Hacker Read top | best | new | newcomments | leaders | about | bookmarklet login

IIRC, it uses microG to emulate some Google services so that you can have push notifications without installing the play store. Otherwise, you have to go without for some things.

Also IIRC, microG requires you to allow signature spoofing, which has always creeped me out a tiny bit. I don't understand android well enough to fully understand the possible risks of that.

Please correct me if I'm mistaken.



view as:

It means a malicious app can pose as a legit app and pass the signature check.

However, it's also necessary for the microG services to pose as the Google services.


When you use the microg lineage build does that only fake the check for microg or does it also allow any other app to?

MicroG claims that it is disabled during normal usage and should pose no security risk.

You can look at the patch that makes it possible, it's not just that they claim this is the case. It is the case.

I agree, I was trying (usuccessfully) not to take a position in the microG - Lineage OS controversy.

Fundamentally the controversy is about what users should be able to do, not whether or not the proposed patches do what they claim. Or if it is, that is a part of that particular discussion that I missed.

I am not well versed in the topic, but as far as I understood Lineage OS has a strong policy not to circumvent security measures in Android.

Liked from microG FAQ

https://review.lineageos.org/c/LineageOS/android_frameworks_...

Apparently one of the given motivation from Lineage OS is that it can break API compatibility, I am definitely far away from my competence so I won't try to summarize more.


I think the reason is because LineageOS is listed as an approved Google ROM which passes the safetynet tests that google added to block custom roms. Some apps use safetynet to block users who have higher levels of access to their system. Allowing microg to work would put the google tick of approval at risk.

Well, LineageOS itself doesn't use microG, because the LineageOS developers seem as creeped out by signature spoofing as you. Stock LineageOS just goes without those Google services, so programs that need them won't work. microG make their own fork of LineageOS called LineageOS for microG that comes with signature spoofing enabled and microG installed, but it's a different product and not supported by the LineageOS developers.

The big difference is that they are creeped out by it while understanding exactly what it is for. They willfully limited user freedom (especially as it applies to being free of google) in their base distribution for reasons that don't make sense.

Legal | privacy