• 7 Posts
  • 383 Comments
Joined 2 years ago
cake
Cake day: June 11th, 2023

help-circle


  • It’s a difference in vision, but I don’t like BlueSky’s vision here.

    Combining the Reddit-like and Twitter-like experiences in one place is a little awkward, but following a blog or a Youtube-like from a Twitter-like isn’t. Having the option to switch to a more optimal appview is great, but realistically a lot more people would follow a blog from BlueSky than would use their BlueSky identity to sign into WhiteWind.







  • I assume for bribes of some sort from Google

    This one is stick, not carrot: apps are generally required to use Google’s notification system to be allowed in the Play Store.

    Signal gets notifications without GMS. I think battery use and latency are a little higher. Molly, a fork can use UnifiedPush for better results.









  • Getting around Google’s attestation with an unlocked bootloader requires root - I believe the go-to is Magisk and the Play Integrity Fix module. It’s also a good idea to put the apps in question on the Magisk denylist. I’ve been using this for years with good results and would not describe it as “a lot of things”.

    Is that from installing an app or from install a malicious ROM?

    A malicious app could modify the OS, but it would need root permissions. There are three ways that can happen:

    • The app exploits a privilege escalation bug in the OS. This can happen even if you don’t have root access yourself.
    • The app exploits a bug in a superuser permission manager (e.g. Magisk) to gain root privileges without prompting you.
    • A previously legitimate app you’ve given root privileges to gets a malicious update (a supply chain attack).

    A malicious ROM is certainly possible. Some random person’s LineageOS fork is slightly less trustworthy than its maintainer (due to supply chain attacks).


  • Privacy isn’t binary.

    LineageOS without Gapps won’t send information to Google unless you install something that does. It won’t do a whole lot to prevent apps from collecting data like GrapheneOS does so it’s up to you to evaluate the privacy implications of anything you install.

    A locked bootloader protects against two attack vectors: malware modifying the operating system at runtime, and an unauthorized person with physical access installing a malicious operating system while you’re not looking (an “evil maid” attack). The former is rare on Android. The latter is rare unless you’re a high-value target or dating an abusive hacker.