> MicroG downloads and runs google code in a privileged context
> many privacy and security issues
> leaking location to apps that dont have the location permission.
Could you share some details on these three points?
> MicroG downloads and runs google code in a privileged context
> many privacy and security issues
> leaking location to apps that dont have the location permission.
Could you share some details on these three points?
I started to try to answer your question, but I found that the GrapheneOS account gave an answer. Here are quotes:
> microG still heavily uses closed source Google services and even downloads executables run with the full privileges of microG. It downloads and runs droidguard with the privileges it has, giving that full access to the privileged access granted to microG.
> microG has repeatedly had vulnerabilities leaking sensitive data to apps including location data. The approach of having an extra service sitting between apps and the OS which handles sensitive data means having to add all the same privacy and security checks as Play services which microG doesn't do in practice and it has caused severe privacy leaks. The main location leakage was eventually fixed but it persisted for years and there are still holes in the location service causing privacy issues.
I also regularly try to explain to people why microG doesn't make sense. It's more of a big picture thing so it's hard to explain briefly. Consider why people would even install microG. It's only helpful for people who have apps that rely on Google Play Services. Those libraries can have fallback implementations and run even without Google Play Services or microG
Sandboxed Google Play is installed as a regular app. It has the same restrictions as other user-installed apps. If apps have Google libraries that don't need Google Play Services or microG are installed with regular apps, they effectively have the same access as Sandboxed Google Play. If those same apps are installed on a device with microG, Google effectively has the same access, big picture.
GrapheneOS's priorities are privacy, security, and app compatibility. There are issues with microG as far as privacy goes, as already noted. It requires privileged permissions to even work properly, and even microG admits that its reimplementations of Google Play Services features are incomplete, so it's worse in terms of app compatibility too.
> It downloads and runs droidguard with the privileges it has, giving that full access to the privileged access granted to microG.
Wow, no kidding! I checked the source code and sure enough, it downloads the DroidGuard APK from Google[0], and loads a class from it[1], (seemingly?) without any kind of sandboxing or separation. I believe I'm safe because I don't have the Play Integrity API enabled, but I really wish the UI was more explicit about this, because the info text only says
> microG GmsCore contains a free implementation of SafetyNet, but the official server requires SafetyNet requests to be signed using the proprietary DroidGuard system.
[0]: https://github.com/microg/GmsCore/blob/32bc8954ff872d0e1a05d...
[1]: https://github.com/microg/GmsCore/blob/32bc8954ff872d0e1a05d...
It runs the Google Play executable code it downloads with the full permissions and privileges available to microG. Since microG is normally integrated with the Location permission along with a bunch of privileged access unavailable to regular apps, that can be accessed by the code it's running. The executable it's downloading is highly obfuscated and regularly changed because it exists to try to detect and defeat tampering via obfuscation and anti-tampering techniques. It heavily uses the privileged access available to it. This is enabled by default on /e/ in addition to the many other Google connections it adds by default both via microG which are not present in AOSP.
They'll just flag you for asking.
Here's the actual response:
https://news.ycombinator.com/item?id=50171175
By "they" I assume you mean GrapheneOS supporters? I can only speak for myself, but I only flag things when they clearly deserve to be flagged. Fair discussions are important. They help us grow as people and even in our case, GrapheneOS, but we encounter a crazy amount of misinformation here. Some members of our team are also targets for endless harassment. It's so unfortunate that people behave that way. There are also clear sockpuppets attacking GrapheneOS while promoting others. There was a brand new account participating in this thread that was clearly doing that.
Misinformation, harassment, and people who are using unfair methods to win arguments and damage the reputation of others is unacceptable. That's the kind of thing that I flag. What other people do with their permissions is up to them, but I would say that I wouldn't condone people flagging just because they disagree. I'd consider flagging genuine questions to be awful behavior as well.
I ask a lot of questions in the GrapheneOS community, I oppose a lot of opinions that are held there, but I have never been "flagged" for questioning or for debating something. The only time somebody is going to be flagged is if they are being outright disrespectful spreading misinformation or just being a general asshole.
In the GrapheneOS community, "being outright disrespectful spreading misinformation" is pretty much anything that brings solid counter-arguments to Daniel Micay's personal points of view. You probably haven't tried debating some advanced security and privacy topics with them.
As a member of the GrapheneOS team, I can say you're very incorrect.
Within the project, there's a lot of discussion and collaboration. Daniel is the most famous of all of us because he started the project, but we all work together and value each other's opinions. You can see the same in the issue tracker and other places as well. All of us, Daniel included, are happy to consider other ideas or approaches.
Instead of making some broad accusation about someone, you should be more specific. I hope that your bitterness isn't because one of us rejected a feature request or explained why our team implemented something in a specific way that you disagree with.
As a community member I can also attest to this. After I gave Other8026 more details about my app and background I shared on the forum, they restored my thread.
As someone outside of GrapheneOS community and preferring an alternative phone to GOS, I do see flagging and downvoting of my posts on HN. I even stated clearly more than once that I am happy about the GOS development but just prefer something else that you can't get from it.
Nevertheless my (and others') comments are often considered as attacks. Examples of flagged comments:
https://news.ycombinator.com/item?id=49565142
https://news.ycombinator.com/item?id=49542065
https://news.ycombinator.com/item?id=49536149
Other people have noticed that GOS community attacks almost every other alternative, instead of joining forces against Google and co.: https://news.ycombinator.com/item?id=49564756
The GrapheneOS crowd is constantly accusing everyone in attacks and spreading misinformation about their phones (including in this discussion). Simple replies to misunderstandings and links to earlier reply would be much more polite. At the same time, I also see FUD and misinformation about alternative phones from GOS supporters on HN, e.g., https://news.ycombinator.com/item?id=47855369
You do realize that people use the flag feature all the time, right? People have abused the feature to remove our comments in the past too. It's beyond unacceptable to accuse us, without basis, that we're flagging all of your comments.
You are accusing us of "attacking" other groups when we're repeatedly pulled into conversations and we give objective answers and respond to misinformation about GrapheneOS. We have every right to correct misinformation about GrapheneOS. We have every right to defend ourselves against harassment.
Objective facts aren't "attacks." Why are you misrepresenting what we say? Isn't it better if people can make informed decisions?
> It's beyond unacceptable to accuse us, without basis, that we're flagging all of your comments.
You are right that I have no evidence that this group flagged the comments. I just say that I see such pattern in GOS-related discussion. I did not accuse anyone about "all my comments" though. This would indeed be beyond unacceptable.
I am happy to receive objective answers to the misunderstandings. I do have a lot of misunderstandings, too. Replies from the GOS supporters are often helpful. However they often lack some respect to the alternatives. Words like "atrocious security" do not bring us closer.
You very actively seek out discussions about GrapheneOS where you make inaccurate claims about both GrapheneOS and our team. You frequently use it as an opportunity to heavily promote products which are the direct opposite of privacy and security hardened devices. Those products are heavily promoted by those companies with false marketing and misinformation.
Immense harm has been caused through the misconceptions the companies behind those products have propagated to make money. It harms actual privacy, security and open hardware efforts. We aren't on the same side as those companies and aren't working towards the same things. We aren't going to agree on that unless you eventually end up moving on to promoting different products without those issues.
We're on the same side as several legitimate projects you promote including QubesOS. However, you promote those as part of attacking GrapheneOS and usually group it together with phony privacy products.
This is a false narrative. You're engaging in personal attacks based on fabrications. It's a demonstration of why you would have had moderation intervention in the GrapheneOS community.