packages_apps_GmsCore/issu... is a slightly better solution - I wonder why it hasn't been implemented.
- pwnna 9y ago
  From your linked thread: > Restrict the permission to apps in /system/priv-app. This requires to ship microG or two placeholder apps with the ROM (or to allow modification of /system, which is a far worse option). Modifying the permission to be for system apps only is changing one word in the patch (from "dangerous" to "system"), creating a placeholder apps is about writing ~10 lines of XML code and thus could be done in a few minutes. Lineage for MicroG already does this by default: https://github.com/lineageos4microg/docker-lineage-cicd/blob/93cc0e5cb5d47a626f5ef6d072b1954d4808d5ff/src/build.sh#L180 https://github.com/lineageos4microg/docker-lineage-cicd/blob... Restricting the permission to a platform level permission essentially means no other installed apps (after flashing) can spoof this. No toggles are necessary either. This should be a secure setup that is as good as any other ROM. It is possible that users can flash something to /system/priv-app via an update.zip and obtain this permission. However, anything you flash like this can practically already gain root access, so this would almost be a feature if ROMs like lineage implemented this, as then microg's installation would be a small update.zip away. This is opposed to the present setup where microg has to build a completely different rom, although that is another story in itself and likely require some more complications.
  - voltagex_ 9y ago
    I don't really understand why signature spoofing is needed at all.
    - pwnna 9y ago
      The framework Google provides for apps to interact with Google Play Services checks the GmsCore's signature to validate that it's talking to only their app.
taneq 9y ago
90% of the objections here seem to be "I can't use Google's online services very easily without using Google Play", which is precisely why Google's spent the past few years piping as much of Android's runtime as possible through Google Play. The rest are mainly just that the main streaming and social media companies don't have open source clients.
- st26 9y ago
  I'd always heard that moving more and more functionality into play services was their strategy for end-running the carrier fragmentation problem.
  - FuckOffNeemo 9y ago
    That's the crux of it. Though Google have fixed it in such a way that's benefited them by consolidating services and potential data collection for revenue raising. I've not used anything but a Nexus of Pixel in years. But carrier fragmentation (and with it, the difficulty for OTA patching!) is a much bigger risk to the Android ecosystem and it's uses than closed source code.
- gregknicholson 9y ago
  The problem more generally seems to be “I'm locked into proprietary services that don't allow me to use libre software”. I suggest that those services therefore aren't very good. If libre software fails to compete with a proprietary alternative in terms of features, it's reasonable to criticise the libre software. Similarly, if a proprietary service fails to compete with a libre alternative in terms of choice of how you use it, it's reasonable to criticise the proprietary service.
giancarlostoro 9y ago
One thing I'd love to see is some Android Tablets that are ROM friendly.
- firmgently 9y ago
  Quite a few (30-40) listed here https://wiki.lineageos.org/devices/ https://wiki.lineageos.org/devices/ - if it runs LineageOS it's probably going to have other ROMS available too
- amiga-workbench 9y ago
  Android tablets are pretty much dead now, nobody ever put the necessary effort into the software experience on tablets, and the hardware has always been a bit of a let down. New hardware releases have slowed to a trickle and what is being released isn't very compelling.
wilwade 9y ago
"...and Firefox on Android still isn't a great experience..." As a daily FF on Android user, I am not sure what he is finding issues with. I wish he would elaborate so his issues can get fixed.
- ChrisSD 9y ago
  For example I've found the app sometimes freezes when scrolling a page. It's only temporary but it's long enough to be annoying.
- Pharylon 9y ago
  That was my thought as well. I have to switch to Chrome every once in a blue moon to make things work on my Android phone, but 99% of the time, Firefox works just as well.
- haZard_OS 9y ago
  I'll add my voice to mix here and agree that FF has worked well for me on Android. Between Nightly and Focus, I have yet to need a non-FF browser post adoption.
- sidlls 9y ago
  I have a Nexus 6 updated with the latest OS version and FF. I spend about 90% of my browsing time on HN, LinkedIn, and a couple of miscellaneous other news sites. I observe the following problems: Loss of UI, where the only thing I see is either a white or black screen. Swiping up or down as if to scroll or refresh "peels back" some of this to reveal the web page underneath, but it doesn't become functional unless I end the app. This affects all tabs open. Terrible latency acting on navigation, where I'll press a link which has clearly been detected (an outline appears around it) and...nothing happens for seconds. Doesn't matter if I have one tab or a dozen open. Terrible detection of which link was pressed. Sometimes it's bad enough that a link more than halfway down the page from where I touch is activated. This doesn't happen in any other app I have, even when it's happening on FF. Poor download times. The bar indicating progress will occasionally stop at about 80% and pause. Sometimes when it pauses it finishes after a few seconds and other times it simply freezes.
