boredsquirrel

Also fun how he "funds" Hyprland but then kinda expects the project to not have paid features anymore? That seems predatory

boredsquirrel (he) @slrpnk.net 4d ago

On KDE Plasma you dont need flatseal, the integrated settings are better

boredsquirrel (he) @slrpnk.net 4d ago

Interesting apparently this already works?

There was a 500k€ donation of the sovereign tech agency to Flatpak which includes development of portals for password managers and spelling correction. Lets see how long that takes and then it needs to be adopted by desktops and apps. KDE will be really fast here, but KeepassXC devs are still working on the Qt6 port, so this might take a while.

boredsquirrel (he) @slrpnk.net 4d ago

Yes they are unprivileged, and the gmscompat tool doesnt give them more access that is true. Still it is google software with the intention to control your device and spy on you, while Aurorastore is a slim app that even allows to restrict the apps it tells to Google.

If you're hiding system services in Aurora that you don't want it touching, that makes it even easier to identify you, because Google play doesn't do that.

It is less data. GrapheneOS will have less system apps than stock android so that immediately gives it away.

Asking Google for updates is also different from telling it a complete list of your installed apps. You might simply not try to update these system apps currently.

In the end, it is really good that play services work on GrapheneOS, but they are still more invasive as regular user apps than alternatives.

2

boredsquirrel (he) @slrpnk.net 5d ago

No, Aurorastore is still worlds more private than Google Play, and until now it was really reliable!

It runs as an unprivileged user app and uses randomized accounts. You can add all apps you dont want Google to know of to your blocklist, so the unique fingerprint from your app list is extremely reduced. Google Play doesnt do that. Aurora is WAY better for privacy

For security yeah, you can use google play and add the signatures to VerifiedApps

1

boredsquirrel (he) @slrpnk.net 5d ago

Well yes but nobody forces devs to only upload on Playstore, they simply do because they suck. Even quite a few open source projects!

9

boredsquirrel (he) @slrpnk.net 5d ago

GrapheneOS is the ONLY free android build that has an alternative by installing the playstore...

boredsquirrel (he) @slrpnk.net 5d ago

The title is misleading, GrapheneOS users are the only ones who have an alternative lol

Most other open source Android builds simply rely on Aurorastore and we see how unreliable that is

/e/OS uses some weird shady appstore that contains a lot of playstore malware (literally anything) and is completely intransparent.

Apkmirror and apkpure rely on other people extracting and uploading APKs.

Tips for everyone

Install the following apps:

VerifiedAppsAndroid (Github) also available through their F-Droid repo

This app contains a growing database of signatures so you can verify that APKs you get are legit. Make sure to submit all the playstore apps you rely on, as those are especially affected!

Signature of the app:

    
org.privacyguides.verifiedapps
40:5C:6B:D2:CA:7C:3A:AE:8F:46:3C:6F:8B:55:BC:F0:DD:AC:43:1C:5E:D8:EA:FF:65:D1:06:C9:81:7A:20:7F

Vadhod APK Extractor contains AI code but it is the only updated and well working app I know that can extract split-APKs and regular ones. Also it doesnt need filesystem permissions!

Universal Installer allows you to install split-APK files like you might get from extracting Playstore apps.

It might be a good idea to make an F-Droid repo with essential proprietary apps, as the combination with VerifiedApps allows users to not need to trust the repo but be able to verify the App's origin securely. Android will only allow updates if the signature matches, so you only need to do this once on install.

Note that Obtainium+Apkpure have frequently installed 32bit APKs on recent Android phones that still supported those, which is a security issue. Might not happen if your phone doesnt even support them anymore like recent Pixels do.