29 ms·

CalyxOS – De-Googled Android Alternative

1010 points by ssklash 5y ago

dangfang 5y ago
Since Microsoft now supports Android apps, you can expect ungoogled android to become more popular since more apps would be written which dont need play store
- wingmanjd 5y ago
  Doesn't the Microsoft Android support require an Amazon account, though?
  - theunspoken 5y ago
    yes and no. first of all: which services does Amazon provide that would make an app dependent on them in the same way it might be on Google services? does Amazon have its own system for push notifications? for weather data? for syncing contacts? secondly: it has been confirmed that Android apps will be able to be sideloaded. a Microsoft employee tweeted about it but I can't really find the post right now
    - commoner 5y ago
      > does Amazon have its own system for push notifications? Yes, but only for Amazon (Fire) devices. Amazon Device Messaging handles push notifications to Amazon devices: https://developer.amazon.com/docs/adm/faq-adm.html https://developer.amazon.com/docs/adm/faq-adm.html Microsoft might implement Amazon Device Messaging in Windows 11. > secondly: it has been confirmed that Android apps will be able to be sideloaded. a Microsoft employee tweeted about it but I can't really find the post right now Here: https://www.theverge.com/2021/6/25/22550689/windows-11-android-app-sideload-amazon-app-store https://www.theverge.com/2021/6/25/22550689/windows-11-andro...
- Popegaf 5y ago
  I hope so, but at the same time, which app developer is going to target compatibility with the windows desktop when writing an app? Also, how will/do apps that depend on Google Services work (or not)? Is there some shim or something?
jszymborski 5y ago
So, what's the current experience like on Android w/o Play services? I know at some point it was quite bad but that there were some up-and-coming solutions.
- Popegaf 5y ago
  Some apps (especially banking and governmental apps) refuse to start at all. With microG (https://microg.org/ https://microg.org/) you can run a wide range of apps though. It's quite bearable, especially if you aren't an app junkie that downloads every app promising a discount on that new store you're purchasing from.
- fragileone 5y ago
  microG as a semi-Play Services experience is fine, the only issue I have is that most network-based geolocation backends tend to be hit or miss. I usually have to enable the Apple location service if I need a fast geolocation.
  - commoner 5y ago
    Mozilla Location Services is crowdsourced, and you can contribute data from your area with the Tower Collector app to make geolocation faster for you: https://github.com/zamojski/TowerCollector https://github.com/zamojski/TowerCollector
- atatatat 5y ago
  I struggle to find any half-assed techy person who uses an app that won't run on AOSP/Calyx/GrapheneOS.
kiawe_fire 5y ago
Anybody have experience using something like this (or others like GrapheneOS) as a daily driver? I’m interested in moving away from Apple and big tech in general, but I don’t know how practical that is yet.
- terhechte 5y ago
  I'm using GrapheneOS on a second device for various reasons. The biggest issue for me is that not all apps work / run. However, I have limited app requirements, so that is fine. If you want to run all social networks, Uber, Lyft, and so on, there might be the one or other that doesn't work (I didn't try them all). However, you can always use the mobile web offering I guess. In terms of classical smartphone features, I know what I don't get out of the box due to the lack of Google Services (Assistant, Picture Sync, etc). That wasn't an issue for me as it is a secondary device.
  - atatatat 5y ago
    What apps haven't worked for you on GrapheneOS, from Aurora Store?
    - 0xdeadb00f 5y ago
      Not the person you asked, but my banking app works but occasionally will crash when I go to certain parts of the app. I'm not sure why. Other than that Discord, MS Teams, and ProtonMail all work fine with the exception of push notifications (I disable those anyways, so this isn't a concern of mine).
  - strcat 5y ago
    GrapheneOS now has https://grapheneos.org/usage#sandboxed-play-services https://grapheneos.org/usage#sandboxed-play-services providing the ability to install Play services in a sandbox. The core functionality is already working in the Stable/Beta channel releases. You can install it in a dedicated profile to avoid apps in other profiles being able to use it. GrapheneOS is fine with people using Google apps and services but not integrated into the OS and they should be on the same level as other apps and services without any special privileges/access. We're working on making this a reality. Google could implement the fallback code paths we're providing for Play services themselves. All we're doing is teaching it to do what it should already know how to do. Perhaps a regulator can force them to unbundle their services and make them usable anywhere.
bmarquez 5y ago
> you can make encrypted phone calls directly, using the built-in integration for Signal and WhatsApp calls Does this mean WhatsApp is automatically installed with Calyx, or just that there are extra features if you manually install it?
- azdle 5y ago
  CalyxOS has a handful of apps that exist in the image that you can optionally install. I would assume it's one of those. I run CalyxOS and don't and never did have WhatsApp installed.
  - cdesai 5y ago
    WhatsApp is not one of those apps, we only include FOSS apps.
- Knighttime 5y ago
  Unsure. It seems that they have Signal installed by default, but not WhatsApp. However, if you install WhatsApp you can make a WhatsApp call directly from the dialer I think?
  - cdesai 5y ago
    Exactly. Signal is available as a default however you can choose not to install it. WhatsApp is shown as an option if you have it installed, the option won't show up if you don't. The rationale being: We didn't exactly ant to promote WhatsApp but still have it present for those who already use it.
sparaker 5y ago
I don't know if they have this, but a good feature a privacy centric android experience would be, to have a simple accessible log of what app accessed what using which permission.
- dasyatidprime 5y ago
  I'd worry that translating this to an end-user-relevant concept of security would lead to a lot of scares, though. Probe all the files in a directory to see which ones are “yours”: “What? Why is it accessing all the files? So suspicious!” Require a specific name pattern or something: “I never have to remember to do this on the other apps…” There's a lot of these tradeoffs that in human life are resolved through reference to all sorts of subtle human things that the machine knows not of. We're at this liminal point where “app” software is given a bare form of “agency” from a social perspective as an extension of its developer, but it doesn't have the intelligence to negotiate over it much (and I think that's behind some of the model-simplification pressure that's encouraged heavy vertical integration).
- izacus 5y ago
  This is being added to Android 12 as a feature, so most new builds should have it.
- fragileone 5y ago
  You're looking for Privacy Dashboard, which is available as a 3rd-party FOSS standalone app[1] or built into Android 12. [1] https://github.com/RushikeshKamewar/PrivacyDashboard https://github.com/RushikeshKamewar/PrivacyDashboard
- cdesai 5y ago
  We do, https://calyxos.org/features/ https://calyxos.org/features/ (Look for "Trusted Agent" to see a screenshot) The code for this was already present in AOSP, Google simply had it disabled / reverted in their builds. We just bring it back like many other Android ROMs.
hentrep 5y ago
Others have mentioned GrapheneOS as an alternative. Recent Graphene builds include sandboxed Google Play compatibility layers [0] [0] https://grapheneos.org/usage#sandboxed-play-services https://grapheneos.org/usage#sandboxed-play-services
grey_earthling 5y ago
From https://calyxos.org/about/ https://calyxos.org/about/: > In social science, agency is defined as: the capacity of individuals to act independently and to make their own free choices. > built-in integration for Signal and WhatsApp calls Signal and WhatsApp are both fully centralised, tied to a single organisation each — they are antithetical to agency. Why not use open protocols like DeltaChat, Matrix or XMPP instead? > built-in free “Virtual Private Network” services from trusted organizations protect you from being spied on Trusted by whom?
- spinax 5y ago
  > Trusted by whom? Calyx VPN uses the same tech stack as Riseup VPN, which are branded versions of the Bitmask client - CalyxOS is a part of the Calyx Institute family. You can instead use the Bitmask client from the F-Droid repo and choose to connect to either service with the same app (rather than using branded apps for each service).
  - steelbrain 5y ago
    Curious, does anyone know what's their business model to monetizing the "free" VPN service? How do they make their money back or is it a donation kind of thing?
    - flylikeabanana 5y ago
      I gave them some money at DEFCON 2019 for an unlimited personal hotspot https://boingboing.net/2016/09/22/i-have-found-a-secret-tunnel-t.html https://boingboing.net/2016/09/22/i-have-found-a-secret-tunn...
    - cdesai 5y ago
      It is all based on donations, see https://calyxinstitute.org/projects/digital-services/vpn https://calyxinstitute.org/projects/digital-services/vpn
  - edoceo 5y ago
    Well, I don't trust them either. Does it run Wireguard?
m12k 5y ago
As someone who knows quite little about Android (currently in the Apple ecosystem, but considering jumping ship): When you use these privacy-focused Android versions without Google Play, is there a consistent way to get apps from the Play store to run on there? (e.g. download the APK from somewhere and sideload it). I'd really like an OS that doesn't spy on me, but there's e.g. some goverment ID apps, transit apps and so on, that I'd really not like to have to give up.
- mackrevinack 5y ago
  ive been trying that it the last while with an old phone where i didn't bother logging into google when i reset it. i just use tasker on my main phone to extract the apk for the current app and save it into to my syncthing folder and sync it across that way. but there are other apps that will let you extract the apk's as well. so far only one or two have worked unfortunately but most do
- simonmales 5y ago
  In short yes.
- godelski 5y ago
  You are always able to add playstore in. But of course this comes with some cost to privacy. There's also other app stores like f-Droid. Usually these are populated with the same apps but often there are ones you are going to have a harder time getting. Does anyone know if there's a way to do a sandboxed playstore? Like you can use it to download the apps and update (assuming this won't be automatic) but that it is contained otherwise?
  - dstryr 5y ago
    - Install Shelter from F-Droid - Install the Aurora store apk inside of Shelter - Open Aurora store in Shelter's work profile and use like a normal play store and all apps installed within Aurora remain sandboxed
    - cdesai 5y ago
fitblipper 5y ago
The thing which always makes me hesitant about these projects is that they don't receive frequent security audits and not having an expensive brand behind them makes them more at risk to being willing to trash their name at the cost of my privacy and security. I consider these to be a fairly critical part of any project which claims superior privacy and security. I think about it this way: Should I trust A. The company which has thousands of developers working on it and wants to avoid their brand being dirtied by failures in security and privacy. B. The small group of people who have formed an organization which may or may not be another Anom like FBI controlled software. Don't get me wrong, I absolutely want to pick B, but I consider it much more risky since there are a lot more unknowns around that. At least with A I know what I'm getting (basically a free flow of my info to whichever government asks for it, but cross my fingers they don't ask for it or that A doesn't want too broad of a breach of trust).
- dheera 5y ago
