Yea, SMS and phone apps are quite numerous. I don't think it's a problem, the subsystems all the apps use is open enough and not hard to build against.
Except for RCS, that's completely locked down and is pretty solidly becoming literally just Google. Fuck RCS.
Not just Google is the problem, the entire industry is the problem. Almost all of the cell-based standards are locked away and purely depend on the operators, major infrastructure companies like Motorola, Ericsson and Huawei and modem implementors like Qualcomm, Apple or Broadcom.
Implementing them independently is extremely difficult and even if you manage to do it you cannot have them commercially available due to radio regulation and patents. Even academic research can only be done with collaboration of those huge companies.
It is impossible to make a phone that is LTE capable completely independently (or even without nation state support). You cannot implement VoLTE or RCS without support from the carriers. They all have their own proprietary protocol on top of the standards.
Google has basically infinite money and their own patents and industry relationships and government support so they can figure out RCS. An indie company, even with infinitely motivated engineers and good funding do not have any of it.
Got to say, I like the current Android versions.
In the early days I flashed my Motorola Defy every second month with some cool new ROM.
Always rooted and Xposed, always enabling something new.
Now I run a S23 Ultra and after two years it still does everything I need.
OneUI 8.0 and Android 16.
For work (app de) I also have a Pixel 7a, always with the newest Android Beta.
Also works well.
Even the entry level phones work OK to pretty good now.
My Samsung A16 5G (also for work) functions surprisingly well for 150€.
> Now I run a S23 Ultra and after two years it still does everything I need.
Maybe, but it is fully under Google and Samsung's control, and is choke full of spyware. You couldn't pay me to use a stock (Googled) Android phone for this reason alone.
How well is rooting supported on these newer Android versions/devices? If I install LineageOS on my device, for example, I can be reasonably sure that Magisk will work fine. But how well does it work on a stock, locked-down ROM?
Back when I used Android phones, tweaking was pretty important to me too. I still remember when I installed CyanogenMod on a Motorola XT1565, those were the days... Eventually, LineageOS, and then some new phones happened, not all of which were rootable, though I eventually ended up with a OnePlus 7 Pro which was pretty tweakable and even opened the possibility of bootloader re-locking, until a TWRP bug wiped my device and I pretty much stopped tweaking. Was never quite able to get EdXposed working right again...
This is them trying to strangle Graphene and LineageOs. We desperately need an ecosystem where manufacturers are legally compelled to publish the source code for their drivers and similar so as to make it easier for alternative Oses to exist.
Android will soon become fully closed source. The writing is on the wall.
Plenty of drivers are proprietary. There are many ways of doing so, like much of it can exist in userspace, or in firmware, or using a shim in the kernel.
I think believing any for-profit business would have any morality is the problem. Especially thanks to the post-80s business conjuncture upheld by the relatively democratic governments. It is all about diminishing responsibilities while increasing profits.
Na, it’s the people. Money attracts people who want money. It’s very hard to argue consistently for quality and ethics against these guys without something slipping through, and once that happens it’s impossible to argue to the business that they should forego a revenue source for ethics reasons. They only have to be convincing once, good engineers have to be convincing every time.
Not sure why people downvoted but this is sort of true
Microsoft was absolutely dominating and buying up everything (similar to today's tech giants) and they were literally the most mega corporation ever
Until they got hit by the monopoly lawsuit. That alone scared microsoft so much that it backed off
After the backing off is when Companies like google, heck Apple was directly invested to be saved by microsoft just so that they dont get threatened by the govt as monopoly and amazon.
In a way people mention so why couldn't Microsoft create their own engine but its also the fact that blink/chromium is based on fork of webkit which itself is a fork of KHTML from the kde team but webkit added many features (from what I could tell) and is a really complex software in it of itself
This was created by apple and apple as we know it would not have been able to exist without Microsoft backing off them
My point here is that in previous times, Microsoft was a large curtain blocking any innovation if they wanted but after it was feared by even a threat like monopoly, they took it very seriously and thus we have the cultural innovation in many ways that we have
Now the monopoly question was a genuine question still launched by the government.
Today the landscape is different, Google and these large tech companies would buy things and the meta strategy has become to sell, its a very cynical point of things which really just ends up screwing the customers in the end.
The government doesn't care, it might slap some 1% fine and there is a quote that if crime's punishment becomes only fines, then crime becomes legal and the fines compared to company are so small and they got legal structure so high that they strech it for as much as possible
Overall, the govt.'s being really lobbied by these tech giants and they stiffle tech innovation in the end
In the end all of them are the same, they all kind of want to be a microsoft pre monopoly era.
Govt's lack of understanding of the matters around the world is the reason why tech feels so intrusive. This has real consequences to you and me, now I don't trust the govt will be able to improve if its gets lobbied or corrupted and that's a seperate matter and might take new laws all around the world to prevent such corruption / lobbying but right now, the other best thing is to showcase support by being the minor fraction of the population who supports/donates to open source / msme businesses
I doubt Microsoft gives a minute's thought to government monopoly concerns. One of their "punishments" after the monopoly lawsuit was to give schools free copies of Microsoft Office products. Teachers and administrators adopted them, forcing parents to also buy copies of Office. Now practically everyone's documents are locked up in Office formats, which Microsoft can change on a whim. Sure, there are products to read Office formats with varying levels of success, but Microsoft has the control and can make everyone jump through hoops whenever they feel like it.
Well yes but I feel like its because the threats of monopolization got less and less due to lobbying efforts but for the time, there are reports where microsoft was scared in the internal emails after what happened.
"Microsoft was more scared of taking over companies that were competitors because of this anti trust trial. They had to back off a little and this created this tiny little gap, this little window from which many flowers can bloom. These flowers ended up growing into massive trillion dollars competitors (google and apple)"
I would consider that much of what I wrote in the previous comment was I think something I had thought about but this particular video definitely helped me and you could say did influence me in a way to write the comment.
It also mentions how it was provable that Microsoft was scared about it. I am not sure about this contradiction though but I would consider that it atleast created a gap for around 10-18 years from which the tech giants emerged.
I can't help to worry, in all seriousness, that these changes are aligned somehow to the current administrations more authoritarian temperament. Can anyone relieve me of my concerns here?
Is there any good faith read of this that people can lend credence to? The one I could maybe come up with (with their mention of stability) is "we want OSes derived from AOSP to be stable, instead of following main too closely". They mention third party devs working off of stable too... so maybe they're like "instead of dealing with outside contributors messing around with our 'wip' stuff, we'll sign up for integration work".
Almost all device run on the initial android release (QPR0), and never shipped any of quarterly updates. Even less so using _main_ as a baseline so that point is moot.
With android 16 introducing "mid releases" (QPR2), they expect OEMs to start shipping those as well, QCOM already has a QPR2 BSP release, and Samsung is expected to release QPR2 based builds soon.
As far as contributions go, google usually wanted patches to apply to main, I don't think that ever changed.
And even there now that AOSP development is fully closed, it's even easier as partners will likely just upload patches against internal main instead. Less integration work there as well.
There really isn't a good explanation as to why they want to do move code drop cadence, other than they can and want to avoid wasting time releasing QPR1/3 that no OEM ever shipped (expect Pixels that is)
So the source code will be released in a kind of FreeBSD releases? These pieces work together, base things off them, don't mess with (or even see) any WIP stuff.
In other words, the result is still open, but the development process is not.
I don't work on Android, but I suspect it's a whole lot less work for both confidentiality and maintenance to not have to worry about daily/weekly OSS releases. That's probably worth more to the decisionmakers than the value of random contributions from people who aren't already inside the partner tent.
[edit] based on the other comments, I surmise that public pushes were already infrequent.
Android's foundation has been mostly stable for years now, with fairly minor changes between releases. So I guess they just don't want to deal with too many versions to document and support, given that device vendors are generally awful.