eadmund 9y ago
> Firefox on Android still isn't a great experience News to me! I've been using Firefox on Android for six years now, and I'm very happy.
- Nexxxeh 9y ago
  Firefox on Android with uBlock Origin is amazing. Best mobile browsing experience on any platform for me.
  - Boulth 9y ago
    I can confirm. I recently wanted to try Chrome for Android but after several vibrating ads I migrated back to Firefox.
    - SmellyGeekBoy 9y ago
      Interesting, I've only ever seen these on Pornhub... ;)
      - Mediumium 9y ago
        Interesting, I've only ever seen Pornhub on Pornhub... ;)
- tazard 9y ago
  I regularly switch between Firefox + ublock and Firefox Focus. Both are great in my opinion, just for different purposes.
- ac29 9y ago
  Scrolling performance is terrible, even on high end devices. I'd imagine its borderline unusable on mid-range devices.
  - TheChaplain 9y ago
    No issues here, and I use it daily on a 2+ year old S7. Currently >20 tabs open with Privacy Badger, uBlock Origin and HTTPS Everywhere addons. No stuttering or delays.
jancsika 9y ago
> There are no FOSS clients for Plex, Netflix, Hulu, or Spotify. Hm... there's a client that is suspiciously absent from that list... > In other words, I couldn't listen to any of my music, unless I copied the MP3 files from my Plex server to the phone's internal storage. I couldn't stream any TV shows or movies, either. Ok, that's just technically inaccurate. The author didn't want to use a particular open-source app (or perhaps category of apps) to stream video/audio to the Android device. There is certainly a persuasive argument as to why one would refrain from installing such apps. But a piece about following FOSS-only dogma which omits a discussion of that app category is misleading. Especially when there are probably tens of thousands if not hundreds of thousands of users who currently have such a FOSS app installed on their Android devices. Edit: typo
- JackCh 9y ago
  What client are you referring to? I've used VLC on android to stream media from my DLNA server. Is that what you're talking about? Or is there a better solution available? (I've found VLC to be unstable in this configuration, it often crashes for reasons I haven't yet bothered to dig into.)
  - phito 9y ago
    Maybe Kodi?
clircle 9y ago
I've been running Lineage with microG on my Nexus 5X for about 5 months and I'm pretty neutral about the experience. I do cheat a little bit though -- I install Google Maps and Gboard. The biggest annoyance was updating from Android 7 to Android 8. I had to reinstall stock Android 8 on my Nexus to get the new firmware, then install Lineage with microG version 8. Quite annoying, but I suppose it was necessary. Other than that, I quite enjoy the extended battery life that comes with the ROM, I have 87% left now, after about 12 hours of very minimal use. I don't use my phone too much, mostly just navigation, texting, email, HN, and reddit. Though I'm considering switching back to stock for the better Google hangouts experience.
_bxg1 9y ago
A much better rule imo, which I've had success with, is "no software from the Big Five" rather than FOSS-only. This has a bigger impact on actual privacy concerns and gives you more leeway when it comes to media apps, etc.
- icebraining 9y ago
  Sorry, which are the Big Five? Google, Facebook, Microsoft, Amazon... Apple?
  - majewsky 9y ago
    yes
Squarex 9y ago
Is there a decent free software Android keyboard which supports sliding? It's the last thing keeping me from going full Google and Microsoft free Android. Right now I use Swiftkey and firewall to keep it from accesing the network.
- Squarex 9y ago
  To answer my own question, I've found out that latest AOSP keyboard supports sliding.
fithisux 9y ago
I agree with the title.
rubenbe 9y ago
I tried this for a while and I consider the experiment failed. No closed source means no Whatsapp, etc. Let's face reality, no-one is using XMPP ;) In the end I started the policy "Prefer open-source software on Android", which works pretty well: * Note taking using orgzly * Tasks using opentasks (https://github.com/dmfs/opentasks https://github.com/dmfs/opentasks) * File Sync using Syncthing * Contacts, Calendar using davdroid & nextcloud * Firefox for browsing (this is a no-brainer)
- jhasse 9y ago
  Try Telegram instead of WhatsApp. It's a good drop-in replacement.
  - heinrich5991 9y ago
    It doesn't encrypt end-to-end by default though.
    - jhasse 9y ago
      FOSS client is more important IMHO.
  - mxschumacher 9y ago
    the trouble is to get your friends to use it. A vast portion of my daily communication runs over Whatsapp. A realistic migration would entail convincing 25+ people to switch apps. Network effects are powerful.
    - jhasse 9y ago
      Let them try Telegram's awesome desktop clients. It's quite a good argument for many as I hear lots of people complaining about WhatsApp's.
      - mxschumacher 9y ago
        I've been using the Whatsapp Web version since it was released and it has worked flawlessly