  > B. The small group of people who have formed an organization which may or may not be another Anom like FBI controlled software. Um, this project is 100% open source, unlike Google's flavor of Android. If there are backdoors to the FBI they will be exposed in due time. https://gitlab.com/CalyxOS https://gitlab.com/CalyxOS That said I'd love to understand how it compares to LineageOS.
  - tkzed49 5y ago
    I just don't buy this take. There's so much code; how can you be certain it will face sufficient scrutiny just by virtue of being available?
    - enriquto 5y ago
      you cannot be certain, but at least the code has the chance to be publicly scrutinized. This is not the case at all with google binaries, so you have a net, objective gain.
    - atatatat 5y ago
Ninjinka 5y ago
Only available on Pixel phones and a single Xiaomi phone.
- dcow 5y ago
  Got to start somewhere.
- SubzeroCarnage 5y ago
  Unlike GrapheneOS (which I recommend you use if you can) and CalyxOS, my project https://divestos.org https://divestos.org is tested working on 30+ devices.
  - atatatat 5y ago
    Very cool! Few quips: Silence was last updated (on F-Droid) a year ago — is this project secure//being maintained? & Mozilla-cousin browser: you're going to lose the security clout these days unfortunately.
    - SubzeroCarnage 5y ago
      Silence is sadly no longer maintained, but it still seems to work for now. I will eventually replace it. Re Mozilla: I do state on my browser comparison page that Chromium browsers are more secure. Also the Bromite repository is included in F-Droid by default on DivestOS.
      - atatatat 5y ago
        Very cool! Thanks for stopping in here!
  - atatatat 5y ago
    Props on bringing verified boot to those devices Lineage can//will not, and doesn't tell users clearly that they could have it with other options.
m0ngr31 5y ago
I've been using MicroG+Lineage for a few years now. No complaints from me, but I don't use a ton of apps. Not sure what the advantage of CalyxOS would be over my current setup (especially considering Lineage has a much better catalog of supported devices)
- commoner 5y ago
  If you are not using root, CalyxOS lets you relock your bootloader with the developer key, which increases the security of your device by preventing other operating systems from being booted or flashed onto your device (until you choose to unlock the bootloader again, which requires you to enter your lock screen password and would wipe the device data). CalyxOS only supports devices with bootloaders that can be relocked with a custom key.
flas9sd 5y ago
Calyx made an effort to sponsor and integrate the backup tool Seedvault (https://calyxinstitute.org/projects/seedvault-encrypted-backup-for-android https://calyxinstitute.org/projects/seedvault-encrypted-back...) into their ROM - and other AOSP distributions benefit from this effort. Handhelds are tethered devices, its essential to have contacts and precious photos stored at a second place (online or offline) and easily restored or used when changing devices. A user friendly full backup solution not requiring root access of some sort was missing to date.
- cdesai 5y ago
  Thank you for bringing this up. We're continuing to fund work on it, both ourselves and also through applying for external funding. Full Storage backup support (Files / Photos) was recently added thanks to a grant from NLnet - https://nlnet.nl/project/Seedvault/index.html https://nlnet.nl/project/Seedvault/index.html https://github.com/seedvault-app/seedvault https://github.com/seedvault-app/seedvault Contributions welcome!
  - alfiedotwtf 5y ago
    Does Seed Vault backup the whole device? Last time I used it, I found out that apps can opt-out of being backed up, along with their settings. In other words, every app i installed didnt get backed up :(
    - summm 5y ago
      As if an app should have any say about if it can be backupped or not. 'Muhh security model'. If your security model includes letting apps randomly deprives me as a user of backups of my own phone , it's just another creepy google-bigbrother-wannabe.
      - summm 5y ago
        https://github.com/seedvault-app/seedvault/issues/165 https://github.com/seedvault-app/seedvault/issues/165 this is the issue, and it seems they are working on it. Good. What I didn't understand is why one would need to fake some Device2Device transfer, when one could just as well patch the root cause. It's open source after all.
JoeyBananas 5y ago
8orl .o 1
dcow 5y ago
If you're unfamiliar with the context: Calyx Institute is a 501(c)(3) with a digital privacy and security mission. For a while they've offered, for a few hundred dollars a year donation, unmetered access to sprint's network. I don't know the details but I think they have retained access to the network through the merger due to some non-profit provision (something like the sprint merger was allowed with stipulation that certain agencies using the network for certain purposes would be grandfathered over). There's apparently more history related to the founder previously running an ISP under gag order, which drives their mission. Access to the network is only possible through wifi pucks. I asked if I could register the IMEI of my ThinkPad's modem/radio, but they wouldn't allow it citing the usual "we are responsible for the behavior of the devices on the network so you have to use our certified device". Sadly, these phones do not participate in Calyx's data network, they require a traditional carrier. Maybe it's part of their roadmap to eventually offer their data services on these handset form factor devices? But until then, I don't see a huge point. It would be really awesome to say "I get my network access through a privacy oriented non-profit" (:
- yellow_lead 5y ago
  More info here. https://calyxinstitute.org/ https://calyxinstitute.org/ Looks like $500-$600 for 4G, and $750 for 4G/5G. Could be a good deal for certain people. But yes, it's lame you have to use the puck.
  - User23 5y ago
    I purchased this several years ago. I don't regret it because I was buying to support the Calyx mission and not for the access point, but it worked reliably for about a month and then it got QoSed into unusability.
- posguy 5y ago
  I wonder if the MEID/ESN locking will go away with the sunset of the Sprint network? It should be possible to move the Calyx SIM to any device you like at that point.
- windthrown 5y ago
johnnyApplePRNG 5y ago
I made the mistake of purchasing a DOOGEE phone a few months back. Won't touch it now that I realize the OS is completely hijacked by whatever chinese company produced this not-half-bad phone. (It goes so far as adding a watermark of the company logo to every photo I take! Sure I can disable it but I just don't feel right putting anything of value on there.) What would happen if I tried installing CalyxOS on it? Or another android compatible operating system? It's not listed as compatible on any alternative android OS that I can see at least.
- commoner 5y ago
  Copying my reply to another comment: Not recommended. Downloads are tailored to specific device models, and installing an operating system image intended for a different device model would not work and could brick your device. DOOGEE phones are not supported by LineageOS, and there is unfortunately hardly any developer focus on this brand: https://forum.xda-developers.com/c/doogee.12007/ https://forum.xda-developers.com/c/doogee.12007/ You are probably better off selling it. A used Google Pixel 3a is in the same price range, and would make a much more flexible replacement.
- zozbot234 5y ago
  > I made the mistake of purchasing a DOOGEE phone a few months back. You can't make this stuff up. Does it ship with a Shiba Inu as the default background (and photo watermark, of course)?
cdnsteve 5y ago
I like this, along with membership enrollment so I can help pay to keep the project alive. Will have to test this out.
hfkfktnekfm 5y ago
How does one verify that this is not a honeypot project funded by the FBI, like those secure phones from a month ago?
- ogwh 5y ago
  There are some people and organisations you can never keep out. It doesn't matter what software you use. You may stand a good chance of keeping the average snooper out, and for that you need to trust the software provider. So it ultimately comes down to who you trust more to keep your stuff moderately secure. If you don't want anyone (but yourself) to have access to your information then don't store it digitally. So who do you trust more, Google or random people on the Internet? Neither are an ideal choice, because there isn't one.
cdesai 5y ago
Lead Developer here, AMA?
- luca020400 5y ago
  Director/Head Developer @ LinaegeOs here. Hi, sharing codebase when? :P
  - cdesai 5y ago
    We're already sharing developers, even one of the directors :P Only question is: who forks what.
    - luca020400 5y ago
      Guess I'll play a bit more on CalyxOS then. Feel free to hire me I guess. We are the base of course.
- fragileone 5y ago
  1) What would you say are your unique differences from LineageOS and GrapheneOS? 2) What big goals/projects are planned for the future? 3) Where do you see Android as a platform in 5 or 10 years? Any predictions or notable obstacles? 4) What do you think of mobile Linux distributions?
  - cdesai 5y ago
    > 1) What would you say are your unique differences from LineageOS and GrapheneOS? We do borrow a lot of code from other projects and try to send any fixes / improvements back to them. We try to provide an OS designed to ensure maximum usability and flexibility, so that you have an array of choices available to ensure your privacy and security. For example, I really like the way we have microG available - https://calyxos.org/features/microg/ https://calyxos.org/features/microg/ You can choose to disable it (which still has benefits), keep it enabled, or even login a Google Account. There's even a fourth option where you have it enabled but without the notifications / communication with Google servers, where it's still useful for some app compatibility, and things like location providers and exposure notifications. > 2) What big goals/projects are planned for the future? Our biggest goal has always been expanding the reach of the project. We want to support cheaper phones which are widely available in the world. We also have a bunch of features in the works or planned for the future - Panic trigger improvements, built in ad/tracker block (without losing the ability to use a VPN), and more. Most of it is documented as https://gitlab.com/groups/CalyxOS/-/epics https://gitlab.com/groups/CalyxOS/-/epics > 3) Where do you see Android as a platform in 5 or 10 years? Any predictions or notable obstacles? We will be at S now, which means we'll be at Z in 7 years. What happens then? Kidding aside, I'm always excited by watching the changes Google is doing (some of it is done in the open, through AOSP at https://android-review.googlesource.com/ https://android-review.googlesource.com/ - you see lots of Rust here nowadays, I need to learn that) Fuchsia is also going to be interesting, they must have something planned. > 4) What do you think of mobile Linux distributions? I have massive respect for them given the work they're doing. I always see at it this way - we're working on Android, and especially on the Pixels - all the hardware is there working for us, so we can focus our efforts on improvements in other areas. Linux on mobile has to spend a lot of time catching up to just the basics (getting phone calls working for example). There are pros and cons to both, it entirely depends on your use case to see what fits.
seaghost 5y ago
Nice, but still very Google dependant for security and OS updates.
- Koshkin 5y ago
  Which, looks like, defeats the whole purpose. (It's almost like if ReactOS or WINE allowed Microsoft Windows updates.)
  - cdesai 5y ago
    I'd argue that it's more akin to Ubuntu relying on Debian for updates, or Microsoft's Edge / Brave Browser / one of the many other forks relying on Google for Chromium / Blink updates. The one distinction is in addition to the open source code comparison here, we also use some proprietary bits from their updates, which are needed to get the phone booting and basic hardware working.
gautamcgoel 5y ago
Can you run this on the desktop?
- commoner 5y ago
  The CalyxOS website publishes emulator images, if you would like to test the OS in Android Studio: https://calyxos.org/news/2021/05/27/emulator-images/ https://calyxos.org/news/2021/05/27/emulator-images/
somenewaccount1 5y ago