Also for a long time they were doing yearly (or longer) release, afaiu it's only the past two years that they switched to quarterly (with the QPR release).
Sure. Development at Google is glacially slow because nobody does any work, and so they're only publishing releases bi-annually because there aren't enough substantive changes to make quarterly releases seem important. This will also allow the teams to move to biannual OKRs instead of quarterly, which lets ICs and line managers do half as much work while giving executives justification for why they need twice as much headcount.
When it comes to large bureaucracies, always assume laziness over malice or strategic competence.
Every time Android gets worse and less open, especially with recent ID verification for APK installs, I think Canonical's 2013 comment on closing Bug #1 ages even more like milk: https://bugs.launchpad.net/ubuntu/+bug/1
Bug: Microsoft has a majority market share
Almost always, a majority of PCs for sale have Microsoft Windows pre-installed. In the rare cases that they come with a GNU/Linux operating system or no operating system at all, the drivers and BIOS may be proprietary. [...] A majority of the PCs for sale should include only free software.
Closing comment:
Android may not be my or your first choice of Linux, but it is without doubt an open source platform that offers both practical and economic benefits to users and industry. So we have both competition, and good representation for open source, in personal computing.
Even though we have only played a small part in that shift, I think it's important for us to recognize that the shift has taken place. So from Ubuntu's perspective, this bug is now closed.
Every attempt since OpenMoko proves the market doesn't care.
And in what concerns the mainstream desktop/laptop market, macOS Linux VMs, WSL, ChromeOS, versus GNU/Linux OEM devices, proves most people doesn't care either what they can get at regular computer stores, otherwise GNU/Linux configurations would not be online only at very specific shops.
Mobile is a massive chicken-and-egg problem. The main purpose of a smartphone these days is to run apps. Nobody is going to buy a smartphone which can't run the apps they need in their day-to-day life. On the other hand, no company is going to write apps for a platform with basically zero users.
OpenMoko & friends are selling devices which basically only run Firefox, and sometimes make calls as well. The only people interested in that are diehard FLOSS enthusiasts, which means they have to use ancient hardware because new stuff doesn't have open drivers, which means that even if you ignore the app ecosystem they compare incredibly poorly to mainstream smartphones. No wonder they keep failing.
Interestingly, the desktop/laptop market is heading the other way. The move to cloud SaaS products means a decent number of people now only need a browser. What's keeping a lot of people on Windows is often literally one or two applications. Valve's push for Proton is the perfect example of this: the Steam Deck is providing a huge incentive to fix those last few bugs keeping a game from running on Linux, and with the way Microsoft is screwing up W11 it is now ironically the gamers who are moving to Linux.
What you are seeing in "regular computer stores" is mostly irrelevant. That market is basically dead. Corporate gets its machines directly from Dell/HP/Lenovo, PC enthusiasts mostly get custom builds, and casual people stick with smartphones and tablets. In-store PC sales is now reduced to a university student's Google Docs machine - and Microsoft is doing a pretty good job bribing the manufacturers to push Windows there.
You know, I could do without the telephone and SMS features nowadays. I just need a data SIM. Then the device just needs to run a Linux distro with a mobile UI.
I'm pretty sure my Linux desktop version of Signal runs great on small screens.
What I see is regular people buy their computers at Media Market, Cool Blue, Saturn, Fnac, Public, Dixon, you name it.
Most of them have no clue that something like System 76 or Tuxedo exists in first place.
Likewise on corporate world, I have long moved into Windows/macOS as official desktops for the last decade, GNU/Linux is only available on VM or servers, and usually it is the cloud provider's own distro.
Those customers where IT allowed the use of GNU/Linux desktops, it was with zero support from them, it was up to us to deal ourselves with any issues preventing our work, and to deal with upper management, in case it impacts delivery.
Until SteamDeck gets rid of its dependency on Windows as source, it is pretty much irrelevant. Games developers will keep using their Windows workstations, while a community smaller than Switch, will get those games thanks to Proton.
And it remains to be seen for how long Microsoft will tolerate Steam, or use their weight as OS vendor, and one of the biggest publishers.
> Games developers will keep using their Windows workstations, while a community smaller than Switch, will get those games thanks to Proton.
Mobile GNU/Linux might end up in a similar situation if projects like Waydroid[0] can be well-integrated into the system, or if the mobile hardware becomes powerful enough to run it well.
OpenMoko phones were too underpowered to run Firefox, but they could run a ton of other apps. I was running non-AI automated human language translation on the thing.
> Every attempt since OpenMoko proves the market doesn't care.
It's because people like you are constantly repeating this mantra of security nihilism [0], instead of spreading the word about true alternatives existing today, Librem 5 and Pinephone.
How much does Librem 5 cost? Are they able to deliver reasonably up-to-date set of features that general population care? Can you still buy them? Will they deliver in a reasonable amount of time? Will they be able to stay afloat? Can they make enough money to invest in features? Can they support an ecosystem that not only support FOSS but proprietary software too? Can they make contracts with operators to have earlier access to newer tech? Does the cost reflect the value that the customer gets out of them?
The answer for most of those questions is no for both Librem and Pinephone. You cannot even buy Pinephones anymore. This is not nihilism.
> Are they able to deliver reasonably up-to-date set of features that general population care?
It doesn't matter. We are not on a mainstream website, we're on HN. You and me can use it as a daily driver (I do). Nothing becomes mainstream and usable by public at the launch (except things advertised by the big tech of course).
> This is not nihilism.
Did you read the linked article? It's not about getting to 100% security/freedom without any effort. This is about giving up, as you did.
> How much does Librem 5 cost?
Yes, it's expensive. If you can't buy it, you can help in many other ways, e.g., by spreading the word or contributing to the free software.
It doesn't matter: The phone runs the mainline kernel and not locked down, it will be able to receive all updates even without Purism. You can install any other OS, too.
> Can they make enough money to invest in features?
Seems like no, because virtually nobody knows about them, even on HN. And, again, it doesn't really matter.
> Can they support an ecosystem that not only support FOSS but proprietary software too?
Why?
> Can they make contracts with operators to have earlier access to newer tech?
This is pure nihilism. Only Apple and Google can do that, so we're all doomed, right? However Purism have been trying, not without some progress, https://puri.sm/posts/breaking-ground/
> Does the cost reflect the value that the customer gets out of them?
Which aren't that great user experience for normal users anyway, with the apps and games everyone else on their friends circle is using, or needed for work.
Security not only matters, we are still far away from the same liability as in other industries.
GNU/Linux also had as baseline what other UNIXes were capable of, and even that had to grew for ACLs, NSA's LinuxSE, and containers.
And yeah, you can even buy phones with a non-android linux pre-installed, e.g. from pine64. But they come with all kinds of "for early adopters" warning labels. Deservedly so, in my opinion.
Hope there's a timeline in which banking and corporate apps can run/be enrolled on that. If the current geopolitical mess from the USA isn't a good-enough reason to make it happen, I don't know what is.
Why are all commenters on HN ignoring the only smartphone running an FSF-endorsed [0] operating system, Librem 5, and only list everything else? I just can't get it.
Because it was a kickstarter that was run like a scam, was years late to deliver the first device, the hardware was already not good at the start due picking an automotive SOC, the form factor was bulky, and the software was really buggy.
GrapheneOS is a much more practical open source OS to use Linux on a phone.
GrapheneOS is not solving the actual interesting problem (running on an entirely mainline kernel, just like on x86). It's effectively a hardened variety of LineageOS/AOSP, hence entirely reliant on device-specific downstream kernels/BSPs that will never see a feature update.
BTW, hardware support on postmarketOS "community" class devices has seen some nice improvements as of late. Once these improvements meaningfully stabilize (avoiding the risk of regression/breakage; there's been some of that even in the recent testing for the 2025-12 stable release) it's quite possible that some "community" devices might finally reach "main" class, marking them as OK for daily-driver use. Something to watch for as we approach 2026-06.