96 points by axiomdata316 9y ago

Also, the Brave browser is a great FOSS option. It's a chromium fork that only adds privacy/adblocking features and doesn't require google services.

jhasse 9y ago
Unfortunately not on F-Droid.
- _bxg1 9y ago
  It is on APKMirror, a trusted (run by Android Police) mirror of the Play Store, which has been essential to ditching the latter.

voltagex_ 9y ago

>Unfortunately, there's a catch - microG only works with custom ROMs that support signature spoofing. The LineageOS project is against adding support for that feature, citing security concerns, so microG offers its own ROM called 'LineageOS for microG.' Jesus - this is what the patch does: https://github.com/microg/android_packages_apps_GmsCore/blob/master/patches/android_frameworks_base-N.patch https://github.com/microg/android_packages_apps_GmsCore/blob... So this allows other applications to appear in the com.google namespace? This can't be good. Can't I have this kind of feature and still be secure? Edit: https://github.com/microg/android_packages_apps_GmsCore/issues/336#issuecomment-284036039 https://github.com/microg/android_packages_apps_GmsCore/issu... is a slightly better solution - I wonder why it hasn't been implemented.

pwnna 9y ago
From your linked thread: > Restrict the permission to apps in /system/priv-app. This requires to ship microG or two placeholder apps with the ROM (or to allow modification of /system, which is a far worse option). Modifying the permission to be for system apps only is changing one word in the patch (from "dangerous" to "system"), creating a placeholder apps is about writing ~10 lines of XML code and thus could be done in a few minutes. Lineage for MicroG already does this by default: https://github.com/lineageos4microg/docker-lineage-cicd/blob/93cc0e5cb5d47a626f5ef6d072b1954d4808d5ff/src/build.sh#L180 https://github.com/lineageos4microg/docker-lineage-cicd/blob... Restricting the permission to a platform level permission essentially means no other installed apps (after flashing) can spoof this. No toggles are necessary either. This should be a secure setup that is as good as any other ROM. It is possible that users can flash something to /system/priv-app via an update.zip and obtain this permission. However, anything you flash like this can practically already gain root access, so this would almost be a feature if ROMs like lineage implemented this, as then microg's installation would be a small update.zip away. This is opposed to the present setup where microg has to build a completely different rom, although that is another story in itself and likely require some more complications.
- voltagex_ 9y ago
  I don't really understand why signature spoofing is needed at all.
  - pwnna 9y ago
    The framework Google provides for apps to interact with Google Play Services checks the GmsCore's signature to validate that it's talking to only their app.