F-Droid is for distributing viruses. There may be legit apps on there, but there are also tons of virus's and not enough app oversite to be safe. It's doesn't seem like much of a threat because the userbase is so small that not a lot of hackers target it. Once it has 5% of pop though, it would be a meaninful target - particularly since these are rooted phones.
- hjek 5y ago
  > F-Droid is for distributing viruses. Lol, please point me to one? (Or an article about one?)
- juniperplant 5y ago
  Your comment seems to imply that the majority of apps on F-droid are malware. I don't think that's the case. Also, F-droid does not require root.
- inickt 5y ago
  It has been years since I have used Android (and F-Droid), but I always thought F-Droid was pretty heavily curated and had a sane security model [1]. Why do you say it is for distributing viruses? [1] https://f-droid.org/en/docs/Security_Model/ https://f-droid.org/en/docs/Security_Model/
hjek 5y ago
Is there an Android X86 build of this? That would be an awesome laptop OS.
rchaud 5y ago
It's ironic that the only devices this can be installed on are Google phones and one Xiaomi phone.
- summm 5y ago
  Even with the most secure alternative Android, you always have blobs from the original manufacturer that you have to use for some hardware-related critical functionality. And of course, the baseband that usually has full access to device's memory using DMA. That's where the backdoors go, I'd suspect. In this regard I'd trust Xiaomi way less than Google. However, Google phones have been subpar for a long time. E.g. the storage was too small and non-extendable. Makes sense from a Google point of view, as you're supposed to store everything into their cloud. But not well suitable for offline-first and privacy-first.
vbsteven 5y ago
I’m thinking about buying a degoogled Android phone to replace my iPhone. The main things I want are: * Spotify needs to work over Bluetooth in my car * WhatsApp needs to work (preferably with push notifications) * I need the Fitbit app to work so my watch can show push notifications from my personal apps * a network-based location provider to be consumed by my personal apps (I’m working on a personal data and automation suite that relies on frequent smartphone location updates) Is this something that can be done with CalyxOS on a Pixel? Can other Android flavours like GrapheneOS or LineageOS do this? And aside from Android, how far along are other “mobile linux” smartphones for use as a daily driver with regards to the above points?
- corty 5y ago
  I don't know about Fitbit stuff, but LineageOS can do everything else you named. Have been using it for years. I guess other alternative Android distributions shouldn't be too different there.
- hadrien01 5y ago
  For you first two questions: Spotify will work with Bluetooth, and WhatsApp will have eventual notifications (real-time if the app was recently opened, up to seven hours later otherwise, at least on my device)
  - cdesai 5y ago
    We're very close to getting the notification issues fixed. We've sent some patches to microG to address them at https://github.com/microg/GmsCore/pull/1483 https://github.com/microg/GmsCore/pull/1483 I'm running it on my device since a few weeks now and it has been quite reliable so far.
    - hadrien01 5y ago
      I don't use microG, the delay is WhatsApp waking itself up
  - prox 5y ago
rodolphoarruda 5y ago
Most of the de-Googled or Linux based mobile OSes have their installation restricted to Pixel phones. Why? Is there any option for old Motorola phones?
- LukeShu 5y ago
  Because those are the phones that are supported in the upstream Android Open Source Project (AOSP), which these OSes are typically based on. Other phones, even ones that to a great job of publishing their sources (like Sony's), have their support living outside of AOSP. And older phones get dropped from AOSP, the original Pixel was dropped in Android 11. So, by only targeting the devices that AOSP supports these OSes can focus on the interesting part of building the OS, rather than getting bogged down with hardware support.
  - cdesai 5y ago
    The other aspect to this is that you can install a custom OS on the Pixels and still re-locked the bootloader, which means you get Verified Boot and all the security guarantees that brings. https://source.android.com/security/verifiedboot https://source.android.com/security/verifiedboot
    - LukeShu 5y ago
      You actually couldn't do that with the original Pixel (which until recently, Android 11, these custom derivatives tended to support). You'd get a warning screen every boot about how the OS has been modified.
      - cdesai 5y ago
        You definitely could, we used to support it in a previous iteration. This was also possible on the Nexus devices, although the oldest I've tried it is the Nexus 6P. It just worked slightly differently on those, nowadays you enroll the public key by flashing it to the device, on those (Pixel 1, Nexus) you used to have the public key embedded in the kernel.
Paul_S 5y ago
That is lovely but what use is it of I have to buy a new phone to use it because it doesn't support the phone I have.
- cutler 5y ago
  Exactly. I want it for my Facebook-infested Samsung Galaxy A20 but I guess I'm out of luck.
dopu 5y ago
It used to be that iOS was the recommended phone OS if you were looking for the best combination of privacy and security. Even Daniel Micay (the lead developer of GrapheneOS) thought so, 2 years ago [0]. But these ROMs are looking much more mature these days. Anyone have thoughts on how CalyxOS and GrapheneOS compare to iOS in the present day? [0]: https://www.reddit.com/r/GrapheneOS/comments/bddq5u/os_security_ios_vs_grapheneos_vs_stock_android/ https://www.reddit.com/r/GrapheneOS/comments/bddq5u/os_secur...
- cosmojg 5y ago
  To my knowledge, GrapheneOS has become the leader of the mobile security space while CalyxOS remains more-or-less on par with iOS. This all depends on your security model, though. There are tradeoffs everywhere.
amelius 5y ago
Can you run banking apps on this without problems? And can Google block any apps that run on this Android clone?
throwawaycuriou 5y ago
It's not clear from what I have read anywhere on the site if installing CalyxOS is reversible. If you want to get back to Android can you?
- cdesai 5y ago
  You can easily go back to stock Android, http://calyxos.org/get/back-to-stock http://calyxos.org/get/back-to-stock
  - throwawaycuriou 5y ago
    Are there any other repercussions one should consider before giving this a try? Would software that uses DRM such as Netflix be affected?
fithisux 5y ago
Question, is it Raspberry Pi compatible?
bishoprook2 5y ago
So where is my OpenBSD phone?
SavantIdiot 5y ago
Side note: Tor Browser as your primary browser is super painful. Lots of stuff doesn't work, and latency can be in the minutes.
buzzy_hacker 5y ago
Are there any resources summarizing the differences between… - CalyxOS - Purism, Librem - microG - /e/ - LineageOS - LineageOS for microG - GrapheneOS And I’m sure many other Android open source/degooglers?
- gnufx 5y ago
  Purism's Librem runs GNU/Linux, not Android; microG is a free replacement for Google bits in Android (Google "services", including location services from other sources); LineageOS is a non-privacy focussed, somewhat de-Googled Android; /e/ is a privacy and free software focussed derivative of LineageOS with a larger set of supported hardware; GrapheneOS is a security-focussed (not privacy-focussed) version of Android with rather limited hardware support. It's not clear to me what the fundamental difference is between CalyxOS and /e/ other than hardware support and what's built-in.
  - buzzy_hacker 5y ago
    Thank you!
- phh 5y ago
  It doesn't answer your real question, but still, I'll try to make a summary: All of CalyxOS, LineageOS, LineageOS for microG, GrapheneOS and /e/ are Android distributions (based on the open-source part of Android, with some modifications and additions) Purism (brand name) Librem 5 (model name) is an opensource smartphones that reduces black boxes to closed areas, while on most smartphones black boxes like modem share RAM access, using a brand new GNU/Linux (so not Android) smartphone OS. microG is fundamentally simply an opensource Android app, that replaces some small parts of Google Services (which are very big unauditable closed-source Android apps), so apps requiring Google Services may have a chance to work without Google services. However microG requires a bit more permissions than a standard app, that's why there needs to be a "LineageOS for miroG" to support microG. Now, between CalyxOS, /e/, LineageOS, and GrapheneOS: - LineageOS targets devices support. LineageOS supports many devices officially, and provides infrastructure to support many more unofficially. They also include many features, but it doesn't feel like they have a specific orientation, and they are happy to integrate with Google apps. They are the very core of Android community original development. - GrapheneOS is security first and foremost, no matter the cost to usability (their philosophy there does seem to evolve to open to more users recently). They do (great) security original development. - /e/ is market first. They focus on having the best experience to the user, and try to reach as many users as possible. They have very little original development, their value is mostly in communication, and providing a "cloud" account. - CalyxOS is targeting a good private user-experience. This goes both by having good usable defaults, and filling gaps. They have nice original developments in making Google-less more usable.
ranguna 5y ago
How risky is it if I install this on a device that is not on the supported list?
- commoner 5y ago
  Not recommended. Downloads are tailored to specific device models, and installing an operating system image intended for a different device model would not work and could brick your device. If your device is supported by LineageOS but not CalyxOS, LineageOS for microG is an alternative OS that might work for you: https://lineage.microg.org https://lineage.microg.org
  - ranguna 5y ago
    Perfect, thank you very much for all the info !
new_stranger 5y ago
I purchased a Pixel phone to test this stuff on. I installed LineageOS and found I couldn't run some google apps. I reinstalled LineageOS with https://opengapps.org https://opengapps.org added during the install and made the mistake of transferring from my old phone which brought all the google services and everything back to the phone (mostly). I then installed CalyxOS - much easier install process than lineage. Really liked the defaults. Could not get many apps that relied on google play services though. If I didn't need so many Google-tied apps I would pick this as my phone OS for basic stuff like messaging and browsing. Installed LineageOS again, found there were a couple apps I could not get working after all (50 different apps installed). In the end I gave up and re-flashed Google firmware back onto the phone. I spent about 10 hours on all this stuff and simply ran out of time for now. I though I could get away from Google but I didn't realize how much my apps needed Google.
- yusi-san 5y ago
  You can try lineage with MicroG[0][1], it replaces Google services. If you want stores there is the F-Droid store for FOSS app or Aurora Store if you want casual apps. YouTube can be replaced by NewPipe and these days I'm trying Organic Maps (a layer for OSM with nav and offline maps) to replace Google Maps. [0] : https://microg.org/ https://microg.org/ [1] : https://lineage.microg.org/ https://lineage.microg.org/
  - sleavey 5y ago
    Does WhatsApp still work? I care about privacy and degoogling but I'm not yet quite ready to abandon my social network over it. Currently I use lineageos with the micro Google apps bundle which provides the real Play Store services and WhatsApp still works. I'd be happy to use the replacement if that was still the case. EDIT: for clarity, by "micro Google apps bundle" I mean the opengapps [1] micro variant. [1] https://opengapps.org/ https://opengapps.org/
    - rashil2000 5y ago
      I use LineageOS+microG and practically all apps not made by Google (WhatsApp, Spotify, PayTM) work as they should. Even for some Google apps, there are good alternatives like YouTube Vanced etc.
joecool1029 5y ago
