3 ms·

Lineage is as much standard android experience as you can get after market without any gaming/styling mods. If google was series about AOSP and sustainability t

by riedel 3y ago

Lineage is as much standard android experience as you can get after market without any gaming/styling mods. If google was series about AOSP and sustainability they should embrace lineage and at least give a non-rooted lineage with a relocked bootloader on pixel phones a safety-net pass. Lineage has been very careful to not piss off google by not including microg or alternative webview signatures or means to circumvent device attestation. This love is not returned. If supported it would be a way also for other manufacturers to give their devices extended lifetime support (and allow bootloader relocking with lineage). Without safety net, people cannot use it for e.g. banking if they do not want to get into the cat and mouse game of magisk or trust shady indian enthusiast custom builds (like me because I am currently lazy/busy). (I am writing this on a Redmi note 10 with lineage 21)

Erratic6576 3y ago
it’s disappointing that people have to go such lengths in order to have a mobile device that is not conspiring against their wallet or ballot
encom 3y ago
I never understood the banking app thing. I can use my banks website to manage my finances, using my built-from-source Gentoo Linux computer. Why must a phone then be totally locked down?
- i5-2520M 3y ago
  Bank would probably prefer if they could lock that websi5e down as well.
  - wkat4242 3y ago
    Banks are all form over function. I came to my bank to discuss a mortgage and I saw them log into their environment. A nice Windows environment with bright blue title bars and big red X buttons. In other words, Windows XP for which even the long term extended support has long since passed.
    - peepee1982 3y ago
      Did you mean the other way around?
  - xnx 3y ago
    They've tried: https://en.wikipedia.org/wiki/Web_Environment_Integrity https://en.wikipedia.org/wiki/Web_Environment_Integrity
- bakugo 3y ago
  > I can use my banks website to manage my finances, using my built-from-source Gentoo Linux computer. Only because hardware attestation is not yet a thing on desktop browsers. Google and Microsoft are working hard to change that, though.
- technothrasher 3y ago
  I recently gave up with the cat and mouse game trying to keep my banking apps working and defected to an iPhone. If I'm going to be locked down, Apple does it better. Sorry, Google, your main advantage to me over Apple was flexibility. Of course, now I have to deal with the completely locked down App Store, which is a diseased pit of useless subscription and ad riddled apps. I do miss f-droid. Why is my only real choice between two platforms that are actively antagonistic toward me?
- squarefoot 3y ago
  Because it's too late to lock down computers, but that's the trend with every newer platform such as phones, tablets, TVs, cars, etc.
- Gabrys1 3y ago
  You might be interested in this https://www.nytimes.com/2022/07/08/business/korea-internet-explorer.html https://www.nytimes.com/2022/07/08/business/korea-internet-e...
adithyassekhar 3y ago
I don't think Lineage want to work for a device manufacturer, that's how it got formed in the first place.
notpushkin 3y ago
DivestOS is a slightly modified Lineage version that officially supports relocking on some phones (in contrast with Lineage, which I think can be relocked but explicitly tells users not to do that). It also has sandboxed implementations of both official Google services — ported from Graphene, I think – and microG. I'm using it with microG, bootloader relocked, and it seems to pass SafetyNet this way – at least the apps that didn't work on Lineage seem to work here. (I haven't yet tried Google Pay, though – I think it will require proper GApps.) https://divestos.org/ https://divestos.org/ Edit: by the way, banks requiring hardware attestation is probably a U.S. thing – in the EU and ex-USSR countries banks seem to not care about that at all (although some don't like it when you root your phone).
- wkat4242 3y ago
  Yeah US companies are weirdly strict on this. The McDonalds app won't even work if installed through the Aurora store, it has a custom screen that says it won't work if it wasn't installed through the play store :D Ridiculous. It doesn't even handle payments here in Europe, you still have to pay at the kiosk.
  - notpushkin 3y ago
    Oh yeah you're right! McDonalds and Revolut are the only two apps that don't work on my phone no matter what I try. (Those and the phone-as-a-card-terminal apps, but that's totally reasonable.)
- chenxiaolong 3y ago
  > but explicitly tells users not to do that They set the vbmeta header flags field to 0x3, which effectively turns off all of AVB (Android Verified Boot). I'm guessing they do this because they want to allow the system partition to be writable (eg. for folks who flash additional things on top of LineageOS). With unmodified LineageOS, if you configured the bootloader to use LineageOS' public key and relocked it, there would be no security benefit. To enable AVB's signature checks, the flags field needs to be set to 0, which requires re-signing LineageOS with your own key.
wkat4242 3y ago
> Lineage has been very careful to not piss off google by not including microg or alternative webview signatures or means to circumvent device attestation. This love is not returned. I wish they weren't so pedantic about that. At the moment if you even mention microg in the lineage channel you get insta-banned. As you say their hard stance is not doing them any good with Google anyway, they're ignored either way. And MicroG is a really good solution which can replace google services like cell-based location with much more privacy-sensitive alternatives. They even implemented the corona bluetooth protocol during the pandemic! The only place it uses google's services is for push notifications, necessary because most app server infrastructure doesn't have the ability to communicate with anything else. But it does so in the most privacy-sensitive way possible. At least the good folks at https://lineage.microg.org/ https://lineage.microg.org/ provide a great fork with microg built in.
- puzzlingcaptcha 3y ago
  Is anyone here daily-driving microg and can share their experiences? https://github.com/microg/GmsCore/wiki/Implementation-Status https://github.com/microg/GmsCore/wiki/Implementation-Status does not exactly inspire confidence.
  - _imnothere 3y ago
    Definitely not everything works with microG, it kinda depends on your daily usage, for me, I have 3 banking apps working by installing additional modules to have the security checks bypassed(FYI, not all these kind of app uses SafetyNet or Play Integrity), but some apps from government doesn't work so I had to give up on those, other than that it's been a pretty nice experience since about 6 years ago.
    - ttarr 3y ago
      Weird! Here in UK, using microG, banking apps for Nationwide, Starling, Revolut, HSBC all work with no issues. Generally, I face no issue using any app. Location services and notification both work reliably.
  - 3y ago

by riedel 3y ago

Erratic6576 3y ago

it’s disappointing that people have to go such lengths in order to have a mobile device that is not conspiring against their wallet or ballot

encom 3y ago

I never understood the banking app thing. I can use my banks website to manage my finances, using my built-from-source Gentoo Linux computer. Why must a phone then be totally locked down?