taneq 9y ago

90% of the objections here seem to be "I can't use Google's online services very easily without using Google Play", which is precisely why Google's spent the past few years piping as much of Android's runtime as possible through Google Play. The rest are mainly just that the main streaming and social media companies don't have open source clients.

st26 9y ago
I'd always heard that moving more and more functionality into play services was their strategy for end-running the carrier fragmentation problem.
- FuckOffNeemo 9y ago
  That's the crux of it. Though Google have fixed it in such a way that's benefited them by consolidating services and potential data collection for revenue raising. I've not used anything but a Nexus of Pixel in years. But carrier fragmentation (and with it, the difficulty for OTA patching!) is a much bigger risk to the Android ecosystem and it's uses than closed source code.
gregknicholson 9y ago
The problem more generally seems to be “I'm locked into proprietary services that don't allow me to use libre software”. I suggest that those services therefore aren't very good. If libre software fails to compete with a proprietary alternative in terms of features, it's reasonable to criticise the libre software. Similarly, if a proprietary service fails to compete with a libre alternative in terms of choice of how you use it, it's reasonable to criticise the proprietary service.

giancarlostoro 9y ago

One thing I'd love to see is some Android Tablets that are ROM friendly.

firmgently 9y ago
Quite a few (30-40) listed here https://wiki.lineageos.org/devices/ https://wiki.lineageos.org/devices/ - if it runs LineageOS it's probably going to have other ROMS available too
amiga-workbench 9y ago
Android tablets are pretty much dead now, nobody ever put the necessary effort into the software experience on tablets, and the hardware has always been a bit of a let down. New hardware releases have slowed to a trickle and what is being released isn't very compelling.

wilwade 9y ago

"...and Firefox on Android still isn't a great experience..." As a daily FF on Android user, I am not sure what he is finding issues with. I wish he would elaborate so his issues can get fixed.

ChrisSD 9y ago
For example I've found the app sometimes freezes when scrolling a page. It's only temporary but it's long enough to be annoying.
Pharylon 9y ago
That was my thought as well. I have to switch to Chrome every once in a blue moon to make things work on my Android phone, but 99% of the time, Firefox works just as well.
haZard_OS 9y ago
I'll add my voice to mix here and agree that FF has worked well for me on Android. Between Nightly and Focus, I have yet to need a non-FF browser post adoption.
sidlls 9y ago
I have a Nexus 6 updated with the latest OS version and FF. I spend about 90% of my browsing time on HN, LinkedIn, and a couple of miscellaneous other news sites. I observe the following problems: Loss of UI, where the only thing I see is either a white or black screen. Swiping up or down as if to scroll or refresh "peels back" some of this to reveal the web page underneath, but it doesn't become functional unless I end the app. This affects all tabs open. Terrible latency acting on navigation, where I'll press a link which has clearly been detected (an outline appears around it) and...nothing happens for seconds. Doesn't matter if I have one tab or a dozen open. Terrible detection of which link was pressed. Sometimes it's bad enough that a link more than halfway down the page from where I touch is activated. This doesn't happen in any other app I have, even when it's happening on FF. Poor download times. The bar indicating progress will occasionally stop at about 80% and pause. Sometimes when it pauses it finishes after a few seconds and other times it simply freezes.

eadmund 9y ago

> Firefox on Android still isn't a great experience News to me! I've been using Firefox on Android for six years now, and I'm very happy.