Because it's prohibitively expensive for something that isn't guaranteed to be a usable daily-driver for most people. Also IIRC the hardware isn't quite worth the price tag in-and-of-itself.
You can sell the phones alright, and they might even work, but the fact is that participation in society - especially if you live in a city - will be much harder without Android/iOS.
Note, not impossible: You can always carry cash to avoid phone-based bank payments (which would be needed at e.g. my local farmer's market, where nobody has a card payment terminal), some taxi services (Yandex Go for example) provide a web view with some of the features, you can open map services in the browser ...
But for the browser-based cases the experience will be even worse than the standard app experience, and friction is overall much higher.
As a result, only a very small fraction of nerds are committed enough to buy and use these devices. You then have a chicken&egg problem about getting a third option to work.
The only way this has been done semi-successfully in recent years is Huawei's HarmonyOS - and they did it by way of a) already being an absolutely massive phone company, and b) keeping around an expensive Android-compatibility core for many years.
Yes, the chicken and the egg problem. But here is the thing, the more adopters there are the more likely to get support. Not to mention the userbase will be mainly in the EU.
The EU is entirely dependent on US services, which don't much care about a fringe phone OS some fraction of people in the EU use. It's like adding duck/egg, crow/egg and other similar problems into the dependency web, too.
The European Commission, as well as many individual countries, are starting to see that as a problem in need of urgent solving, as they've realized it's strategic suicide for a country to be dependent on the goodwill of the (potentially, now turned likely, and going for almost declared) enemy.
Open Harmony? I can't find what I would call authoritative information on how open it is. There's some hedging language about modules being closed source. But it's unclear if that refers to commercial versions of Harmony OS or Open Harmony, or if Open Harmony is open but somehow crippled.
It’s a circle that needs to be broken. It has multiple parties even without device manufacturers.
Users - there is a broad scope of users. For sustainable eco-system you need also user interest and support of such.
Developers - that sounds funny. I know. But you need enough leverage to get apps or services to be open.
Companies/Software - a modern mobile device takes place in almost any interaction. Commuting, payment, banking, grocery shopping, social messaging, doom scrolling.
Biggest hope for the future is ensuring PWA becomes standardized enough.
That way the OS lock-in could be reduced.
> It’s a circle that needs to be broken. It has multiple parties even without device manufacturers.
Well, you're right, however badly I don't want to admit it. Google broke that cycle once with Android. I'm sure that Apple would have too, even if they were not the first mover. And there's no question that their wealth and influence had a massive role in it - something an open platform cannot match realistically.
But the current situation is simply untenable anymore. I want out, no matter how many others don't care for it. The open platform has to be just functional enough (including app support, even as PWAs), for us to break free from this duopoly. Just like how Linux and BSDs are on desktops. I'm able to do everything on it from work to netbanking. I would hate it really badly if I was forced to use Windows or MacOS these days.
We need a hardware attestation vendor who isn’t also selling ads on the same device. Something like, I dunno, an identity module which you could maybe insert into the phone?
We never had one on desktop; no real issues. Hardware attestation is primarily in the interest of the vendor, not the user. The user relies on chains of trust. This is how the world works.
This is because of legacy. And even now lots of people assemble and build PC.
My worry is one fine day Microsoft, Samsung Apple, and Google (rest of SV Media companies like Netflix etc) will join hands in bringing security and force a ChromeOS or macOS type totally- we decide everything for you.
But that's exactly why I advocate that the hardware attestation module be separate from the computing device - so I can be in control of what and when I attest, not the vendor.
Can you elaborate. Say I buy parts myself and install a fully FOSS OS on my machine. Let's say I want to access my bank, and they demand attestation. You propose I'd buy an off-the-shelf, universal attestation module of my chosing (free market). But how would that work from an implementation standpoint? How would the module help put e.g. my bank at ease?
Those actually exist. Yubikeys, Nitrokeys (complete FOSS FW) or bank-approved code generators (For Germany these exist: https://www.reiner-sct.com/tan-generatoren/) are basically that. They provide independent assessment. So regardless of the OS or the browser both parties can make secure transactions.
Ok, so at this point we’re getting iOS kernel source releases more often than AOSP drops? Maybe they should rename to i Open Source at this point because they seem to be doing a better job than Google at this now.
I wish I could understand why it is so difficult to build an un-googled android image.
One reason, I guess it's not possible because it's a complex OS?
But is the real obstacle being smartphone brands not publishing their hardware drivers?
It is so easy to install linux on a PC, yet I don't see the same happening for android while it's actually running a linux kernel, so it really begs the question.
It comes with optional sandboxed Google Play Services and Store, meaning that these run just like any other app, with no special permissions. You can give them only Network access. The Play Store is still the most secure way to download everyday apps, so a lot of GrapheneOS users use Google's Play Store with a burner account in a separate profile, usually the Owner (the main) profile - since you can then disable apps in Owner and install them into other profiles. And the sandboxed google stuff can be used to run proper Google apps without any problem. Even sandboxed Android Auto works.
> I wish I could understand why it is so difficult to build an un-googled android image.
> It is so easy to install linux on a PC, yet I don't see the same happening for android while it's actually running a linux kernel, so it really begs the question.
It's not particularly difficult -- see Graphene and Lineage. The main issue is that there are few phones on which to run these custom builds. Ironically, Google Pixels allow to run other operating systems than the one they come with (the bootloader can be unlocked). Other than the Pixel and a couple of Chinese models, you are looking at low-end or ancient hardware. You can't just build a phone without OS and install Linux/Android like you would on a PC.
> But is the real obstacle being smartphone brands not publishing their hardware drivers?
In part, afaik. On one hand, you have binary blobs that come from Google and you cannot generate yourself. The other part, is that you, as an individual, have no relationships with manufacturers so you have no access to their drivers.
I like the android way of security, where "rooting" your device to install updates is insecure, but using a horrifyingly out-of-date android (because your manufacturer, the only one who can update your device, didn't bother) is secure.
Not to mention, play integrity is being used a some sort of "anti cheats" by bank apps and other essential services. Even some government apps in the EU, essentially forcing you to be spied on by google.
The worse part is that, you can do all of those functionality with a browser on linux (or Android), yet to use them as Android apps on a device without gapps (even if jt's not rooted and with locked bootloader) is not allowed. Make this make sense.
> Even some government apps in the EU, essentially forcing you to be spied on by google.
The same in India. I can't use even the government weather app and the disaster alerts app without signing in to google play.
Seeing that this malpractice (of forcing the users into Google's surveillance net) is widespread among seemingly unrelated agencies like banks and government agencies of several nations, I would really like to know who is peddling this draconian scheme among them.
I want to send some angry rants to the app owners/developers and ask for those malicious peddlers to be permanently banned from further interference in cyber security matters of these institutions.
I would not be surprised if Google is sponsoring a lot of this efffort targeting young devs, and "teaching about security". They basically positioning their services as "authenticators" of truth, despite it 100% being cat and mouse game still.
That really makes sense though if you think about it. When a company has an annual revenue that would put them around the 43rd largest country by GDP, they could very well begin acting more like a state. States spy and states claim to be the arbiters of truth.
Play Integrity and Play Services are two different things.
Play Integrity is a remote attestation scheme by which apps can ask the OS to prove to a remote server that it is unmodified. It allows apps to refuse to run on devices with root or third-party ROMs.
Play Services is a set of libraries and APIs for things like network-based location, push notifications, and advertising. Nearly all Android phones include it, and users of third-party ROMs can add it at install time (but not later) with packages like MindTheGapps. There's an open source substitute called MicroG that allows most apps to run without it.
> Play Integrity and Play Services are two different things.