i5-2520M 3y ago
Bank would probably prefer if they could lock that websi5e down as well.
- wkat4242 3y ago
  Banks are all form over function. I came to my bank to discuss a mortgage and I saw them log into their environment. A nice Windows environment with bright blue title bars and big red X buttons. In other words, Windows XP for which even the long term extended support has long since passed.
  - peepee1982 3y ago
    Did you mean the other way around?
- xnx 3y ago
  They've tried: https://en.wikipedia.org/wiki/Web_Environment_Integrity https://en.wikipedia.org/wiki/Web_Environment_Integrity
bakugo 3y ago
> I can use my banks website to manage my finances, using my built-from-source Gentoo Linux computer. Only because hardware attestation is not yet a thing on desktop browsers. Google and Microsoft are working hard to change that, though.
technothrasher 3y ago
I recently gave up with the cat and mouse game trying to keep my banking apps working and defected to an iPhone. If I'm going to be locked down, Apple does it better. Sorry, Google, your main advantage to me over Apple was flexibility. Of course, now I have to deal with the completely locked down App Store, which is a diseased pit of useless subscription and ad riddled apps. I do miss f-droid. Why is my only real choice between two platforms that are actively antagonistic toward me?
squarefoot 3y ago
Because it's too late to lock down computers, but that's the trend with every newer platform such as phones, tablets, TVs, cars, etc.
Gabrys1 3y ago
You might be interested in this https://www.nytimes.com/2022/07/08/business/korea-internet-explorer.html https://www.nytimes.com/2022/07/08/business/korea-internet-e...

adithyassekhar 3y ago

I don't think Lineage want to work for a device manufacturer, that's how it got formed in the first place.

notpushkin 3y ago

DivestOS is a slightly modified Lineage version that officially supports relocking on some phones (in contrast with Lineage, which I think can be relocked but explicitly tells users not to do that). It also has sandboxed implementations of both official Google services — ported from Graphene, I think – and microG. I'm using it with microG, bootloader relocked, and it seems to pass SafetyNet this way – at least the apps that didn't work on Lineage seem to work here. (I haven't yet tried Google Pay, though – I think it will require proper GApps.) https://divestos.org/ https://divestos.org/ Edit: by the way, banks requiring hardware attestation is probably a U.S. thing – in the EU and ex-USSR countries banks seem to not care about that at all (although some don't like it when you root your phone).

wkat4242 3y ago
Yeah US companies are weirdly strict on this. The McDonalds app won't even work if installed through the Aurora store, it has a custom screen that says it won't work if it wasn't installed through the play store :D Ridiculous. It doesn't even handle payments here in Europe, you still have to pay at the kiosk.
- notpushkin 3y ago
  Oh yeah you're right! McDonalds and Revolut are the only two apps that don't work on my phone no matter what I try. (Those and the phone-as-a-card-terminal apps, but that's totally reasonable.)
chenxiaolong 3y ago
> but explicitly tells users not to do that They set the vbmeta header flags field to 0x3, which effectively turns off all of AVB (Android Verified Boot). I'm guessing they do this because they want to allow the system partition to be writable (eg. for folks who flash additional things on top of LineageOS). With unmodified LineageOS, if you configured the bootloader to use LineageOS' public key and relocked it, there would be no security benefit. To enable AVB's signature checks, the flags field needs to be set to 0, which requires re-signing LineageOS with your own key.

wkat4242 3y ago

> Lineage has been very careful to not piss off google by not including microg or alternative webview signatures or means to circumvent device attestation. This love is not returned. I wish they weren't so pedantic about that. At the moment if you even mention microg in the lineage channel you get insta-banned. As you say their hard stance is not doing them any good with Google anyway, they're ignored either way. And MicroG is a really good solution which can replace google services like cell-based location with much more privacy-sensitive alternatives. They even implemented the corona bluetooth protocol during the pandemic! The only place it uses google's services is for push notifications, necessary because most app server infrastructure doesn't have the ability to communicate with anything else. But it does so in the most privacy-sensitive way possible. At least the good folks at https://lineage.microg.org/ https://lineage.microg.org/ provide a great fork with microg built in.

puzzlingcaptcha 3y ago
Is anyone here daily-driving microg and can share their experiences? https://github.com/microg/GmsCore/wiki/Implementation-Status https://github.com/microg/GmsCore/wiki/Implementation-Status does not exactly inspire confidence.
- _imnothere 3y ago
  Definitely not everything works with microG, it kinda depends on your daily usage, for me, I have 3 banking apps working by installing additional modules to have the security checks bypassed(FYI, not all these kind of app uses SafetyNet or Play Integrity), but some apps from government doesn't work so I had to give up on those, other than that it's been a pretty nice experience since about 6 years ago.
  - ttarr 3y ago
    Weird! Here in UK, using microG, banking apps for Nationwide, Starling, Revolut, HSBC all work with no issues. Generally, I face no issue using any app. Location services and notification both work reliably.
- 3y ago