> microG replaces some functions of Google Play Services while maintaining much more anonymity and privacy. I've said it before and saying it again on here for those that don't know: microG breaks the security model on android and adds in package signature spoofing. It's the only way to add a fake Google Play Services without needing to pull Google blobs. This is why projects like LineageOS are against using this method, it weakens overall package security. However, it is still possible for the tinfoil hat crew to not use Google play services with OS like LineageOS. This will of course break some functionality (apps will have to poll instead of relying on push) but it will not break the security model. I'd like a different, better set of options to choose from but we don't have it at this time. Most users should probably choose a minimal Google Play distribution if they value things like battery life and working apps while still maintaining protections against spoofed apps.
- josh_today 5y ago
  Funny that you’re using “tin foil hat crew” the day after Apple announced snooping on everyone’s pictures
  - genewitch 5y ago
    Also google has never ever used users' data to turn a buck or anything.
  - collsni 5y ago
    Yeah more like a "baseball cap crew" these days.. lol i dont trust corporations.
  - atatatat 5y ago
    Especially since tinfoil would be like an antenna. Everyone knows that.
- cdesai 5y ago
  I've said this in another comment, but I'll duplicate here: The microG creator goes into more detail about signature spoofing at https://github.com/microg/GmsCore/issues/1467#issuecomment-840711695 https://github.com/microg/GmsCore/issues/1467#issuecomment-8... The concerns usually raised against that are due to the "default" patch included in their repository, which has a specific purpose. We don't use that, https://calyxos.org/about/tech/microg/ https://calyxos.org/about/tech/microg/ are the precautions we take to try and prevent "weakening overall package security" In addition, microG is optional and can be disabled on first install, see https://calyxos.org/features/microg/#1-microg-disabled https://calyxos.org/features/microg/#1-microg-disabled
mark_l_watson 5y ago
It is asking a lot, but this would be nice: if the developer organizations behind CalyxOS and GrapheneOS could sell new phones with software installed, sort of like System 76 for Linux laptops.
- abawany 5y ago
  I believe CalyxOS sells a Pixel 4a preloaded with membership (https://calyxinstitute.org/membership/calyxos https://calyxinstitute.org/membership/calyxos).
  - mark_l_watson 5y ago
    Thanks for that.
kristov 5y ago
I have been using LineageOS without google replacement libs for about a year. There is a huge amount of comments here, which is interesting in itself - clearly there is a lot of interest in de-googled Android. I worry about fragmentation, eg: if there are too many options will they get diluted without the larger user base. Many apps won't work without google libs. I would like to think that this puts pressure on app builders to not just blindly require google libs, but the reality is without a significant user base wanting it, the tradeoff will always side with the majority. Interestingly WhatsApp works fine - presumably because using your competitors libs is seen as a no-no. FB are no angels here, but I need WhatsApp for family chats.
- hfkfktnekfm 5y ago
  WhatsApp still works on a 9 year old Android I still have. Remember that a large part of the world doesn't have fancy phones, and WhatsApp needs to work on all kinds. In fact, it's easier to install WhatsApp with severely limited permissions, while I just couldn't install the supposedly much more private Signal without giving it SMS access.
cyberpanther 5y ago
After using CalyxOS for a while, I came up with a method to use stock android and preserve more of your privacy. https://hackernoon.com/have-your-privacy-cake-on-android-and-eat-it-too-db1f37b5 https://hackernoon.com/have-your-privacy-cake-on-android-and...
- strcat 5y ago
  You might be interested in the sandboxed Play services compatibility layer being developed by GrapheneOS: https://grapheneos.org/usage#sandboxed-play-services https://grapheneos.org/usage#sandboxed-play-services An early release of this is already available in the Stable/Beta channel releases. Our hope is that more projects take interest and collaborate on making a much more broadly compatible alternative to microG with the same security sacrifices it makes.
temp8964 5y ago
I just transferred from Android to iPhone today. I wouldn't bother to use these alternative Androids, because I don't trust 3rd party app stores. There are banking, authenticator, and other essential apps I will never download from a 3rd party app store.
- fragileone 5y ago
  Not even an app store that distributes only open-source software (eg F-Droid)? Considering the reputation for scams and malware on 1st party app stores I could never understand this perspective.
toastal 5y ago
Something like this seems a lot easier to set up than the hoops I ran through to get my Xaiomi Redmi K20 Pro running Havoc OS + microG. I wish it were more straightforward to get more device compatibility for builds. With GNU/Linux I pick my CPU architecture and I'm good to go. With a project like this, I, given my Android proficiency, should wait who knows how long to get a compatible build. But why a separate build for every device?
- fragileone 5y ago
  Previously Android phones were allowed to be released each with modified unique kernels. All new phones which ship with Android 12 however must use the same generic Android Common Kernel, and any device-specific drivers are then attached via kernel modules. So basically from September-ish all future Android phones should be able to boot off the same image, or at least a Generic System Image.
danvittegleo 5y ago
CalyxOS is an awesome project. I have worked with the lead developer a bit over the past few years and it's been such a pleasure. We share some bits of code between our projects here: https://github.com/AOSPAlliance https://github.com/AOSPAlliance. If anyone is interested in building their own custom android OS in the cloud (AWS) with same ability to lock your bootloader like CalyxOS, you can checkout my project I've been maintaining for a few years now called RattlesnakeOS: https://github.com/dan-v/rattlesnakeos-stack https://github.com/dan-v/rattlesnakeos-stack. And if you prefer to not build in the cloud, there is also a really great project called robotnix (https://github.com/danielfullmer/robotnix https://github.com/danielfullmer/robotnix) which provides a way to build many flavors of OS (AOSP, GrapheneOS, LineageOS, etc).
- busymom0 5y ago
  How expensive is it to build android in the cloud? And how are the build times? Is it possible to do it on a local Mac mini instead or will that take too long to build?
  - danvittegleo 5y ago
    With rattlesnakeos-stack, it uses spot instances and defaults to a c5.4xlarge which takes about 7-8 hours to build AOSP and Chromium (for an up to date webview) and equates to about ~$1 a build. I typically build on a c5.24xlarge instance which takes about 2.5 hours and costs about ~$2 per build. Unfortunately both AOSP and Chromium are massive projects that require a ton of computing power to build quickly. It's definitely still possible to do on less powerful machines, but it's just going to take a lot longer to do builds.
    - hayd 5y ago
      Is any of the build cached?
      - danvittegleo 5y ago
        In order to limit costs, everything is pulled from source on each build and there is nothing cached. This strategy takes advantage of the fact that AWS doesn't charge for ingress traffic and unfortunately puts additional load on Google's servers. I've attempted a few different strategies on caching AOSP and Chromium source trees, but since you have to incur the storage costs on an ongoing basis, it's just not very economical.
surajs 5y ago
I am as a rule wary of anyone who decides to offer me "privacy" as a USP of their products, I didn't pick up the phone or laptop to get more privacy, but to share more data. Moreover, the iron law of oligarchy seems to suggest that those who are excessively concerned about my data must need it more.
the_biot 5y ago
The trouble I have with AOSP of all flavors isn't lack of Google Services, it's lack of access to the app store. I can do fine without Google Services, but I occasionally need an app that's just not available on F-Droid, and Google is doing their level best to make it harder to get APKs any other way. You used to be able to download them from the store; no longer possible. They've announced some other package format, support for which I assume won't be released to AOSP. They're locking Android ever closer in to their store, and it makes any alternative Android distribution ever more dependent on Google.
- sphinxcdi 5y ago
  You can access and download apps from Google Play Store with Aurora Store. https://gitlab.com/AuroraOSS/AuroraStore#aurora-store-a-google-playstore-client https://gitlab.com/AuroraOSS/AuroraStore#aurora-store-a-goog... > Google is doing their level best to make it harder to get APKs any other way. You used to be able to download them from the store; no longer possible. They are making it easier with Android 12 by letting third-party stores do automatic updates without user interaction, not harder. https://developer.android.com/about/versions/12/features#automatic-app-updates https://developer.android.com/about/versions/12/features#aut... It has always been the case that OEMs need to bundle Play Services in the OS and that you need an account to access Google Play. Some OEMs like Samsung and Huawei bundle their own store, "the store" isn't a thing. Raccoon, Yalp Store, Aurora Store, etc. to access Google Play have always existed too. > They've announced some other package format, support for which I assume won't be released to AOSP. It's not a new format, it's open source and Aurora Store and other stuff supports it just fine. It's not locked to Google Play.
  - the_biot 5y ago
    I had no idea about Aurora Store, this changes things for me. Thanks!
BorisMelnik 5y ago
very cool project - assuming by de-bloating all this google-ware the battery performance might be better?
thoughty 5y ago
Anyone know if they ship the phone to india?
ForHackernews 5y ago
How does CalyxOX compare to /e/ https://e.foundation/ https://e.foundation/ ? I've been really happy with /e/ in daily usage but I'm curious to see what other projects are out there.
- commoner 5y ago
  phh compared a bunch of Android distros here: https://news.ycombinator.com/item?id=28093473 https://news.ycombinator.com/item?id=28093473 Comparing just CalyxOS to /e/, both include microG as a substitute for Google Play Services. That's the main feature they have in common. Some of their differences: - CalyxOS's upstream is AOSP, while /e/'s upstream is LineageOS. - CalyxOS is intended to be used with a locked bootloader, while /e/ is mostly intended to be used with an unlocked bootloader. (As an exception, /e/ supports a locked bootloader for the Fairphone 3, but I'm not sure if there are any other models that work the same way. /e/ install instructions for Fairphone 3: https://doc.e.foundation/devices/FP3/install https://doc.e.foundation/devices/FP3/install) - CalyxOS supports a few devices, since the project only considers devices that support relocking the bootloader with a custom key and have a monthly security update schedule from the manufacturer. /e/ supports a much larger number of devices. - /e/ integrates its optional open source cloud service, ecloud, which includes email, calendar, contact, photo, and file hosting. CalyxOS does not offer an equivalent first-party service.
uhtred 5y ago
Surprised not many people talking about /e/ https://e.foundation/e-os/ https://e.foundation/e-os/
einpoklum 5y ago
Is there some crowdfunding initiative to get this working on additional phones? I would contribute to get this working on more Xiaomi phones for example.
majka72 5y ago
having to buy a pixel phone for this is too expensive for the 2,5 world countries folks anyway. Unfortunately, it won't become popular if brands like xiaomi don't work with this kind of software, and I know there are many reasons why it will never happen.
niutech 5y ago
Similar projects: https://e.foundation/ https://e.foundation/ and https://replicant.us/ https://replicant.us/