You're right in your elaboration, but I didn't mention which one it is. My primary concern is that it forces me to log in to my play services account, which I haven't agreed to so far.
> There's an open source substitute called MicroG that allows most apps to run without it.
It's not for the lack of trying and I probably wouldn't even be complaining if it had worked. Phones are getting harder to root these days, much less install a custom ROM. Everyday feels like the ecosystem is tightening around us.
moto g15 in hand, deguggled as much as possible right out of the box, no guggle accounts or big tech apps, bank through a browser, but there is defintly a lot of outright fraud as to bieng able to turn off google apps, it is an arcane procedure to turn off notifications, insisting that nothing will work without "play store" installed, though it is clear that going to a linux phone will become the only way to avoid adversurvielance security and tracking from taking over my device completly.
keep in mind that our techno facist elite did provide the "intel" that led to ICE bieng sent to a particular area code in minaipolis, where they executed a mild mannered chearfull poet, who's last words, somehow knowing, were, "i dont hate you".
"tech" is central to whatever comes next
Get a phone that runs GrapheneOS (second-hand Pixel 7 or 8 will do fine). Run apps that do not require it without Google Play Services and run apps that do require Google Play Services with the sandboxed Google Play Services. That will constrain the data that can be collected a lot.
(Yes, there will still be issues if you use apps that require Google's remote attestation, but at least in Europe, many banks etc. do not require it.)
Yeah India, because a lot of people are having their lives ruined by scammers everyday. Get off your fucking high horse, it literally protects users. Before you start judging, do a simple search. It's not one off cases.
The scamming problem is a fault of the government. It's trivial for a national government to make rules forcing banks to become able to reverse wrongful transactions. That'd stop scammers cold. If your government doesn't do this, and instead transfers the responsibility to the client, it's because the government doesn't care for the people.
Oh Please! Can't protect the users without forcing them to log on to Google and subject themselves to surveillance? That too even for the weather and the emergency alerts? Give me a break! And stop ruining the discussion with your misguided condescension and nationalist rhetoric.
I do not have a smartphone and have had no problem being a customer of multiple top banks. They strongly _encourage_ you to use apps, but if smartphones are against your unspecified religion, alternative paths always appear.
In EU? For internet banking you need a mobile phone or a dedicated hardware token (thing you own), as part of the Strong Customer Authentication (SCA) requirement under the PSD2 regulation: https://ec.europa.eu/newsroom/fisma/items/658958
I know in some countries (UK, Germany, Switzerland, Austria) they're used to hardware tokens already since they were in use long before PSD2. But I seriously, seriously doubt banks in e.g. Poland specifically implement support for hardware tokens issued to very few annoying customers who refuse to use an app but otherwise want internet banking.
Between what the law says and what actually happens there's sometimes a gap.
I'm in the EU and currently I do online banking with 3 banks without using any app, i.e. thru a laptop browser. The 1st literally lets me stay logged in with a simple cookie, with an SMS 2FA requirement every 90 days. The 2nd additionally asks for a PIN to be entered at each session. The 3rd is a neobank and is tougher, requiring a TOTP (which I generate on the same machine, needless to say).
A 4th does require an app, and in fact can hardly even be used with a desktop OS. That bank is Revolut and I therefore don't use it and I recommend others avoid it too.
The reason this happens is because big companies get their software pen tested. Part of the pen test report will include something like “accessible from jailbroken devices.”
The pen test results get put into the ticket system as immovable entries. Engineers will question them, only to be shot down by the cyber security department who organized the pen test. The engineers will eventually accept that they cannot convince cyber to drop the issue, and implement the jail break detection.
Why does cyber mandate it? Because no one in a large company wants to accept the risk, even imaginary risk. They want to be able to say, when security is breached, “we did our due diligence. Look at the report, we implemented everything in it”
Why do firms offering penetration testing keep putting junk like this into their reports? Because their automated tools list them out and they’re getting paid to find issues. The more the better.
The Dutch ID app got rid of all trackers and such requirements last year, but they didn't go the full length and made an F-droid repo (or a government store or sth).
Google actively guiding developers to APIs like the Play Integrity API (which requires not only you register the phone with Google on a Google account, but also an untampered device, outdated or not.
I don't even root my devices, just using something like Lineage already gets you the basic-integrity Max. Not enough for many banking apps.
It's the security of the ecosystem, where the interests of app vendors are fundamental: content distributors can count on enforcing DRM, and banks are relying on the camera used for KYC actually being a camera and not a virtual device.
I think you had the wrong idea on security here, the security is for the device manufacturers benefit to obsolete the hardware and force you to buy a new one not for your benefit. All the data is already being shipped off to where the hell ever for building models of you for advertising and more.
Android does have a meaningfully improved security over typical Linux desktop: the segmentation of data between apps. Imagine what would happen if people run all the proprietary crap they do on a typical Linux box. That's multiple spyware apps with full filesystem access.
Unfortunately, Google also uses it to abuse the user by also segmenting the user's access as well, "protecting" apps from the user, which is an abomination.
Me too. But you have to be a lot more careful about not running proprietary crap on the desktop, which is easier to do than on phone. Ever been forced to install some crap for some event/business/etc?
I have the somewhat controversial opinion that most Android apps are pretty much useless as native and they would be okay as a webapp if it would be more seamless.
The whole security of both Android and iOS is a joke at this point. We know now that plenty of apps/games have proxy services built in, allowing the publisher to monetize their users, by selling proxy services to AI companies. If that can happen, with all the "security" those platforms and store supposedly offer, then I fail to see the point.
We're being prevented from installing and updating software on the devices we own, but Google and Apple will happily approve and sign malware in their stores?
Android devices are enraging. ARM in general, why is there never a boot loader?
I have a little Android handheld game device that will allow me to dual boot a Linux from SD quite easily... but why can't I overwrite the existing install? I thought Android was more open and hackable than that.
I've got an Anbernic RG353M, came with a dual boot as you've described. I completely wiped it and only have ROCKNIX on there, a minimal distro based on LibreELEC, I believe. I actually maintained an Android + ROCKNIX dualboot at first, but it breaks the sleep function for some reason, and the ROCKNIX docs for this device say to remove Android, so eventually I did. I didn't actually use the Android side but had kept it around just in case before.
Not all these devices have the same level of support, so do your research on your model before trying to overwrite the install.
I went with a Retroid after seeing articles about people booting ROCKNIX on it. And one can, from SD. But I did not do enough research to see there was no documentation on writing Linux to the internal storage.
I'm so tired of doing research. I'd just like it to be a functioning BIOS. I at least learned my lesson and have stayed clear of other Android devices.
Those AI translations are really bad these days... In german it says in the subline "Verwenden Sie das Android-Betriebssystem, um Ihr Gerät mit Strom zu versorgen.", that means: Use Android to power your device with electricity.
Please don't show me your crappy translations any more.
I checked and it's indeed the translation Google Translate gives for "Use the Android operating system to power your device."
Gemini 3 Pro offers "Nutzen Sie die Power von Android für Ihr Gerät." as a modern, tech-savvy alternative, as well as more literal translations that correctly recognize the idiom.
Yeah, I, too, was confused by this translation at first glance... That reminded me of when I had to install M$ Office for work. The download button read "Büro herunterladen" (Büro is the exact german translation of Office)
Android started out as an open ecosystem that is slowly being closed. How much funding would it take to re-create a credible open-source ecosystem for phones?
And since Project Treble you wouldn't even get the drivers, because Android Linux is a pseudo-microkernel now, where drivers run in userspace and talk via Android IPC (Binder) with the kernel, enforced since Android 8.
Android is open source partly because they can fund it from Play Store profits. Google is thinking that their Play Store profits are going to be cut, and they want to make the profit up elsewhere - and importantly, maintain control of the platform. This is their method.
