5 ms·

If you're not savvy at installing custom anything, and just want a setup that keeps the Android security model intact (unlike all of these LineageOS forks), che

If you're not savvy at installing custom anything, and just want a setup that keeps the Android security model intact (unlike all of these LineageOS forks), check out GrapheneOS.org.

Karsteski 6y ago
Alternatively, CalyxOS is also a great choice. I've been using it on my Pixel 3 for a few weeks now and it's seamless
- jqpabc123 6y ago
  It may be great but I haven't tried it because the hardware support is really restricted, much more so than eOS.
ForHackernews 6y ago
Most commercial apps will not run on GrapheneOS, because it doesn't provide alternative implementations of Play Services. https://github.com/GrapheneOS/os_issue_tracker/issues/204 https://github.com/GrapheneOS/os_issue_tracker/issues/204
- 177tcca 6y ago
  Holy hell, the FUD. YES THEY WILL — I wouldn't even say it's "many" or "some", anymore. "Most" is just insulting.
  - ForHackernews 6y ago
    You believe less than 51% of commercial Android apps on the app store use even one single Google Play Service? No push alerts, maps, ads, etc.
    - 177tcca 6y ago
      There are varying (read: dropping weekly) levels of dev reliance on Google/GCM etc for those things in apps, now. I'd evaluate what you're using, because it's likely to work just fine.
- 177tcca 6y ago
  Also, there's great reasons for not providing an insecure/incomplete implementation of Google services (or destroying the Android security model with Lineage) which is discussed on GrapheneOS.org — if you're interested in learning more.
hiq 6y ago
> want a setup that keeps the Android security model intact (unlike all of these LineageOS forks) Can you expand on how LineageOS breaks the Android security model?
- ForHackernews 6y ago
  Not standard LineageOS, but LOS forks that provide microG in place of Google Apps have to support "signature spoofing" so that MicroG can impersonate the missing proprietary Google apps. More details here: https://blogs.fsfe.org/larma/2016/microg-signature-spoofing-security/ https://blogs.fsfe.org/larma/2016/microg-signature-spoofing-... > I’d also like to point out a myths I heard regarding signature spoofing. Some people assume, that signature spoofing allows to break the Android signature security model and thus rogue applications can access private app storage. But in fact signature spoofing is only applied after installation if the permission was granted, it has no influence on the package manager security model.
  - hiq 6y ago
    Correct me if I'm wrong, but your quote then implies that it's still fine even with microg installed, right? So maybe OP is talking about something else? Or are you saying that they're misguided?
    - ForHackernews 6y ago
      I'm not enough of an expert to say for certain, and I'm not exactly sure what parent comment means when they accuse LineageOS of "destroying" the "Android security model", but from what I've read, concerns about signature spoofing are overblown - provided the user is very selective about what apps they grant spoofing powers to.

If you're not savvy at installing custom anything, and just want a setup that keeps the Android security model intact (unlike all of these LineageOS forks), check out GrapheneOS.org.

Karsteski 6y ago

Alternatively, CalyxOS is also a great choice. I've been using it on my Pixel 3 for a few weeks now and it's seamless

jqpabc123 6y ago
It may be great but I haven't tried it because the hardware support is really restricted, much more so than eOS.

ForHackernews 6y ago

Most commercial apps will not run on GrapheneOS, because it doesn't provide alternative implementations of Play Services. https://github.com/GrapheneOS/os_issue_tracker/issues/204 https://github.com/GrapheneOS/os_issue_tracker/issues/204

177tcca 6y ago
Holy hell, the FUD. YES THEY WILL — I wouldn't even say it's "many" or "some", anymore. "Most" is just insulting.
- ForHackernews 6y ago
  You believe less than 51% of commercial Android apps on the app store use even one single Google Play Service? No push alerts, maps, ads, etc.
  - 177tcca 6y ago
    There are varying (read: dropping weekly) levels of dev reliance on Google/GCM etc for those things in apps, now. I'd evaluate what you're using, because it's likely to work just fine.
177tcca 6y ago
Also, there's great reasons for not providing an insecure/incomplete implementation of Google services (or destroying the Android security model with Lineage) which is discussed on GrapheneOS.org — if you're interested in learning more.

hiq 6y ago

> want a setup that keeps the Android security model intact (unlike all of these LineageOS forks) Can you expand on how LineageOS breaks the Android security model?

ForHackernews 6y ago
Not standard LineageOS, but LOS forks that provide microG in place of Google Apps have to support "signature spoofing" so that MicroG can impersonate the missing proprietary Google apps. More details here: https://blogs.fsfe.org/larma/2016/microg-signature-spoofing-security/ https://blogs.fsfe.org/larma/2016/microg-signature-spoofing-... > I’d also like to point out a myths I heard regarding signature spoofing. Some people assume, that signature spoofing allows to break the Android signature security model and thus rogue applications can access private app storage. But in fact signature spoofing is only applied after installation if the permission was granted, it has no influence on the package manager security model.
- hiq 6y ago
  Correct me if I'm wrong, but your quote then implies that it's still fine even with microg installed, right? So maybe OP is talking about something else? Or are you saying that they're misguided?
  - ForHackernews 6y ago
    I'm not enough of an expert to say for certain, and I'm not exactly sure what parent comment means when they accuse LineageOS of "destroying" the "Android security model", but from what I've read, concerns about signature spoofing are overblown - provided the user is very selective about what apps they grant spoofing powers to.