1010 points by ssklash 5y ago

Since Microsoft now supports Android apps, you can expect ungoogled android to become more popular since more apps would be written which dont need play store

wingmanjd 5y ago
Doesn't the Microsoft Android support require an Amazon account, though?
- theunspoken 5y ago
  yes and no. first of all: which services does Amazon provide that would make an app dependent on them in the same way it might be on Google services? does Amazon have its own system for push notifications? for weather data? for syncing contacts? secondly: it has been confirmed that Android apps will be able to be sideloaded. a Microsoft employee tweeted about it but I can't really find the post right now
  - commoner 5y ago
    > does Amazon have its own system for push notifications? Yes, but only for Amazon (Fire) devices. Amazon Device Messaging handles push notifications to Amazon devices: https://developer.amazon.com/docs/adm/faq-adm.html https://developer.amazon.com/docs/adm/faq-adm.html Microsoft might implement Amazon Device Messaging in Windows 11. > secondly: it has been confirmed that Android apps will be able to be sideloaded. a Microsoft employee tweeted about it but I can't really find the post right now Here: https://www.theverge.com/2021/6/25/22550689/windows-11-android-app-sideload-amazon-app-store https://www.theverge.com/2021/6/25/22550689/windows-11-andro...
Popegaf 5y ago
I hope so, but at the same time, which app developer is going to target compatibility with the windows desktop when writing an app? Also, how will/do apps that depend on Google Services work (or not)? Is there some shim or something?

jszymborski 5y ago

So, what's the current experience like on Android w/o Play services? I know at some point it was quite bad but that there were some up-and-coming solutions.

Popegaf 5y ago
Some apps (especially banking and governmental apps) refuse to start at all. With microG (https://microg.org/ https://microg.org/) you can run a wide range of apps though. It's quite bearable, especially if you aren't an app junkie that downloads every app promising a discount on that new store you're purchasing from.
fragileone 5y ago
microG as a semi-Play Services experience is fine, the only issue I have is that most network-based geolocation backends tend to be hit or miss. I usually have to enable the Apple location service if I need a fast geolocation.
- commoner 5y ago
  Mozilla Location Services is crowdsourced, and you can contribute data from your area with the Tower Collector app to make geolocation faster for you: https://github.com/zamojski/TowerCollector https://github.com/zamojski/TowerCollector
atatatat 5y ago
I struggle to find any half-assed techy person who uses an app that won't run on AOSP/Calyx/GrapheneOS.

kiawe_fire 5y ago

Anybody have experience using something like this (or others like GrapheneOS) as a daily driver? I’m interested in moving away from Apple and big tech in general, but I don’t know how practical that is yet.

terhechte 5y ago
I'm using GrapheneOS on a second device for various reasons. The biggest issue for me is that not all apps work / run. However, I have limited app requirements, so that is fine. If you want to run all social networks, Uber, Lyft, and so on, there might be the one or other that doesn't work (I didn't try them all). However, you can always use the mobile web offering I guess. In terms of classical smartphone features, I know what I don't get out of the box due to the lack of Google Services (Assistant, Picture Sync, etc). That wasn't an issue for me as it is a secondary device.
- atatatat 5y ago
  What apps haven't worked for you on GrapheneOS, from Aurora Store?
  - 0xdeadb00f 5y ago
    Not the person you asked, but my banking app works but occasionally will crash when I go to certain parts of the app. I'm not sure why. Other than that Discord, MS Teams, and ProtonMail all work fine with the exception of push notifications (I disable those anyways, so this isn't a concern of mine).
- strcat 5y ago
  GrapheneOS now has https://grapheneos.org/usage#sandboxed-play-services https://grapheneos.org/usage#sandboxed-play-services providing the ability to install Play services in a sandbox. The core functionality is already working in the Stable/Beta channel releases. You can install it in a dedicated profile to avoid apps in other profiles being able to use it. GrapheneOS is fine with people using Google apps and services but not integrated into the OS and they should be on the same level as other apps and services without any special privileges/access. We're working on making this a reality. Google could implement the fallback code paths we're providing for Play services themselves. All we're doing is teaching it to do what it should already know how to do. Perhaps a regulator can force them to unbundle their services and make them usable anywhere.

bmarquez 5y ago

> you can make encrypted phone calls directly, using the built-in integration for Signal and WhatsApp calls Does this mean WhatsApp is automatically installed with Calyx, or just that there are extra features if you manually install it?

azdle 5y ago
CalyxOS has a handful of apps that exist in the image that you can optionally install. I would assume it's one of those. I run CalyxOS and don't and never did have WhatsApp installed.
- cdesai 5y ago
  WhatsApp is not one of those apps, we only include FOSS apps.
Knighttime 5y ago
Unsure. It seems that they have Signal installed by default, but not WhatsApp. However, if you install WhatsApp you can make a WhatsApp call directly from the dialer I think?
- cdesai 5y ago
  Exactly. Signal is available as a default however you can choose not to install it. WhatsApp is shown as an option if you have it installed, the option won't show up if you don't. The rationale being: We didn't exactly ant to promote WhatsApp but still have it present for those who already use it.

sparaker 5y ago

I don't know if they have this, but a good feature a privacy centric android experience would be, to have a simple accessible log of what app accessed what using which permission.

dasyatidprime 5y ago
I'd worry that translating this to an end-user-relevant concept of security would lead to a lot of scares, though. Probe all the files in a directory to see which ones are “yours”: “What? Why is it accessing all the files? So suspicious!” Require a specific name pattern or something: “I never have to remember to do this on the other apps…” There's a lot of these tradeoffs that in human life are resolved through reference to all sorts of subtle human things that the machine knows not of. We're at this liminal point where “app” software is given a bare form of “agency” from a social perspective as an extension of its developer, but it doesn't have the intelligence to negotiate over it much (and I think that's behind some of the model-simplification pressure that's encouraged heavy vertical integration).
izacus 5y ago
This is being added to Android 12 as a feature, so most new builds should have it.
fragileone 5y ago
You're looking for Privacy Dashboard, which is available as a 3rd-party FOSS standalone app[1] or built into Android 12. [1] https://github.com/RushikeshKamewar/PrivacyDashboard https://github.com/RushikeshKamewar/PrivacyDashboard
cdesai 5y ago
We do, https://calyxos.org/features/ https://calyxos.org/features/ (Look for "Trusted Agent" to see a screenshot) The code for this was already present in AOSP, Google simply had it disabled / reverted in their builds. We just bring it back like many other Android ROMs.

hentrep 5y ago

Others have mentioned GrapheneOS as an alternative. Recent Graphene builds include sandboxed Google Play compatibility layers [0] [0] https://grapheneos.org/usage#sandboxed-play-services https://grapheneos.org/usage#sandboxed-play-services

grey_earthling 5y ago

From https://calyxos.org/about/ https://calyxos.org/about/: > In social science, agency is defined as: the capacity of individuals to act independently and to make their own free choices. > built-in integration for Signal and WhatsApp calls Signal and WhatsApp are both fully centralised, tied to a single organisation each — they are antithetical to agency. Why not use open protocols like DeltaChat, Matrix or XMPP instead? > built-in free “Virtual Private Network” services from trusted organizations protect you from being spied on Trusted by whom?

spinax 5y ago
> Trusted by whom? Calyx VPN uses the same tech stack as Riseup VPN, which are branded versions of the Bitmask client - CalyxOS is a part of the Calyx Institute family. You can instead use the Bitmask client from the F-Droid repo and choose to connect to either service with the same app (rather than using branded apps for each service).
- steelbrain 5y ago
  Curious, does anyone know what's their business model to monetizing the "free" VPN service? How do they make their money back or is it a donation kind of thing?
  - flylikeabanana 5y ago
    I gave them some money at DEFCON 2019 for an unlimited personal hotspot https://boingboing.net/2016/09/22/i-have-found-a-secret-tunnel-t.html https://boingboing.net/2016/09/22/i-have-found-a-secret-tunn...
  - cdesai 5y ago
    It is all based on donations, see https://calyxinstitute.org/projects/digital-services/vpn https://calyxinstitute.org/projects/digital-services/vpn
- edoceo 5y ago
  Well, I don't trust them either. Does it run Wireguard?

m12k 5y ago

As someone who knows quite little about Android (currently in the Apple ecosystem, but considering jumping ship): When you use these privacy-focused Android versions without Google Play, is there a consistent way to get apps from the Play store to run on there? (e.g. download the APK from somewhere and sideload it). I'd really like an OS that doesn't spy on me, but there's e.g. some goverment ID apps, transit apps and so on, that I'd really not like to have to give up.

mackrevinack 5y ago
ive been trying that it the last while with an old phone where i didn't bother logging into google when i reset it. i just use tasker on my main phone to extract the apk for the current app and save it into to my syncthing folder and sync it across that way. but there are other apps that will let you extract the apk's as well. so far only one or two have worked unfortunately but most do
simonmales 5y ago
In short yes.
godelski 5y ago
You are always able to add playstore in. But of course this comes with some cost to privacy. There's also other app stores like f-Droid. Usually these are populated with the same apps but often there are ones you are going to have a harder time getting. Does anyone know if there's a way to do a sandboxed playstore? Like you can use it to download the apps and update (assuming this won't be automatic) but that it is contained otherwise?
- dstryr 5y ago
  - Install Shelter from F-Droid - Install the Aurora store apk inside of Shelter - Open Aurora store in Shelter's work profile and use like a normal play store and all apps installed within Aurora remain sandboxed
  - cdesai 5y ago

fitblipper 5y ago

The thing which always makes me hesitant about these projects is that they don't receive frequent security audits and not having an expensive brand behind them makes them more at risk to being willing to trash their name at the cost of my privacy and security. I consider these to be a fairly critical part of any project which claims superior privacy and security. I think about it this way: Should I trust A. The company which has thousands of developers working on it and wants to avoid their brand being dirtied by failures in security and privacy. B. The small group of people who have formed an organization which may or may not be another Anom like FBI controlled software. Don't get me wrong, I absolutely want to pick B, but I consider it much more risky since there are a lot more unknowns around that. At least with A I know what I'm getting (basically a free flow of my info to whichever government asks for it, but cross my fingers they don't ask for it or that A doesn't want too broad of a breach of trust).