They've already used this playbook in the past with Google Play Services, and even before that when they abandoned all the built-in open source apps (Email, Calendar, etc.).
By GPL, they're only obligated to release an offer that allows costumers to request the source code. They can still keep the source "closed" by default.
It has to be the source of the distribution the user currently has a copy of. So they can't just say "sure" and then wait until the next public release. I'm not sure about timeliness, though.
From other discussions, it sounds like they are shipping the copyleft source on time, only the permissive/pushover licensed stuff gets delayed source releases.
redirect your efforts into other areas. I'd love a simpler device like https://www.waveshare.com/esp32-p4-wifi6-touch-lcd-7-8-10.1.... to be well supported with a lightweight friendly OS. This is about as root as you can get for those who want root access. You'll have to put in an effort yourselves or you'll forever be using slop devices and software.
This sounds like defeat - essentially retreating into niches that only a handful of enthusiasts will be using, while leaving the mainstream to Google etc.
why is everyone so negative about anything alternative. it won't succeed and all. how do you know? maybe it's not defeat. maybe you'd be better off without any devices.
Aka "We will do less releases because certain OEMs don't want to be seen as outdated as they don't want to spend the resources to rebase even 4 times per year."
That's not clear to me: Will they do fewer releases, or will they have the same quarterly release cadence as now, just with only every second release open source?
I meant OEMs rushing the gun on new features that aren't fully baked. That probably does add support burden. (I don't know if it happens anymore but it used to be a problem on the OEM forks)
They should at least be shipping monthly updates with the months security updates. Well some months have not had any since Google is now trying to batch them to be quarterly because OEMs couldn't keep up with monthly security fixes.
AOSP has felt different lately, what’s going on? Not much. ~
More like a change of tone.
Quarterly releases given more emphasis. More precise stability language. Rather than feeling like an afterthought, feature flags are now receiving first-class treatment.
My view.
The isolation of platform work is earlier.
Landing flags are occurring more frequently than ever.
By “Stable,” it appears the Intuit team is suggesting “boring” which is deliberate.
I have been using a simple lens.
The surface of the platform is slow and predictable.
A gated and reversible design.
The OEM risk will be pushed later.
I wonder how other people see it.
Is Android giving off more conservative vibes?
Are flags cutting down on breakage, or just relocating it?
Has your testing strategy changed if you’ve shipped against AOSP?
In a practitioner’s take, not in a press narrative.
Android source code will be released twice per year instead of every quarter.
Great. So now nobody gets bugfixes until after the main vendors get priority access to it. for six months.
There's no way this isn't intentional hostility towards forks.
> There's no way this isn't intentional hostility towards forks.
Of course it is. But it isn't new. This was declared in March last year. We discussed it a lot here. It's only now that it's going into effect.
You guys are getting bugfixes?
Ofc to the root kit installed by "them", better battery life and WiFi stability.
/s
The security fixes will be published normally.
Security fixes are hardly the only software problems Android has.
The writing was on the wall the day they shipped Doze with GPS as an OS feature.
All those years back I started calling it, since I built software for (long-lived) HMI devices that ran on Android
We were doomed when they stopped shipping a dialer or SMS app in AOSP.
“Phone by Google” is disgusting.
And then Signal removed SMS support so we're stuck with Gogole's crap.
There are several SMS clients on F-Droid.
Yea, SMS and phone apps are quite numerous. I don't think it's a problem, the subsystems all the apps use is open enough and not hard to build against.
Except for RCS, that's completely locked down and is pretty solidly becoming literally just Google. Fuck RCS.
Not just Google is the problem, the entire industry is the problem. Almost all of the cell-based standards are locked away and purely depend on the operators, major infrastructure companies like Motorola, Ericsson and Huawei and modem implementors like Qualcomm, Apple or Broadcom.
Implementing them independently is extremely difficult and even if you manage to do it you cannot have them commercially available due to radio regulation and patents. Even academic research can only be done with collaboration of those huge companies.
It is impossible to make a phone that is LTE capable completely independently (or even without nation state support). You cannot implement VoLTE or RCS without support from the carriers. They all have their own proprietary protocol on top of the standards.
Google has basically infinite money and their own patents and industry relationships and government support so they can figure out RCS. An indie company, even with infinitely motivated engineers and good funding do not have any of it.
At this rate, given a few more years Google will announce that they're moving to a "once a century" release model for AOSP.
They'll decrease the frequency by a year every year so they never actually release it again
Would it be so bad? The recent Androids have been going downhill. E.g. the mandatory edge-to-edge nonsense.
Got to say, I like the current Android versions. In the early days I flashed my Motorola Defy every second month with some cool new ROM. Always rooted and Xposed, always enabling something new.
Now I run a S23 Ultra and after two years it still does everything I need. OneUI 8.0 and Android 16. For work (app de) I also have a Pixel 7a, always with the newest Android Beta. Also works well.
Even the entry level phones work OK to pretty good now. My Samsung A16 5G (also for work) functions surprisingly well for 150€.
> Now I run a S23 Ultra and after two years it still does everything I need.
Maybe, but it is fully under Google and Samsung's control, and is choke full of spyware. You couldn't pay me to use a stock (Googled) Android phone for this reason alone.
How well is rooting supported on these newer Android versions/devices? If I install LineageOS on my device, for example, I can be reasonably sure that Magisk will work fine. But how well does it work on a stock, locked-down ROM?
Back when I used Android phones, tweaking was pretty important to me too. I still remember when I installed CyanogenMod on a Motorola XT1565, those were the days... Eventually, LineageOS, and then some new phones happened, not all of which were rootable, though I eventually ended up with a OnePlus 7 Pro which was pretty tweakable and even opened the possibility of bootloader re-locking, until a TWRP bug wiped my device and I pretty much stopped tweaking. Was never quite able to get EdXposed working right again...
This is them trying to strangle Graphene and LineageOs. We desperately need an ecosystem where manufacturers are legally compelled to publish the source code for their drivers and similar so as to make it easier for alternative Oses to exist.
Android will soon become fully closed source. The writing is on the wall.
The founder of GrapheneOS commented on this a few days ago here on HN, and basically said it doesn't impact GrapheneOS.
https://news.ycombinator.com/item?id=46550366
No, neither of them register as a blip on the usage stats and both have, and will continue having, priority access through OEM partnerships.
The drivers are legally required to be, well not published, but the source sent to anyone who asks.
Plenty of drivers are proprietary. There are many ways of doing so, like much of it can exist in userspace, or in firmware, or using a shim in the kernel.
Just because it's legally required doesn't mean everyone obeys the law I agree.
We simply can not trust Google. It kind of became the Microsoft of the 1990s now.
Insert: "You were supposed to defeat the Sith, not join them!" meme here...
I think believing any for-profit business would have any morality is the problem. Especially thanks to the post-80s business conjuncture upheld by the relatively democratic governments. It is all about diminishing responsibilities while increasing profits.
Na, it’s the people. Money attracts people who want money. It’s very hard to argue consistently for quality and ethics against these guys without something slipping through, and once that happens it’s impossible to argue to the business that they should forego a revenue source for ethics reasons. They only have to be convincing once, good engineers have to be convincing every time.
To be really honest yeah.
Not sure why people downvoted but this is sort of true
Microsoft was absolutely dominating and buying up everything (similar to today's tech giants) and they were literally the most mega corporation ever
Until they got hit by the monopoly lawsuit. That alone scared microsoft so much that it backed off
After the backing off is when Companies like google, heck Apple was directly invested to be saved by microsoft just so that they dont get threatened by the govt as monopoly and amazon.
