5 ms·

I'm using microg's lineage, and something I was wondering when choosing a rom was, how secure are all those roms in terms of supply chain/developpers. There are

I'm using microg's lineage, and something I was wondering when choosing a rom was, how secure are all those roms in terms of supply chain/developpers. There are many, with no big reassuring name behind, and it's hard to trust that what looks like a random rom from the internet is not just a full trojan horse. It would be nice to have just the one or two options, with app store and some kind of official entities backing (say, states, or universities, or distros).

geraldhh 3y ago
afaik microg is developed by a german guy with a grant from the goverment. can't get more legit than that in the android ecosystem :D
- commoner 3y ago
  I'm having a great experience using microG, which lets me selectively enable and disable cloud messaging for every app that attempts to use Google Play Services. microG does not implement the ads and tracking (Google Analytics) APIs of Google Play Services. microG also lets me use Mozilla Location Services to replace Google Location Services, which obtains a location much faster than GPS alone. With microG being free and open source, I trust it much more than the proprietary Google Play Services, even with sandboxing applied. It's weird that the article doesn't mention microG even once, since it's what /e/ uses instead of the Google Play Services client.
  - geraldhh 3y ago
    > It's weird that the article doesn't mention microG even once true seems like the whole aftermarket android ecosystem hinges on the functionality of this, mostly unrecognized, component
izacus 3y ago
It's safe to assume that there's very little-to-none supply chain protection. It's mostly all single people or tiny groups of people releasing this.
- notyoutube 3y ago
  Sad to hear. It feels like the EU could fund some entity to manage, develop and distribute such a degoogled android with only a very small fraction of its other spendings, and that would help a lot with reducing google/apple's hold on the european market… A cheap deal.
  - izacus 3y ago
    Android is a Google project through and through, so I'm not sure if basing the result would actually be "reducing google hold on european market". For that you'd have to actually have a product that isn't developed by one of those corps.
    - notyoutube 3y ago
      I mean, it would be a step in a better direction, wouldn't it? One might start with something like aosp/lineage and potentially fork from there if needs be, or ask of companies to support this alternative rom, etc.
    - greentea23 3y ago
      Degoogling is a misnomer imo. It's not about not using anything from Google or Apple at all. They both contribute to Linux, clang/llvm and other core open software tooling after all. It's about not using unaudited closed source code which cannot be proven to be secure or private, as well as getting away from the online services Google/Apple bake into their operating systems that spy on and tell on users as a requirement to boot the device at all. There's also some cool features that are blocked by both. Since AOSP is open source and the API is easy to target by 3rd party app stores, it's perfectly legitimate to use it as a starting point. There may come a day where Google stops releasing it in such a usable way though, and a more complete fork will be necessary to maintain OS sovereignty.
      - flas9sd 3y ago
        > It's about not using unaudited closed source code which cannot be proven to be secure or private [..] Degoogling is not deblobbing and Lineage or /e/ use plenty of closed source software during runtime. The top parent and DivestOS author really is deblobbing* to some degree, but forks of LineageOS that introduce measures of "degoogling" hold onto vendor firmware blobs on androids /vendor partition for functionality. Those aren't known for connecting to the Google hivemind though. * https://github.com/Divested-Mobile/DivestOS-Build/blob/de3ba78/Scripts/Common/Deblob.sh https://github.com/Divested-Mobile/DivestOS-Build/blob/de3ba... My interpretation of the term degoogling fits the second part of your sentence, "getting away from online services": it is user agency in what network connections can occur, so either by default or optionally users can stop any signaling coming from the device they use. They don't have that freedom with the software the device came with.
kaba0 3y ago
GrapheneOS is by far the most secure option. Unfortunately, it’s only for pixels (as the former “director” (in my opinion rightly) claims that there is not much point to “extreme” security if the hardware itself is already vulnerable, and most android phones have very shitty hardware security)
- 4ggr0 3y ago
  > not much point to “extreme” security if the hardware itself is already vulnerable What I don't get about this is that a lot of people who install custom ROMs do so, to ungoogle their devices, and just plainly get rid of Google. So why exactly is Google deemed to be a safe hardware vendor?
  - eptcyka 3y ago
    They have a secure boot chain and they allow users to use their own signing keys. Samsung for instance also has verified boot, but doesn't allow users to use their own keys. Thus, the boot process is as secure using GrapheneOS as it would be using stock Android, but this just isn't the case for any other device manufacturer.
    - 4ggr0 3y ago
      Yeah but that's still SW, if we talk about HW then using Google-HW to get rid of Google seems a bit weird. I know that Google is not manufacturing these parts, but they're probably not open-source either. I don't care that deeply about privacy/security, just being a bit devils-advocat-y.
      - smallerfish 3y ago
        It depends on why you want to de-google. Running Android means that you're plugged into their ad-analytics data collection. Firmware layers are extremely unlikely to be reporting personalized analytics into that engine. On the other hand if you're trying to avoid an oppressive state, you probably want to avoid any potential for a sub-poena to a big corp yielding information on you; in which case considering fully open firmware makes much more sense.
3abiton 3y ago
There are no real answers to this, taking trust out of the equation, the only way to be sure is to inspect the source code and build it yourself. On a side note, it's always possible to hook dns to a remote piehole setup, and monitor connections. Aside from the security issues related to roms, there are still the binary blobs from OEMs.
maratc 3y ago
> It would be nice to have just the one or two options, with app store and some kind of official entities backing I won't doubt that you know that iPhone is a thing.