dheera 5y ago
> B. The small group of people who have formed an organization which may or may not be another Anom like FBI controlled software. Um, this project is 100% open source, unlike Google's flavor of Android. If there are backdoors to the FBI they will be exposed in due time. https://gitlab.com/CalyxOS https://gitlab.com/CalyxOS That said I'd love to understand how it compares to LineageOS.
- tkzed49 5y ago
  I just don't buy this take. There's so much code; how can you be certain it will face sufficient scrutiny just by virtue of being available?
  - enriquto 5y ago
    you cannot be certain, but at least the code has the chance to be publicly scrutinized. This is not the case at all with google binaries, so you have a net, objective gain.
  - atatatat 5y ago

Ninjinka 5y ago

Only available on Pixel phones and a single Xiaomi phone.

dcow 5y ago
Got to start somewhere.
SubzeroCarnage 5y ago
Unlike GrapheneOS (which I recommend you use if you can) and CalyxOS, my project https://divestos.org https://divestos.org is tested working on 30+ devices.
- atatatat 5y ago
  Very cool! Few quips: Silence was last updated (on F-Droid) a year ago — is this project secure//being maintained? & Mozilla-cousin browser: you're going to lose the security clout these days unfortunately.
  - SubzeroCarnage 5y ago
    Silence is sadly no longer maintained, but it still seems to work for now. I will eventually replace it. Re Mozilla: I do state on my browser comparison page that Chromium browsers are more secure. Also the Bromite repository is included in F-Droid by default on DivestOS.
    - atatatat 5y ago
      Very cool! Thanks for stopping in here!
- atatatat 5y ago
  Props on bringing verified boot to those devices Lineage can//will not, and doesn't tell users clearly that they could have it with other options.

m0ngr31 5y ago

I've been using MicroG+Lineage for a few years now. No complaints from me, but I don't use a ton of apps. Not sure what the advantage of CalyxOS would be over my current setup (especially considering Lineage has a much better catalog of supported devices)

commoner 5y ago
If you are not using root, CalyxOS lets you relock your bootloader with the developer key, which increases the security of your device by preventing other operating systems from being booted or flashed onto your device (until you choose to unlock the bootloader again, which requires you to enter your lock screen password and would wipe the device data). CalyxOS only supports devices with bootloaders that can be relocked with a custom key.

flas9sd 5y ago

Calyx made an effort to sponsor and integrate the backup tool Seedvault (https://calyxinstitute.org/projects/seedvault-encrypted-backup-for-android https://calyxinstitute.org/projects/seedvault-encrypted-back...) into their ROM - and other AOSP distributions benefit from this effort. Handhelds are tethered devices, its essential to have contacts and precious photos stored at a second place (online or offline) and easily restored or used when changing devices. A user friendly full backup solution not requiring root access of some sort was missing to date.

cdesai 5y ago
Thank you for bringing this up. We're continuing to fund work on it, both ourselves and also through applying for external funding. Full Storage backup support (Files / Photos) was recently added thanks to a grant from NLnet - https://nlnet.nl/project/Seedvault/index.html https://nlnet.nl/project/Seedvault/index.html https://github.com/seedvault-app/seedvault https://github.com/seedvault-app/seedvault Contributions welcome!
- alfiedotwtf 5y ago
  Does Seed Vault backup the whole device? Last time I used it, I found out that apps can opt-out of being backed up, along with their settings. In other words, every app i installed didnt get backed up :(
  - summm 5y ago
    As if an app should have any say about if it can be backupped or not. 'Muhh security model'. If your security model includes letting apps randomly deprives me as a user of backups of my own phone , it's just another creepy google-bigbrother-wannabe.
    - summm 5y ago
      https://github.com/seedvault-app/seedvault/issues/165 https://github.com/seedvault-app/seedvault/issues/165 this is the issue, and it seems they are working on it. Good. What I didn't understand is why one would need to fake some Device2Device transfer, when one could just as well patch the root cause. It's open source after all.

JoeyBananas 5y ago

8orl .o 1

dcow 5y ago

If you're unfamiliar with the context: Calyx Institute is a 501(c)(3) with a digital privacy and security mission. For a while they've offered, for a few hundred dollars a year donation, unmetered access to sprint's network. I don't know the details but I think they have retained access to the network through the merger due to some non-profit provision (something like the sprint merger was allowed with stipulation that certain agencies using the network for certain purposes would be grandfathered over). There's apparently more history related to the founder previously running an ISP under gag order, which drives their mission. Access to the network is only possible through wifi pucks. I asked if I could register the IMEI of my ThinkPad's modem/radio, but they wouldn't allow it citing the usual "we are responsible for the behavior of the devices on the network so you have to use our certified device". Sadly, these phones do not participate in Calyx's data network, they require a traditional carrier. Maybe it's part of their roadmap to eventually offer their data services on these handset form factor devices? But until then, I don't see a huge point. It would be really awesome to say "I get my network access through a privacy oriented non-profit" (:

yellow_lead 5y ago
More info here. https://calyxinstitute.org/ https://calyxinstitute.org/ Looks like $500-$600 for 4G, and $750 for 4G/5G. Could be a good deal for certain people. But yes, it's lame you have to use the puck.
- User23 5y ago
  I purchased this several years ago. I don't regret it because I was buying to support the Calyx mission and not for the access point, but it worked reliably for about a month and then it got QoSed into unusability.
posguy 5y ago
I wonder if the MEID/ESN locking will go away with the sunset of the Sprint network? It should be possible to move the Calyx SIM to any device you like at that point.
windthrown 5y ago

johnnyApplePRNG 5y ago

I made the mistake of purchasing a DOOGEE phone a few months back. Won't touch it now that I realize the OS is completely hijacked by whatever chinese company produced this not-half-bad phone. (It goes so far as adding a watermark of the company logo to every photo I take! Sure I can disable it but I just don't feel right putting anything of value on there.) What would happen if I tried installing CalyxOS on it? Or another android compatible operating system? It's not listed as compatible on any alternative android OS that I can see at least.

commoner 5y ago
Copying my reply to another comment: Not recommended. Downloads are tailored to specific device models, and installing an operating system image intended for a different device model would not work and could brick your device. DOOGEE phones are not supported by LineageOS, and there is unfortunately hardly any developer focus on this brand: https://forum.xda-developers.com/c/doogee.12007/ https://forum.xda-developers.com/c/doogee.12007/ You are probably better off selling it. A used Google Pixel 3a is in the same price range, and would make a much more flexible replacement.
zozbot234 5y ago
> I made the mistake of purchasing a DOOGEE phone a few months back. You can't make this stuff up. Does it ship with a Shiba Inu as the default background (and photo watermark, of course)?

cdnsteve 5y ago

I like this, along with membership enrollment so I can help pay to keep the project alive. Will have to test this out.

hfkfktnekfm 5y ago

How does one verify that this is not a honeypot project funded by the FBI, like those secure phones from a month ago?

ogwh 5y ago
There are some people and organisations you can never keep out. It doesn't matter what software you use. You may stand a good chance of keeping the average snooper out, and for that you need to trust the software provider. So it ultimately comes down to who you trust more to keep your stuff moderately secure. If you don't want anyone (but yourself) to have access to your information then don't store it digitally. So who do you trust more, Google or random people on the Internet? Neither are an ideal choice, because there isn't one.

cdesai 5y ago

Lead Developer here, AMA?

luca020400 5y ago
Director/Head Developer @ LinaegeOs here. Hi, sharing codebase when? :P
- cdesai 5y ago
  We're already sharing developers, even one of the directors :P Only question is: who forks what.
  - luca020400 5y ago
    Guess I'll play a bit more on CalyxOS then. Feel free to hire me I guess. We are the base of course.
fragileone 5y ago
1) What would you say are your unique differences from LineageOS and GrapheneOS? 2) What big goals/projects are planned for the future? 3) Where do you see Android as a platform in 5 or 10 years? Any predictions or notable obstacles? 4) What do you think of mobile Linux distributions?
- cdesai 5y ago
  > 1) What would you say are your unique differences from LineageOS and GrapheneOS? We do borrow a lot of code from other projects and try to send any fixes / improvements back to them. We try to provide an OS designed to ensure maximum usability and flexibility, so that you have an array of choices available to ensure your privacy and security. For example, I really like the way we have microG available - https://calyxos.org/features/microg/ https://calyxos.org/features/microg/ You can choose to disable it (which still has benefits), keep it enabled, or even login a Google Account. There's even a fourth option where you have it enabled but without the notifications / communication with Google servers, where it's still useful for some app compatibility, and things like location providers and exposure notifications. > 2) What big goals/projects are planned for the future? Our biggest goal has always been expanding the reach of the project. We want to support cheaper phones which are widely available in the world. We also have a bunch of features in the works or planned for the future - Panic trigger improvements, built in ad/tracker block (without losing the ability to use a VPN), and more. Most of it is documented as https://gitlab.com/groups/CalyxOS/-/epics https://gitlab.com/groups/CalyxOS/-/epics > 3) Where do you see Android as a platform in 5 or 10 years? Any predictions or notable obstacles? We will be at S now, which means we'll be at Z in 7 years. What happens then? Kidding aside, I'm always excited by watching the changes Google is doing (some of it is done in the open, through AOSP at https://android-review.googlesource.com/ https://android-review.googlesource.com/ - you see lots of Rust here nowadays, I need to learn that) Fuchsia is also going to be interesting, they must have something planned. > 4) What do you think of mobile Linux distributions? I have massive respect for them given the work they're doing. I always see at it this way - we're working on Android, and especially on the Pixels - all the hardware is there working for us, so we can focus our efforts on improvements in other areas. Linux on mobile has to spend a lot of time catching up to just the basics (getting phone calls working for example). There are pros and cons to both, it entirely depends on your use case to see what fits.

seaghost 5y ago

Nice, but still very Google dependant for security and OS updates.