In a way people mention so why couldn't Microsoft create their own engine but its also the fact that blink/chromium is based on fork of webkit which itself is a fork of KHTML from the kde team but webkit added many features (from what I could tell) and is a really complex software in it of itself
This was created by apple and apple as we know it would not have been able to exist without Microsoft backing off them
My point here is that in previous times, Microsoft was a large curtain blocking any innovation if they wanted but after it was feared by even a threat like monopoly, they took it very seriously and thus we have the cultural innovation in many ways that we have
Now the monopoly question was a genuine question still launched by the government.
Today the landscape is different, Google and these large tech companies would buy things and the meta strategy has become to sell, its a very cynical point of things which really just ends up screwing the customers in the end.
The government doesn't care, it might slap some 1% fine and there is a quote that if crime's punishment becomes only fines, then crime becomes legal and the fines compared to company are so small and they got legal structure so high that they strech it for as much as possible
Overall, the govt.'s being really lobbied by these tech giants and they stiffle tech innovation in the end
In the end all of them are the same, they all kind of want to be a microsoft pre monopoly era.
Govt's lack of understanding of the matters around the world is the reason why tech feels so intrusive. This has real consequences to you and me, now I don't trust the govt will be able to improve if its gets lobbied or corrupted and that's a seperate matter and might take new laws all around the world to prevent such corruption / lobbying but right now, the other best thing is to showcase support by being the minor fraction of the population who supports/donates to open source / msme businesses
I doubt Microsoft gives a minute's thought to government monopoly concerns. One of their "punishments" after the monopoly lawsuit was to give schools free copies of Microsoft Office products. Teachers and administrators adopted them, forcing parents to also buy copies of Office. Now practically everyone's documents are locked up in Office formats, which Microsoft can change on a whim. Sure, there are products to read Office formats with varying levels of success, but Microsoft has the control and can make everyone jump through hoops whenever they feel like it.
Well yes but I feel like its because the threats of monopolization got less and less due to lobbying efforts but for the time, there are reports where microsoft was scared in the internal emails after what happened.
"Microsoft was more scared of taking over companies that were competitors because of this anti trust trial. They had to back off a little and this created this tiny little gap, this little window from which many flowers can bloom. These flowers ended up growing into massive trillion dollars competitors (google and apple)"
Per Atrioc (https://youtu.be/VS6p5kPeD9I?si=PUT4R5a7Y4kiIvD2&t=692) [Title of the video being the Halo scheme is insane talking about groq's weird acquisition by nvidia]
I would consider that much of what I wrote in the previous comment was I think something I had thought about but this particular video definitely helped me and you could say did influence me in a way to write the comment.
It also mentions how it was provable that Microsoft was scared about it. I am not sure about this contradiction though but I would consider that it atleast created a gap for around 10-18 years from which the tech giants emerged.
I can't help to worry, in all seriousness, that these changes are aligned somehow to the current administrations more authoritarian temperament. Can anyone relieve me of my concerns here?
I feel like that happened when they released chrome.
More like Apple with extra steps and equally less freedom.
Is there any good faith read of this that people can lend credence to? The one I could maybe come up with (with their mention of stability) is "we want OSes derived from AOSP to be stable, instead of following main too closely". They mention third party devs working off of stable too... so maybe they're like "instead of dealing with outside contributors messing around with our 'wip' stuff, we'll sign up for integration work".
Almost all device run on the initial android release (QPR0), and never shipped any of quarterly updates. Even less so using _main_ as a baseline so that point is moot.
With android 16 introducing "mid releases" (QPR2), they expect OEMs to start shipping those as well, QCOM already has a QPR2 BSP release, and Samsung is expected to release QPR2 based builds soon.
As far as contributions go, google usually wanted patches to apply to main, I don't think that ever changed. And even there now that AOSP development is fully closed, it's even easier as partners will likely just upload patches against internal main instead. Less integration work there as well.
There really isn't a good explanation as to why they want to do move code drop cadence, other than they can and want to avoid wasting time releasing QPR1/3 that no OEM ever shipped (expect Pixels that is)
So the source code will be released in a kind of FreeBSD releases? These pieces work together, base things off them, don't mess with (or even see) any WIP stuff.
In other words, the result is still open, but the development process is not.
I don't work on Android, but I suspect it's a whole lot less work for both confidentiality and maintenance to not have to worry about daily/weekly OSS releases. That's probably worth more to the decisionmakers than the value of random contributions from people who aren't already inside the partner tent.
[edit] based on the other comments, I surmise that public pushes were already infrequent.
> the result is still open, but the development process is not.
Is the source code available at all times? This is a genuine question, I don't know right now.
Android's foundation has been mostly stable for years now, with fairly minor changes between releases. So I guess they just don't want to deal with too many versions to document and support, given that device vendors are generally awful.
Also for a long time they were doing yearly (or longer) release, afaiu it's only the past two years that they switched to quarterly (with the QPR release).
Maybe less fragmentation?
Sure. Development at Google is glacially slow because nobody does any work, and so they're only publishing releases bi-annually because there aren't enough substantive changes to make quarterly releases seem important. This will also allow the teams to move to biannual OKRs instead of quarterly, which lets ICs and line managers do half as much work while giving executives justification for why they need twice as much headcount.
When it comes to large bureaucracies, always assume laziness over malice or strategic competence.
Every time Android gets worse and less open, especially with recent ID verification for APK installs, I think Canonical's 2013 comment on closing Bug #1 ages even more like milk: https://bugs.launchpad.net/ubuntu/+bug/1
Closing comment:We need a third alternative, based on freedom with your device. No root access, remote control by apple and google, all wrong.
Every attempt since OpenMoko proves the market doesn't care.
And in what concerns the mainstream desktop/laptop market, macOS Linux VMs, WSL, ChromeOS, versus GNU/Linux OEM devices, proves most people doesn't care either what they can get at regular computer stores, otherwise GNU/Linux configurations would not be online only at very specific shops.
Mobile is a massive chicken-and-egg problem. The main purpose of a smartphone these days is to run apps. Nobody is going to buy a smartphone which can't run the apps they need in their day-to-day life. On the other hand, no company is going to write apps for a platform with basically zero users.
OpenMoko & friends are selling devices which basically only run Firefox, and sometimes make calls as well. The only people interested in that are diehard FLOSS enthusiasts, which means they have to use ancient hardware because new stuff doesn't have open drivers, which means that even if you ignore the app ecosystem they compare incredibly poorly to mainstream smartphones. No wonder they keep failing.
Interestingly, the desktop/laptop market is heading the other way. The move to cloud SaaS products means a decent number of people now only need a browser. What's keeping a lot of people on Windows is often literally one or two applications. Valve's push for Proton is the perfect example of this: the Steam Deck is providing a huge incentive to fix those last few bugs keeping a game from running on Linux, and with the way Microsoft is screwing up W11 it is now ironically the gamers who are moving to Linux.
What you are seeing in "regular computer stores" is mostly irrelevant. That market is basically dead. Corporate gets its machines directly from Dell/HP/Lenovo, PC enthusiasts mostly get custom builds, and casual people stick with smartphones and tablets. In-store PC sales is now reduced to a university student's Google Docs machine - and Microsoft is doing a pretty good job bribing the manufacturers to push Windows there.
You know, I could do without the telephone and SMS features nowadays. I just need a data SIM. Then the device just needs to run a Linux distro with a mobile UI.
I'm pretty sure my Linux desktop version of Signal runs great on small screens.
What I see is regular people buy their computers at Media Market, Cool Blue, Saturn, Fnac, Public, Dixon, you name it.
Most of them have no clue that something like System 76 or Tuxedo exists in first place.
Likewise on corporate world, I have long moved into Windows/macOS as official desktops for the last decade, GNU/Linux is only available on VM or servers, and usually it is the cloud provider's own distro.
Those customers where IT allowed the use of GNU/Linux desktops, it was with zero support from them, it was up to us to deal ourselves with any issues preventing our work, and to deal with upper management, in case it impacts delivery.
