5 ms·

MicroG is a fantastic project! I wouldn't know what to do without it! (×) For anyone who wants a really easy way to install and use LineageOS with MicroG, cons

MicroG is a fantastic project! I wouldn't know what to do without it! (×) For anyone who wants a really easy way to install and use LineageOS with MicroG, consider going for the MicroG-infused version of LineageOS: https://lineage.microg.org/ https://lineage.microg.org/ It's basically pure LineageOS with a small patch that allows MicroG to spoof the Google services' signatures. The ROM supports all the devices regularly supported by LineageOS and even gets weekly OTA updates, too. (×) In case you agree, consider donating to the project: https://salt.bountysource.com/teams/microg https://salt.bountysource.com/teams/microg (or, if you want a specific issue to be solved, you can put a bounty on it, too: https://bountysource.com/teams/microg https://bountysource.com/teams/microg )

dessant 7y ago
Does the patch allow the spoofing of Google packages only, or are signature checks disabled for all apps?
- SXX 7y ago
  Signature spoof require specific permission and it's only available for system apps. So there is no way any app can abuse it unless you specifically allow it.
- codethief 7y ago
  From the FAQ on the page I linked to above: > Why do we need a custom build of LineageOS to have microG? Can't I install microG on the official LineageOS? > MicroG requires a patch called "signature spoofing", which allows the microG's apps to spoof themselves as Google Apps. LineageOS' developers refused (multiple times) to include the patch, forcing us to fork their project. > Wait, on their FAQ page I see that they don't want to include the patch for security reasons. Is this ROM unsafe? > No. LineageOS' developers decided not to include this patch for various reasons. The signature spoofing could be an unsafe feature only if the user blindly gives any permission to any app, as this permission can't be obtained automatically by the apps. Moreover, to further strengthen the security of our ROM, we modified the signature spoofing permission so that only system privileged apps can obtain it, and no security threat is posed to our users.
- testvox 7y ago
  It allows spoofing for any apps the user gives the spoofing permission to.
kudu 7y ago
There's also the main Bountysource page: https://www.bountysource.com/teams/microg https://www.bountysource.com/teams/microg for donating to specific issues. If you're not ready to use this yet because it doesn't work well with X app, there's probably an issue tracking something that would make it work which you can donate to!
- codethief 7y ago
  Thank you, I added the link to my original post!
blacksmith_tb 7y ago
There's also /e/ - another, more opinionated Android distro also using MicroG (and LineageOS...)[1], along with freemium Nextcloud hosting. I threw it on an old Nexus 5, seems interesting, if a little still-in-alpha. 1: https://e.foundation/e-solutions/ https://e.foundation/e-solutions/
- m52go 7y ago
  Apparently they're rather shady. https://ewwlo.xyz/evil https://ewwlo.xyz/evil https://infosec-handbook.eu/blog/e-foundation-first-look/ https://infosec-handbook.eu/blog/e-foundation-first-look/
  - axaxs 7y ago
    I don't think it's fair to categorize them as 'shady', at least yet. Most of the issues described could be attributed to the fact they are very early stage and just wanted to release something working quick. I realize that's not always the best approach, though. Time will tell if they are a standup organization or not, I suppose.
    - m52go 7y ago
      The very reason for /e/ to exist is expressly to provide users with privacy...so some of the shortcuts they took are inexcusable (using APKs from APKPure, leaking personal data, etc). So "shady" might not be the right term..."untrustworthy" might be a better one, until they prove otherwise.
      - wyre 7y ago
        Pardon my lack of knowledge, but what is wrong with APKs from APKPure?
        m52go 7y ago
        It's a third party. To be sure of the integrity of a binary and what it does, one must build it from source code that one has verified. Making strong claims about privacy and then bundling pre-built binaries found on the internet (no matter what the site) does not inspire confidence in me about the team or its supposed dedication to privacy.
psandersen 7y ago
I'm getting tempted to go the LineageOS with MicroG route on my Pocophone (need to confirm it works first). Does this mean I can use the Play store and apps such as Spotify without much issue?
- glaurung_ 7y ago
  I don't believe you can install the play store itself, but Spotify should work. You would have to manually side load it, or install the yalp store which will manage fetching and updating play store apps for you.
  - chasil 7y ago
    Yalp store has default credentials for Play, and it has difficulty loading "split" APKs. I have Chrome installed, and I use Yalp's manual download to get updates for it, then trigger the updates from my downloads folder. If I were using Webview instead, this wouldn't be required. LineageOS really should find a way of making Webview available for people who do not load Play/gapps - MicroG is the only way to run an up to date webview if gapps is not present. There are also two versions of the "Aurora Store" in F-Droid. These require your Google account at startup, and they supposedly handle the split APKs. Yalp does warn that using your own credentials is a violation of Google's terms of service. Because of this, I have never given these credentials to Aurora.
    - deleted 7y ago
      [deleted]
    - callahad 7y ago
      Aurora does not require using your own credentials; there's an "anonymous" button on the login page. It does support split APKs, and has completely replaced Yalp for my uses. https://gitlab.com/AuroraOSS/AuroraStore/ https://gitlab.com/AuroraOSS/AuroraStore/
    - codethief 7y ago
      I'm not following. What does WebView have to do with MicroG / Gapps? I'm asking in particular because: 1. WebView comes pre-installed on LineageOS, irrespective of whether you install Gapps 2. WebView can be downloaded separately from the Play Store
StavrosK 7y ago
What's the difference between using this and sideloading Gapps on LOS? Will I still be able to use Maps, for example? I'm not sure what the benefit is.
- cameronbrown 7y ago
  Benefit is avoiding hitting Google servers and services.
- codethief 7y ago
  Running Gapps on your device (in particular, the Google Services Framework) means that Google will basically have root access to your phone. MicroG prevents that while still allowing you to run certain Google apps like Maps, use Google Cloud Messaging and so on.

dessant 7y ago

Does the patch allow the spoofing of Google packages only, or are signature checks disabled for all apps?