geraldhh 3y ago

afaik microg is developed by a german guy with a grant from the goverment. can't get more legit than that in the android ecosystem :D

commoner 3y ago
I'm having a great experience using microG, which lets me selectively enable and disable cloud messaging for every app that attempts to use Google Play Services. microG does not implement the ads and tracking (Google Analytics) APIs of Google Play Services. microG also lets me use Mozilla Location Services to replace Google Location Services, which obtains a location much faster than GPS alone. With microG being free and open source, I trust it much more than the proprietary Google Play Services, even with sandboxing applied. It's weird that the article doesn't mention microG even once, since it's what /e/ uses instead of the Google Play Services client.
- geraldhh 3y ago
  > It's weird that the article doesn't mention microG even once true seems like the whole aftermarket android ecosystem hinges on the functionality of this, mostly unrecognized, component

izacus 3y ago

It's safe to assume that there's very little-to-none supply chain protection. It's mostly all single people or tiny groups of people releasing this.

notyoutube 3y ago
Sad to hear. It feels like the EU could fund some entity to manage, develop and distribute such a degoogled android with only a very small fraction of its other spendings, and that would help a lot with reducing google/apple's hold on the european market… A cheap deal.
- izacus 3y ago
  Android is a Google project through and through, so I'm not sure if basing the result would actually be "reducing google hold on european market". For that you'd have to actually have a product that isn't developed by one of those corps.
  - notyoutube 3y ago
    I mean, it would be a step in a better direction, wouldn't it? One might start with something like aosp/lineage and potentially fork from there if needs be, or ask of companies to support this alternative rom, etc.
  - greentea23 3y ago
    Degoogling is a misnomer imo. It's not about not using anything from Google or Apple at all. They both contribute to Linux, clang/llvm and other core open software tooling after all. It's about not using unaudited closed source code which cannot be proven to be secure or private, as well as getting away from the online services Google/Apple bake into their operating systems that spy on and tell on users as a requirement to boot the device at all. There's also some cool features that are blocked by both. Since AOSP is open source and the API is easy to target by 3rd party app stores, it's perfectly legitimate to use it as a starting point. There may come a day where Google stops releasing it in such a usable way though, and a more complete fork will be necessary to maintain OS sovereignty.
    - flas9sd 3y ago
      > It's about not using unaudited closed source code which cannot be proven to be secure or private [..] Degoogling is not deblobbing and Lineage or /e/ use plenty of closed source software during runtime. The top parent and DivestOS author really is deblobbing* to some degree, but forks of LineageOS that introduce measures of "degoogling" hold onto vendor firmware blobs on androids /vendor partition for functionality. Those aren't known for connecting to the Google hivemind though. * https://github.com/Divested-Mobile/DivestOS-Build/blob/de3ba78/Scripts/Common/Deblob.sh https://github.com/Divested-Mobile/DivestOS-Build/blob/de3ba... My interpretation of the term degoogling fits the second part of your sentence, "getting away from online services": it is user agency in what network connections can occur, so either by default or optionally users can stop any signaling coming from the device they use. They don't have that freedom with the software the device came with.

kaba0 3y ago

GrapheneOS is by far the most secure option. Unfortunately, it’s only for pixels (as the former “director” (in my opinion rightly) claims that there is not much point to “extreme” security if the hardware itself is already vulnerable, and most android phones have very shitty hardware security)

4ggr0 3y ago
> not much point to “extreme” security if the hardware itself is already vulnerable What I don't get about this is that a lot of people who install custom ROMs do so, to ungoogle their devices, and just plainly get rid of Google. So why exactly is Google deemed to be a safe hardware vendor?
- eptcyka 3y ago
  They have a secure boot chain and they allow users to use their own signing keys. Samsung for instance also has verified boot, but doesn't allow users to use their own keys. Thus, the boot process is as secure using GrapheneOS as it would be using stock Android, but this just isn't the case for any other device manufacturer.
  - 4ggr0 3y ago
    Yeah but that's still SW, if we talk about HW then using Google-HW to get rid of Google seems a bit weird. I know that Google is not manufacturing these parts, but they're probably not open-source either. I don't care that deeply about privacy/security, just being a bit devils-advocat-y.
    - smallerfish 3y ago
      It depends on why you want to de-google. Running Android means that you're plugged into their ad-analytics data collection. Firmware layers are extremely unlikely to be reporting personalized analytics into that engine. On the other hand if you're trying to avoid an oppressive state, you probably want to avoid any potential for a sub-poena to a big corp yielding information on you; in which case considering fully open firmware makes much more sense.

3abiton 3y ago

There are no real answers to this, taking trust out of the equation, the only way to be sure is to inspect the source code and build it yourself. On a side note, it's always possible to hook dns to a remote piehole setup, and monitor connections. Aside from the security issues related to roms, there are still the binary blobs from OEMs.

maratc 3y ago

> It would be nice to have just the one or two options, with app store and some kind of official entities backing I won't doubt that you know that iPhone is a thing.