Until SteamDeck gets rid of its dependency on Windows as source, it is pretty much irrelevant. Games developers will keep using their Windows workstations, while a community smaller than Switch, will get those games thanks to Proton.
And it remains to be seen for how long Microsoft will tolerate Steam, or use their weight as OS vendor, and one of the biggest publishers.
> Games developers will keep using their Windows workstations, while a community smaller than Switch, will get those games thanks to Proton.
Mobile GNU/Linux might end up in a similar situation if projects like Waydroid[0] can be well-integrated into the system, or if the mobile hardware becomes powerful enough to run it well.
[0]: https://waydro.id
OpenMoko phones were too underpowered to run Firefox, but they could run a ton of other apps. I was running non-AI automated human language translation on the thing.
Aren't people using fewer apps than ever?
At least for mean almost everything has moved into the browser except, Whatsapp, maps, and music
> Every attempt since OpenMoko proves the market doesn't care.
It's because people like you are constantly repeating this mantra of security nihilism [0], instead of spreading the word about true alternatives existing today, Librem 5 and Pinephone.
[0] https://news.ycombinator.com/item?id=27897975
How much does Librem 5 cost? Are they able to deliver reasonably up-to-date set of features that general population care? Can you still buy them? Will they deliver in a reasonable amount of time? Will they be able to stay afloat? Can they make enough money to invest in features? Can they support an ecosystem that not only support FOSS but proprietary software too? Can they make contracts with operators to have earlier access to newer tech? Does the cost reflect the value that the customer gets out of them?
The answer for most of those questions is no for both Librem and Pinephone. You cannot even buy Pinephones anymore. This is not nihilism.
> Are they able to deliver reasonably up-to-date set of features that general population care?
No, they are very much an experiment at the moment.
> Does the cost reflect the value that the customer gets out of them?
Also no, for what they are they are vastly overprices. It makes much more sense to buy an old device that an run Lineage or PMOS.
> You cannot even buy Pinephones anymore
Sure you can. The Pinephone Pro is discontinued, sadly, but regular Pinephones are able to be purchased, I just double checked the PINE64 store:
https://pine64.com/product/pinephone-beta-edition-with-conve...
> Are they able to deliver reasonably up-to-date set of features that general population care?
It doesn't matter. We are not on a mainstream website, we're on HN. You and me can use it as a daily driver (I do). Nothing becomes mainstream and usable by public at the launch (except things advertised by the big tech of course).
> This is not nihilism.
Did you read the linked article? It's not about getting to 100% security/freedom without any effort. This is about giving up, as you did.
> How much does Librem 5 cost?
Yes, it's expensive. If you can't buy it, you can help in many other ways, e.g., by spreading the word or contributing to the free software.
> Can you still buy them?
Yes: https://shop.puri.sm/shop/librem-5/
> Are they able to deliver reasonably up-to-date set of features that general population care?
It doesn't matter. It can provide you with the main features you may need and add something you can't get anywhere else, https://source.puri.sm/Librem5/docs/community-wiki/-/wikis/F....
Further development can deliver most required features to the public, too, https://puri.sm/posts/closing-the-app-gap-momentum-and-time/.
> Will they deliver in a reasonable amount of time?
Yes, 10 working days, according to their website, https://puri.sm/products/librem-5/
> Will they be able to stay afloat?
It doesn't matter: The phone runs the mainline kernel and not locked down, it will be able to receive all updates even without Purism. You can install any other OS, too.
> Can they make enough money to invest in features?
Seems like no, because virtually nobody knows about them, even on HN. And, again, it doesn't really matter.
> Can they support an ecosystem that not only support FOSS but proprietary software too?
Why?
> Can they make contracts with operators to have earlier access to newer tech?
This is pure nihilism. Only Apple and Google can do that, so we're all doomed, right? However Purism have been trying, not without some progress, https://puri.sm/posts/breaking-ground/
> Does the cost reflect the value that the customer gets out of them?
Probably yes, https://source.puri.sm/Librem5/docs/community-wiki/-/wikis/F...
Typed and submitted entirely on my Librem 5.
Which aren't that great user experience for normal users anyway, with the apps and games everyone else on their friends circle is using, or needed for work.
Security not only matters, we are still far away from the same liability as in other industries.
GNU/Linux also had as baseline what other UNIXes were capable of, and even that had to grew for ACLs, NSA's LinuxSE, and containers.
> We need a third alternative, based on freedom with your device. No root access, remote control by apple and google, all wrong.
There is https://postmarketos.org/
Maybe 2026 will be the year of Linux on mobile phone.
The list of devices in the highest support category hints at how likely this is. https://wiki.postmarketos.org/wiki/Devices
And yeah, you can even buy phones with a non-android linux pre-installed, e.g. from pine64. But they come with all kinds of "for early adopters" warning labels. Deservedly so, in my opinion.
https://commerce.jolla.com/products/jolla-phone-preorder
Hope there's a timeline in which banking and corporate apps can run/be enrolled on that. If the current geopolitical mess from the USA isn't a good-enough reason to make it happen, I don't know what is.
Oh thanks for that link, I didn't know about it, pre-ordered!
Why are all commenters on HN ignoring the only smartphone running an FSF-endorsed [0] operating system, Librem 5, and only list everything else? I just can't get it.
[0] https://news.ycombinator.com/item?id=25504641
Because it was a kickstarter that was run like a scam, was years late to deliver the first device, the hardware was already not good at the start due picking an automotive SOC, the form factor was bulky, and the software was really buggy.
GrapheneOS is a much more practical open source OS to use Linux on a phone.
GrapheneOS is not solving the actual interesting problem (running on an entirely mainline kernel, just like on x86). It's effectively a hardened variety of LineageOS/AOSP, hence entirely reliant on device-specific downstream kernels/BSPs that will never see a feature update.
BTW, hardware support on postmarketOS "community" class devices has seen some nice improvements as of late. Once these improvements meaningfully stabilize (avoiding the risk of regression/breakage; there's been some of that even in the recent testing for the 2025-12 stable release) it's quite possible that some "community" devices might finally reach "main" class, marking them as OK for daily-driver use. Something to watch for as we approach 2026-06.
I don't care about the problems they had many years ago. Sent from my daily driver Librem 5.
Because it's prohibitively expensive for something that isn't guaranteed to be a usable daily-driver for most people. Also IIRC the hardware isn't quite worth the price tag in-and-of-itself.
> Maybe 2026 will be the year of Linux on mobile phone.
Considering the ongoing DRAM and SSD crunch, I won't hold my breath.
This could actually be a reason to work on better supporting older "Android" phones in postmarketOS, to keep the hardware people already have working.
Check out Hackberry Pi devices. Then check out how far Plasma Mobile got, it made insane progress over the last years.
I'm currently working on an OS image for the Hackberry devices, maybe it'll get some traction. [1]
[1] https://github.com/rogueberry
[2] https://github.com/ZitaoTech/HackberryPiCM5
There are some, right? I think I lost track a bit, but one is Sailfish OS. I guess it is super hard for alternative devices/OSs to enter the market.
You can sell the phones alright, and they might even work, but the fact is that participation in society - especially if you live in a city - will be much harder without Android/iOS.
Note, not impossible: You can always carry cash to avoid phone-based bank payments (which would be needed at e.g. my local farmer's market, where nobody has a card payment terminal), some taxi services (Yandex Go for example) provide a web view with some of the features, you can open map services in the browser ...
But for the browser-based cases the experience will be even worse than the standard app experience, and friction is overall much higher.
As a result, only a very small fraction of nerds are committed enough to buy and use these devices. You then have a chicken&egg problem about getting a third option to work.
The only way this has been done semi-successfully in recent years is Huawei's HarmonyOS - and they did it by way of a) already being an absolutely massive phone company, and b) keeping around an expensive Android-compatibility core for many years.