Koshkin 5y ago
Which, looks like, defeats the whole purpose. (It's almost like if ReactOS or WINE allowed Microsoft Windows updates.)
- cdesai 5y ago
  I'd argue that it's more akin to Ubuntu relying on Debian for updates, or Microsoft's Edge / Brave Browser / one of the many other forks relying on Google for Chromium / Blink updates. The one distinction is in addition to the open source code comparison here, we also use some proprietary bits from their updates, which are needed to get the phone booting and basic hardware working.

gautamcgoel 5y ago

Can you run this on the desktop?

commoner 5y ago
The CalyxOS website publishes emulator images, if you would like to test the OS in Android Studio: https://calyxos.org/news/2021/05/27/emulator-images/ https://calyxos.org/news/2021/05/27/emulator-images/

somenewaccount1 5y ago

F-Droid is for distributing viruses. There may be legit apps on there, but there are also tons of virus's and not enough app oversite to be safe. It's doesn't seem like much of a threat because the userbase is so small that not a lot of hackers target it. Once it has 5% of pop though, it would be a meaninful target - particularly since these are rooted phones.

hjek 5y ago
> F-Droid is for distributing viruses. Lol, please point me to one? (Or an article about one?)
juniperplant 5y ago
Your comment seems to imply that the majority of apps on F-droid are malware. I don't think that's the case. Also, F-droid does not require root.
inickt 5y ago
It has been years since I have used Android (and F-Droid), but I always thought F-Droid was pretty heavily curated and had a sane security model [1]. Why do you say it is for distributing viruses? [1] https://f-droid.org/en/docs/Security_Model/ https://f-droid.org/en/docs/Security_Model/

hjek 5y ago

Is there an Android X86 build of this? That would be an awesome laptop OS.

rchaud 5y ago

It's ironic that the only devices this can be installed on are Google phones and one Xiaomi phone.

summm 5y ago
Even with the most secure alternative Android, you always have blobs from the original manufacturer that you have to use for some hardware-related critical functionality. And of course, the baseband that usually has full access to device's memory using DMA. That's where the backdoors go, I'd suspect. In this regard I'd trust Xiaomi way less than Google. However, Google phones have been subpar for a long time. E.g. the storage was too small and non-extendable. Makes sense from a Google point of view, as you're supposed to store everything into their cloud. But not well suitable for offline-first and privacy-first.

vbsteven 5y ago

I’m thinking about buying a degoogled Android phone to replace my iPhone. The main things I want are: * Spotify needs to work over Bluetooth in my car * WhatsApp needs to work (preferably with push notifications) * I need the Fitbit app to work so my watch can show push notifications from my personal apps * a network-based location provider to be consumed by my personal apps (I’m working on a personal data and automation suite that relies on frequent smartphone location updates) Is this something that can be done with CalyxOS on a Pixel? Can other Android flavours like GrapheneOS or LineageOS do this? And aside from Android, how far along are other “mobile linux” smartphones for use as a daily driver with regards to the above points?

corty 5y ago
I don't know about Fitbit stuff, but LineageOS can do everything else you named. Have been using it for years. I guess other alternative Android distributions shouldn't be too different there.
hadrien01 5y ago
For you first two questions: Spotify will work with Bluetooth, and WhatsApp will have eventual notifications (real-time if the app was recently opened, up to seven hours later otherwise, at least on my device)
- cdesai 5y ago
  We're very close to getting the notification issues fixed. We've sent some patches to microG to address them at https://github.com/microg/GmsCore/pull/1483 https://github.com/microg/GmsCore/pull/1483 I'm running it on my device since a few weeks now and it has been quite reliable so far.
  - hadrien01 5y ago
    I don't use microG, the delay is WhatsApp waking itself up
- prox 5y ago

rodolphoarruda 5y ago

Most of the de-Googled or Linux based mobile OSes have their installation restricted to Pixel phones. Why? Is there any option for old Motorola phones?

LukeShu 5y ago
Because those are the phones that are supported in the upstream Android Open Source Project (AOSP), which these OSes are typically based on. Other phones, even ones that to a great job of publishing their sources (like Sony's), have their support living outside of AOSP. And older phones get dropped from AOSP, the original Pixel was dropped in Android 11. So, by only targeting the devices that AOSP supports these OSes can focus on the interesting part of building the OS, rather than getting bogged down with hardware support.
- cdesai 5y ago
  The other aspect to this is that you can install a custom OS on the Pixels and still re-locked the bootloader, which means you get Verified Boot and all the security guarantees that brings. https://source.android.com/security/verifiedboot https://source.android.com/security/verifiedboot
  - LukeShu 5y ago
    You actually couldn't do that with the original Pixel (which until recently, Android 11, these custom derivatives tended to support). You'd get a warning screen every boot about how the OS has been modified.
    - cdesai 5y ago
      You definitely could, we used to support it in a previous iteration. This was also possible on the Nexus devices, although the oldest I've tried it is the Nexus 6P. It just worked slightly differently on those, nowadays you enroll the public key by flashing it to the device, on those (Pixel 1, Nexus) you used to have the public key embedded in the kernel.

Paul_S 5y ago

That is lovely but what use is it of I have to buy a new phone to use it because it doesn't support the phone I have.

cutler 5y ago
Exactly. I want it for my Facebook-infested Samsung Galaxy A20 but I guess I'm out of luck.

dopu 5y ago

It used to be that iOS was the recommended phone OS if you were looking for the best combination of privacy and security. Even Daniel Micay (the lead developer of GrapheneOS) thought so, 2 years ago [0]. But these ROMs are looking much more mature these days. Anyone have thoughts on how CalyxOS and GrapheneOS compare to iOS in the present day? [0]: https://www.reddit.com/r/GrapheneOS/comments/bddq5u/os_security_ios_vs_grapheneos_vs_stock_android/ https://www.reddit.com/r/GrapheneOS/comments/bddq5u/os_secur...

cosmojg 5y ago
To my knowledge, GrapheneOS has become the leader of the mobile security space while CalyxOS remains more-or-less on par with iOS. This all depends on your security model, though. There are tradeoffs everywhere.

amelius 5y ago

Can you run banking apps on this without problems? And can Google block any apps that run on this Android clone?

throwawaycuriou 5y ago

It's not clear from what I have read anywhere on the site if installing CalyxOS is reversible. If you want to get back to Android can you?

cdesai 5y ago
You can easily go back to stock Android, http://calyxos.org/get/back-to-stock http://calyxos.org/get/back-to-stock
- throwawaycuriou 5y ago
  Are there any other repercussions one should consider before giving this a try? Would software that uses DRM such as Netflix be affected?

fithisux 5y ago

Question, is it Raspberry Pi compatible?

bishoprook2 5y ago

So where is my OpenBSD phone?

SavantIdiot 5y ago

Side note: Tor Browser as your primary browser is super painful. Lots of stuff doesn't work, and latency can be in the minutes.

buzzy_hacker 5y ago

Are there any resources summarizing the differences between… - CalyxOS - Purism, Librem - microG - /e/ - LineageOS - LineageOS for microG - GrapheneOS And I’m sure many other Android open source/degooglers?

gnufx 5y ago
Purism's Librem runs GNU/Linux, not Android; microG is a free replacement for Google bits in Android (Google "services", including location services from other sources); LineageOS is a non-privacy focussed, somewhat de-Googled Android; /e/ is a privacy and free software focussed derivative of LineageOS with a larger set of supported hardware; GrapheneOS is a security-focussed (not privacy-focussed) version of Android with rather limited hardware support. It's not clear to me what the fundamental difference is between CalyxOS and /e/ other than hardware support and what's built-in.
- buzzy_hacker 5y ago
  Thank you!
phh 5y ago
It doesn't answer your real question, but still, I'll try to make a summary: All of CalyxOS, LineageOS, LineageOS for microG, GrapheneOS and /e/ are Android distributions (based on the open-source part of Android, with some modifications and additions) Purism (brand name) Librem 5 (model name) is an opensource smartphones that reduces black boxes to closed areas, while on most smartphones black boxes like modem share RAM access, using a brand new GNU/Linux (so not Android) smartphone OS. microG is fundamentally simply an opensource Android app, that replaces some small parts of Google Services (which are very big unauditable closed-source Android apps), so apps requiring Google Services may have a chance to work without Google services. However microG requires a bit more permissions than a standard app, that's why there needs to be a "LineageOS for miroG" to support microG. Now, between CalyxOS, /e/, LineageOS, and GrapheneOS: - LineageOS targets devices support. LineageOS supports many devices officially, and provides infrastructure to support many more unofficially. They also include many features, but it doesn't feel like they have a specific orientation, and they are happy to integrate with Google apps. They are the very core of Android community original development. - GrapheneOS is security first and foremost, no matter the cost to usability (their philosophy there does seem to evolve to open to more users recently). They do (great) security original development. - /e/ is market first. They focus on having the best experience to the user, and try to reach as many users as possible. They have very little original development, their value is mostly in communication, and providing a "cloud" account. - CalyxOS is targeting a good private user-experience. This goes both by having good usable defaults, and filling gaps. They have nice original developments in making Google-less more usable.

ranguna 5y ago

How risky is it if I install this on a device that is not on the supported list?

commoner 5y ago
Not recommended. Downloads are tailored to specific device models, and installing an operating system image intended for a different device model would not work and could brick your device. If your device is supported by LineageOS but not CalyxOS, LineageOS for microG is an alternative OS that might work for you: https://lineage.microg.org https://lineage.microg.org
- ranguna 5y ago
  Perfect, thank you very much for all the info !

new_stranger 5y ago

I purchased a Pixel phone to test this stuff on. I installed LineageOS and found I couldn't run some google apps. I reinstalled LineageOS with https://opengapps.org https://opengapps.org added during the install and made the mistake of transferring from my old phone which brought all the google services and everything back to the phone (mostly). I then installed CalyxOS - much easier install process than lineage. Really liked the defaults. Could not get many apps that relied on google play services though. If I didn't need so many Google-tied apps I would pick this as my phone OS for basic stuff like messaging and browsing. Installed LineageOS again, found there were a couple apps I could not get working after all (50 different apps installed). In the end I gave up and re-flashed Google firmware back onto the phone. I spent about 10 hours on all this stuff and simply ran out of time for now. I though I could get away from Google but I didn't realize how much my apps needed Google.

yusi-san 5y ago
You can try lineage with MicroG[0][1], it replaces Google services. If you want stores there is the F-Droid store for FOSS app or Aurora Store if you want casual apps. YouTube can be replaced by NewPipe and these days I'm trying Organic Maps (a layer for OSM with nav and offline maps) to replace Google Maps. [0] : https://microg.org/ https://microg.org/ [1] : https://lineage.microg.org/ https://lineage.microg.org/
- sleavey 5y ago
  Does WhatsApp still work? I care about privacy and degoogling but I'm not yet quite ready to abandon my social network over it. Currently I use lineageos with the micro Google apps bundle which provides the real Play Store services and WhatsApp still works. I'd be happy to use the replacement if that was still the case. EDIT: for clarity, by "micro Google apps bundle" I mean the opengapps [1] micro variant. [1] https://opengapps.org/ https://opengapps.org/
  - rashil2000 5y ago
    I use LineageOS+microG and practically all apps not made by Google (WhatsApp, Spotify, PayTM) work as they should. Even for some Google apps, there are good alternatives like YouTube Vanced etc.