Nexxxeh 9y ago
Firefox on Android with uBlock Origin is amazing. Best mobile browsing experience on any platform for me.
- Boulth 9y ago
  I can confirm. I recently wanted to try Chrome for Android but after several vibrating ads I migrated back to Firefox.
  - SmellyGeekBoy 9y ago
    Interesting, I've only ever seen these on Pornhub... ;)
    - Mediumium 9y ago
      Interesting, I've only ever seen Pornhub on Pornhub... ;)
tazard 9y ago
I regularly switch between Firefox + ublock and Firefox Focus. Both are great in my opinion, just for different purposes.
ac29 9y ago
Scrolling performance is terrible, even on high end devices. I'd imagine its borderline unusable on mid-range devices.
- TheChaplain 9y ago
  No issues here, and I use it daily on a 2+ year old S7. Currently >20 tabs open with Privacy Badger, uBlock Origin and HTTPS Everywhere addons. No stuttering or delays.

jancsika 9y ago

> There are no FOSS clients for Plex, Netflix, Hulu, or Spotify. Hm... there's a client that is suspiciously absent from that list... > In other words, I couldn't listen to any of my music, unless I copied the MP3 files from my Plex server to the phone's internal storage. I couldn't stream any TV shows or movies, either. Ok, that's just technically inaccurate. The author didn't want to use a particular open-source app (or perhaps category of apps) to stream video/audio to the Android device. There is certainly a persuasive argument as to why one would refrain from installing such apps. But a piece about following FOSS-only dogma which omits a discussion of that app category is misleading. Especially when there are probably tens of thousands if not hundreds of thousands of users who currently have such a FOSS app installed on their Android devices. Edit: typo

JackCh 9y ago
What client are you referring to? I've used VLC on android to stream media from my DLNA server. Is that what you're talking about? Or is there a better solution available? (I've found VLC to be unstable in this configuration, it often crashes for reasons I haven't yet bothered to dig into.)
- phito 9y ago
  Maybe Kodi?

clircle 9y ago

I've been running Lineage with microG on my Nexus 5X for about 5 months and I'm pretty neutral about the experience. I do cheat a little bit though -- I install Google Maps and Gboard. The biggest annoyance was updating from Android 7 to Android 8. I had to reinstall stock Android 8 on my Nexus to get the new firmware, then install Lineage with microG version 8. Quite annoying, but I suppose it was necessary. Other than that, I quite enjoy the extended battery life that comes with the ROM, I have 87% left now, after about 12 hours of very minimal use. I don't use my phone too much, mostly just navigation, texting, email, HN, and reddit. Though I'm considering switching back to stock for the better Google hangouts experience.

_bxg1 9y ago

A much better rule imo, which I've had success with, is "no software from the Big Five" rather than FOSS-only. This has a bigger impact on actual privacy concerns and gives you more leeway when it comes to media apps, etc.

icebraining 9y ago
Sorry, which are the Big Five? Google, Facebook, Microsoft, Amazon... Apple?
- majewsky 9y ago
  yes

Squarex 9y ago

Is there a decent free software Android keyboard which supports sliding? It's the last thing keeping me from going full Google and Microsoft free Android. Right now I use Swiftkey and firewall to keep it from accesing the network.

Squarex 9y ago
To answer my own question, I've found out that latest AOSP keyboard supports sliding.

fithisux 9y ago

I agree with the title.

rubenbe 9y ago

I tried this for a while and I consider the experiment failed. No closed source means no Whatsapp, etc. Let's face reality, no-one is using XMPP ;) In the end I started the policy "Prefer open-source software on Android", which works pretty well: * Note taking using orgzly * Tasks using opentasks (https://github.com/dmfs/opentasks https://github.com/dmfs/opentasks) * File Sync using Syncthing * Contacts, Calendar using davdroid & nextcloud * Firefox for browsing (this is a no-brainer)

jhasse 9y ago
Try Telegram instead of WhatsApp. It's a good drop-in replacement.
- heinrich5991 9y ago
  It doesn't encrypt end-to-end by default though.
  - jhasse 9y ago
    FOSS client is more important IMHO.
- mxschumacher 9y ago
  the trouble is to get your friends to use it. A vast portion of my daily communication runs over Whatsapp. A realistic migration would entail convincing 25+ people to switch apps. Network effects are powerful.
  - jhasse 9y ago
    Let them try Telegram's awesome desktop clients. It's quite a good argument for many as I hear lots of people complaining about WhatsApp's.
    - mxschumacher 9y ago
      I've been using the Whatsapp Web version since it was released and it has worked flawlessly