SXX 7y ago
Signature spoof require specific permission and it's only available for system apps. So there is no way any app can abuse it unless you specifically allow it.
codethief 7y ago
From the FAQ on the page I linked to above: > Why do we need a custom build of LineageOS to have microG? Can't I install microG on the official LineageOS? > MicroG requires a patch called "signature spoofing", which allows the microG's apps to spoof themselves as Google Apps. LineageOS' developers refused (multiple times) to include the patch, forcing us to fork their project. > Wait, on their FAQ page I see that they don't want to include the patch for security reasons. Is this ROM unsafe? > No. LineageOS' developers decided not to include this patch for various reasons. The signature spoofing could be an unsafe feature only if the user blindly gives any permission to any app, as this permission can't be obtained automatically by the apps. Moreover, to further strengthen the security of our ROM, we modified the signature spoofing permission so that only system privileged apps can obtain it, and no security threat is posed to our users.
testvox 7y ago
It allows spoofing for any apps the user gives the spoofing permission to.

kudu 7y ago

There's also the main Bountysource page: https://www.bountysource.com/teams/microg https://www.bountysource.com/teams/microg for donating to specific issues. If you're not ready to use this yet because it doesn't work well with X app, there's probably an issue tracking something that would make it work which you can donate to!

codethief 7y ago
Thank you, I added the link to my original post!

blacksmith_tb 7y ago

There's also /e/ - another, more opinionated Android distro also using MicroG (and LineageOS...)[1], along with freemium Nextcloud hosting. I threw it on an old Nexus 5, seems interesting, if a little still-in-alpha. 1: https://e.foundation/e-solutions/ https://e.foundation/e-solutions/

m52go 7y ago
Apparently they're rather shady. https://ewwlo.xyz/evil https://ewwlo.xyz/evil https://infosec-handbook.eu/blog/e-foundation-first-look/ https://infosec-handbook.eu/blog/e-foundation-first-look/
- axaxs 7y ago
  I don't think it's fair to categorize them as 'shady', at least yet. Most of the issues described could be attributed to the fact they are very early stage and just wanted to release something working quick. I realize that's not always the best approach, though. Time will tell if they are a standup organization or not, I suppose.
  - m52go 7y ago
    The very reason for /e/ to exist is expressly to provide users with privacy...so some of the shortcuts they took are inexcusable (using APKs from APKPure, leaking personal data, etc). So "shady" might not be the right term..."untrustworthy" might be a better one, until they prove otherwise.
    - wyre 7y ago
      Pardon my lack of knowledge, but what is wrong with APKs from APKPure?
      - m52go 7y ago
        It's a third party. To be sure of the integrity of a binary and what it does, one must build it from source code that one has verified. Making strong claims about privacy and then bundling pre-built binaries found on the internet (no matter what the site) does not inspire confidence in me about the team or its supposed dedication to privacy.

psandersen 7y ago

I'm getting tempted to go the LineageOS with MicroG route on my Pocophone (need to confirm it works first). Does this mean I can use the Play store and apps such as Spotify without much issue?

glaurung_ 7y ago
I don't believe you can install the play store itself, but Spotify should work. You would have to manually side load it, or install the yalp store which will manage fetching and updating play store apps for you.
- chasil 7y ago
  Yalp store has default credentials for Play, and it has difficulty loading "split" APKs. I have Chrome installed, and I use Yalp's manual download to get updates for it, then trigger the updates from my downloads folder. If I were using Webview instead, this wouldn't be required. LineageOS really should find a way of making Webview available for people who do not load Play/gapps - MicroG is the only way to run an up to date webview if gapps is not present. There are also two versions of the "Aurora Store" in F-Droid. These require your Google account at startup, and they supposedly handle the split APKs. Yalp does warn that using your own credentials is a violation of Google's terms of service. Because of this, I have never given these credentials to Aurora.
  - deleted 7y ago
    [deleted]
  - callahad 7y ago
    Aurora does not require using your own credentials; there's an "anonymous" button on the login page. It does support split APKs, and has completely replaced Yalp for my uses. https://gitlab.com/AuroraOSS/AuroraStore/ https://gitlab.com/AuroraOSS/AuroraStore/
  - codethief 7y ago
    I'm not following. What does WebView have to do with MicroG / Gapps? I'm asking in particular because: 1. WebView comes pre-installed on LineageOS, irrespective of whether you install Gapps 2. WebView can be downloaded separately from the Play Store

StavrosK 7y ago

What's the difference between using this and sideloading Gapps on LOS? Will I still be able to use Maps, for example? I'm not sure what the benefit is.

cameronbrown 7y ago
Benefit is avoiding hitting Google servers and services.
codethief 7y ago
Running Gapps on your device (in particular, the Google Services Framework) means that Google will basically have root access to your phone. MicroG prevents that while still allowing you to run certain Google apps like Maps, use Google Cloud Messaging and so on.