joecool1029 5y ago

> microG replaces some functions of Google Play Services while maintaining much more anonymity and privacy. I've said it before and saying it again on here for those that don't know: microG breaks the security model on android and adds in package signature spoofing. It's the only way to add a fake Google Play Services without needing to pull Google blobs. This is why projects like LineageOS are against using this method, it weakens overall package security. However, it is still possible for the tinfoil hat crew to not use Google play services with OS like LineageOS. This will of course break some functionality (apps will have to poll instead of relying on push) but it will not break the security model. I'd like a different, better set of options to choose from but we don't have it at this time. Most users should probably choose a minimal Google Play distribution if they value things like battery life and working apps while still maintaining protections against spoofed apps.

josh_today 5y ago
Funny that you’re using “tin foil hat crew” the day after Apple announced snooping on everyone’s pictures
- genewitch 5y ago
  Also google has never ever used users' data to turn a buck or anything.
- collsni 5y ago
  Yeah more like a "baseball cap crew" these days.. lol i dont trust corporations.
- atatatat 5y ago
  Especially since tinfoil would be like an antenna. Everyone knows that.
cdesai 5y ago
I've said this in another comment, but I'll duplicate here: The microG creator goes into more detail about signature spoofing at https://github.com/microg/GmsCore/issues/1467#issuecomment-840711695 https://github.com/microg/GmsCore/issues/1467#issuecomment-8... The concerns usually raised against that are due to the "default" patch included in their repository, which has a specific purpose. We don't use that, https://calyxos.org/about/tech/microg/ https://calyxos.org/about/tech/microg/ are the precautions we take to try and prevent "weakening overall package security" In addition, microG is optional and can be disabled on first install, see https://calyxos.org/features/microg/#1-microg-disabled https://calyxos.org/features/microg/#1-microg-disabled

mark_l_watson 5y ago

It is asking a lot, but this would be nice: if the developer organizations behind CalyxOS and GrapheneOS could sell new phones with software installed, sort of like System 76 for Linux laptops.

abawany 5y ago
I believe CalyxOS sells a Pixel 4a preloaded with membership (https://calyxinstitute.org/membership/calyxos https://calyxinstitute.org/membership/calyxos).
- mark_l_watson 5y ago
  Thanks for that.

kristov 5y ago

I have been using LineageOS without google replacement libs for about a year. There is a huge amount of comments here, which is interesting in itself - clearly there is a lot of interest in de-googled Android. I worry about fragmentation, eg: if there are too many options will they get diluted without the larger user base. Many apps won't work without google libs. I would like to think that this puts pressure on app builders to not just blindly require google libs, but the reality is without a significant user base wanting it, the tradeoff will always side with the majority. Interestingly WhatsApp works fine - presumably because using your competitors libs is seen as a no-no. FB are no angels here, but I need WhatsApp for family chats.

hfkfktnekfm 5y ago
WhatsApp still works on a 9 year old Android I still have. Remember that a large part of the world doesn't have fancy phones, and WhatsApp needs to work on all kinds. In fact, it's easier to install WhatsApp with severely limited permissions, while I just couldn't install the supposedly much more private Signal without giving it SMS access.

cyberpanther 5y ago

After using CalyxOS for a while, I came up with a method to use stock android and preserve more of your privacy. https://hackernoon.com/have-your-privacy-cake-on-android-and-eat-it-too-db1f37b5 https://hackernoon.com/have-your-privacy-cake-on-android-and...

strcat 5y ago
You might be interested in the sandboxed Play services compatibility layer being developed by GrapheneOS: https://grapheneos.org/usage#sandboxed-play-services https://grapheneos.org/usage#sandboxed-play-services An early release of this is already available in the Stable/Beta channel releases. Our hope is that more projects take interest and collaborate on making a much more broadly compatible alternative to microG with the same security sacrifices it makes.

temp8964 5y ago

I just transferred from Android to iPhone today. I wouldn't bother to use these alternative Androids, because I don't trust 3rd party app stores. There are banking, authenticator, and other essential apps I will never download from a 3rd party app store.

fragileone 5y ago
Not even an app store that distributes only open-source software (eg F-Droid)? Considering the reputation for scams and malware on 1st party app stores I could never understand this perspective.

toastal 5y ago

Something like this seems a lot easier to set up than the hoops I ran through to get my Xaiomi Redmi K20 Pro running Havoc OS + microG. I wish it were more straightforward to get more device compatibility for builds. With GNU/Linux I pick my CPU architecture and I'm good to go. With a project like this, I, given my Android proficiency, should wait who knows how long to get a compatible build. But why a separate build for every device?

fragileone 5y ago
Previously Android phones were allowed to be released each with modified unique kernels. All new phones which ship with Android 12 however must use the same generic Android Common Kernel, and any device-specific drivers are then attached via kernel modules. So basically from September-ish all future Android phones should be able to boot off the same image, or at least a Generic System Image.

danvittegleo 5y ago

CalyxOS is an awesome project. I have worked with the lead developer a bit over the past few years and it's been such a pleasure. We share some bits of code between our projects here: https://github.com/AOSPAlliance https://github.com/AOSPAlliance. If anyone is interested in building their own custom android OS in the cloud (AWS) with same ability to lock your bootloader like CalyxOS, you can checkout my project I've been maintaining for a few years now called RattlesnakeOS: https://github.com/dan-v/rattlesnakeos-stack https://github.com/dan-v/rattlesnakeos-stack. And if you prefer to not build in the cloud, there is also a really great project called robotnix (https://github.com/danielfullmer/robotnix https://github.com/danielfullmer/robotnix) which provides a way to build many flavors of OS (AOSP, GrapheneOS, LineageOS, etc).

busymom0 5y ago
How expensive is it to build android in the cloud? And how are the build times? Is it possible to do it on a local Mac mini instead or will that take too long to build?
- danvittegleo 5y ago
  With rattlesnakeos-stack, it uses spot instances and defaults to a c5.4xlarge which takes about 7-8 hours to build AOSP and Chromium (for an up to date webview) and equates to about ~$1 a build. I typically build on a c5.24xlarge instance which takes about 2.5 hours and costs about ~$2 per build. Unfortunately both AOSP and Chromium are massive projects that require a ton of computing power to build quickly. It's definitely still possible to do on less powerful machines, but it's just going to take a lot longer to do builds.
  - hayd 5y ago
    Is any of the build cached?
    - danvittegleo 5y ago
      In order to limit costs, everything is pulled from source on each build and there is nothing cached. This strategy takes advantage of the fact that AWS doesn't charge for ingress traffic and unfortunately puts additional load on Google's servers. I've attempted a few different strategies on caching AOSP and Chromium source trees, but since you have to incur the storage costs on an ongoing basis, it's just not very economical.

surajs 5y ago

I am as a rule wary of anyone who decides to offer me "privacy" as a USP of their products, I didn't pick up the phone or laptop to get more privacy, but to share more data. Moreover, the iron law of oligarchy seems to suggest that those who are excessively concerned about my data must need it more.

the_biot 5y ago

The trouble I have with AOSP of all flavors isn't lack of Google Services, it's lack of access to the app store. I can do fine without Google Services, but I occasionally need an app that's just not available on F-Droid, and Google is doing their level best to make it harder to get APKs any other way. You used to be able to download them from the store; no longer possible. They've announced some other package format, support for which I assume won't be released to AOSP. They're locking Android ever closer in to their store, and it makes any alternative Android distribution ever more dependent on Google.

sphinxcdi 5y ago
You can access and download apps from Google Play Store with Aurora Store. https://gitlab.com/AuroraOSS/AuroraStore#aurora-store-a-google-playstore-client https://gitlab.com/AuroraOSS/AuroraStore#aurora-store-a-goog... > Google is doing their level best to make it harder to get APKs any other way. You used to be able to download them from the store; no longer possible. They are making it easier with Android 12 by letting third-party stores do automatic updates without user interaction, not harder. https://developer.android.com/about/versions/12/features#automatic-app-updates https://developer.android.com/about/versions/12/features#aut... It has always been the case that OEMs need to bundle Play Services in the OS and that you need an account to access Google Play. Some OEMs like Samsung and Huawei bundle their own store, "the store" isn't a thing. Raccoon, Yalp Store, Aurora Store, etc. to access Google Play have always existed too. > They've announced some other package format, support for which I assume won't be released to AOSP. It's not a new format, it's open source and Aurora Store and other stuff supports it just fine. It's not locked to Google Play.
- the_biot 5y ago
  I had no idea about Aurora Store, this changes things for me. Thanks!

BorisMelnik 5y ago

very cool project - assuming by de-bloating all this google-ware the battery performance might be better?

thoughty 5y ago

Anyone know if they ship the phone to india?

ForHackernews 5y ago

How does CalyxOX compare to /e/ https://e.foundation/ https://e.foundation/ ? I've been really happy with /e/ in daily usage but I'm curious to see what other projects are out there.

commoner 5y ago
phh compared a bunch of Android distros here: https://news.ycombinator.com/item?id=28093473 https://news.ycombinator.com/item?id=28093473 Comparing just CalyxOS to /e/, both include microG as a substitute for Google Play Services. That's the main feature they have in common. Some of their differences: - CalyxOS's upstream is AOSP, while /e/'s upstream is LineageOS. - CalyxOS is intended to be used with a locked bootloader, while /e/ is mostly intended to be used with an unlocked bootloader. (As an exception, /e/ supports a locked bootloader for the Fairphone 3, but I'm not sure if there are any other models that work the same way. /e/ install instructions for Fairphone 3: https://doc.e.foundation/devices/FP3/install https://doc.e.foundation/devices/FP3/install) - CalyxOS supports a few devices, since the project only considers devices that support relocking the bootloader with a custom key and have a monthly security update schedule from the manufacturer. /e/ supports a much larger number of devices. - /e/ integrates its optional open source cloud service, ecloud, which includes email, calendar, contact, photo, and file hosting. CalyxOS does not offer an equivalent first-party service.

uhtred 5y ago

Surprised not many people talking about /e/ https://e.foundation/e-os/ https://e.foundation/e-os/

einpoklum 5y ago

Is there some crowdfunding initiative to get this working on additional phones? I would contribute to get this working on more Xiaomi phones for example.

majka72 5y ago

having to buy a pixel phone for this is too expensive for the 2,5 world countries folks anyway. Unfortunately, it won't become popular if brands like xiaomi don't work with this kind of software, and I know there are many reasons why it will never happen.

niutech 5y ago

Similar projects: https://e.foundation/ https://e.foundation/ and https://replicant.us/ https://replicant.us/