Yes, the chicken and the egg problem. But here is the thing, the more adopters there are the more likely to get support. Not to mention the userbase will be mainly in the EU.
The EU is entirely dependent on US services, which don't much care about a fringe phone OS some fraction of people in the EU use. It's like adding duck/egg, crow/egg and other similar problems into the dependency web, too.
The European Commission, as well as many individual countries, are starting to see that as a problem in need of urgent solving, as they've realized it's strategic suicide for a country to be dependent on the goodwill of the (potentially, now turned likely, and going for almost declared) enemy.
Sailfish OS isn't fully FOSS. I believe the UI is still proprietary.
Open Harmony? I can't find what I would call authoritative information on how open it is. There's some hedging language about modules being closed source. But it's unclear if that refers to commercial versions of Harmony OS or Open Harmony, or if Open Harmony is open but somehow crippled.
It’s a circle that needs to be broken. It has multiple parties even without device manufacturers.
Users - there is a broad scope of users. For sustainable eco-system you need also user interest and support of such.
Developers - that sounds funny. I know. But you need enough leverage to get apps or services to be open.
Companies/Software - a modern mobile device takes place in almost any interaction. Commuting, payment, banking, grocery shopping, social messaging, doom scrolling.
Biggest hope for the future is ensuring PWA becomes standardized enough. That way the OS lock-in could be reduced.
> It’s a circle that needs to be broken. It has multiple parties even without device manufacturers.
Well, you're right, however badly I don't want to admit it. Google broke that cycle once with Android. I'm sure that Apple would have too, even if they were not the first mover. And there's no question that their wealth and influence had a massive role in it - something an open platform cannot match realistically.
But the current situation is simply untenable anymore. I want out, no matter how many others don't care for it. The open platform has to be just functional enough (including app support, even as PWAs), for us to break free from this duopoly. Just like how Linux and BSDs are on desktops. I'm able to do everything on it from work to netbanking. I would hate it really badly if I was forced to use Windows or MacOS these days.
We need a hardware attestation vendor who isn’t also selling ads on the same device. Something like, I dunno, an identity module which you could maybe insert into the phone?
> We need a hardware attestation vendor
We never had one on desktop; no real issues. Hardware attestation is primarily in the interest of the vendor, not the user. The user relies on chains of trust. This is how the world works.
This is because of legacy. And even now lots of people assemble and build PC.
My worry is one fine day Microsoft, Samsung Apple, and Google (rest of SV Media companies like Netflix etc) will join hands in bringing security and force a ChromeOS or macOS type totally- we decide everything for you.
But that's exactly why I advocate that the hardware attestation module be separate from the computing device - so I can be in control of what and when I attest, not the vendor.
Can you elaborate. Say I buy parts myself and install a fully FOSS OS on my machine. Let's say I want to access my bank, and they demand attestation. You propose I'd buy an off-the-shelf, universal attestation module of my chosing (free market). But how would that work from an implementation standpoint? How would the module help put e.g. my bank at ease?
Those actually exist. Yubikeys, Nitrokeys (complete FOSS FW) or bank-approved code generators (For Germany these exist: https://www.reiner-sct.com/tan-generatoren/) are basically that. They provide independent assessment. So regardless of the OS or the browser both parties can make secure transactions.
It is Linux, isn't it. Jolla phone, etc...
Ok, so at this point we’re getting iOS kernel source releases more often than AOSP drops? Maybe they should rename to i Open Source at this point because they seem to be doing a better job than Google at this now.
Isn't the kernel tree for AOSP open (so can see changes continuously)?
The development isn't done in the public tree (anymore), you essentially get a git push every 6 months in public.
For the android parts or for the kernel. I was asking specifically about the kernel.
(My impression was based on lwn discussions about that change)
Edit: https://android.googlesource.com/kernel/common/ has a lot of recent changes
Ah, the situation there is a bit more complicated, sorry :)
I wish I could understand why it is so difficult to build an un-googled android image.
One reason, I guess it's not possible because it's a complex OS?
But is the real obstacle being smartphone brands not publishing their hardware drivers?
It is so easy to install linux on a PC, yet I don't see the same happening for android while it's actually running a linux kernel, so it really begs the question.
GrapheneOS does this just fine.
It comes with optional sandboxed Google Play Services and Store, meaning that these run just like any other app, with no special permissions. You can give them only Network access. The Play Store is still the most secure way to download everyday apps, so a lot of GrapheneOS users use Google's Play Store with a burner account in a separate profile, usually the Owner (the main) profile - since you can then disable apps in Owner and install them into other profiles. And the sandboxed google stuff can be used to run proper Google apps without any problem. Even sandboxed Android Auto works.
> I wish I could understand why it is so difficult to build an un-googled android image. > It is so easy to install linux on a PC, yet I don't see the same happening for android while it's actually running a linux kernel, so it really begs the question.
It's not particularly difficult -- see Graphene and Lineage. The main issue is that there are few phones on which to run these custom builds. Ironically, Google Pixels allow to run other operating systems than the one they come with (the bootloader can be unlocked). Other than the Pixel and a couple of Chinese models, you are looking at low-end or ancient hardware. You can't just build a phone without OS and install Linux/Android like you would on a PC.
It's not that difficult, plenty of ROMs exist, and analogues of all the apps exist as well.
> But is the real obstacle being smartphone brands not publishing their hardware drivers? In part, afaik. On one hand, you have binary blobs that come from Google and you cannot generate yourself. The other part, is that you, as an individual, have no relationships with manufacturers so you have no access to their drivers.
I like the android way of security, where "rooting" your device to install updates is insecure, but using a horrifyingly out-of-date android (because your manufacturer, the only one who can update your device, didn't bother) is secure.
It's because "security" is not a user one, but a security of Google Play Services.
As rooting may tamper the google's telemetry (can we already call it "spying" please).
Not to mention, play integrity is being used a some sort of "anti cheats" by bank apps and other essential services. Even some government apps in the EU, essentially forcing you to be spied on by google.
The worse part is that, you can do all of those functionality with a browser on linux (or Android), yet to use them as Android apps on a device without gapps (even if jt's not rooted and with locked bootloader) is not allowed. Make this make sense.
> Even some government apps in the EU, essentially forcing you to be spied on by google.
The same in India. I can't use even the government weather app and the disaster alerts app without signing in to google play.
Seeing that this malpractice (of forcing the users into Google's surveillance net) is widespread among seemingly unrelated agencies like banks and government agencies of several nations, I would really like to know who is peddling this draconian scheme among them.
I want to send some angry rants to the app owners/developers and ask for those malicious peddlers to be permanently banned from further interference in cyber security matters of these institutions.
I would not be surprised if Google is sponsoring a lot of this efffort targeting young devs, and "teaching about security". They basically positioning their services as "authenticators" of truth, despite it 100% being cat and mouse game still.
That really makes sense though if you think about it. When a company has an annual revenue that would put them around the 43rd largest country by GDP, they could very well begin acting more like a state. States spy and states claim to be the arbiters of truth.
Play Integrity and Play Services are two different things.
Play Integrity is a remote attestation scheme by which apps can ask the OS to prove to a remote server that it is unmodified. It allows apps to refuse to run on devices with root or third-party ROMs.
Play Services is a set of libraries and APIs for things like network-based location, push notifications, and advertising. Nearly all Android phones include it, and users of third-party ROMs can add it at install time (but not later) with packages like MindTheGapps. There's an open source substitute called MicroG that allows most apps to run without it.
> Play Integrity and Play Services are two different things.
You're right in your elaboration, but I didn't mention which one it is. My primary concern is that it forces me to log in to my play services account, which I haven't agreed to so far.
> There's an open source substitute called MicroG that allows most apps to run without it.
It's not for the lack of trying and I probably wouldn't even be complaining if it had worked. Phones are getting harder to root these days, much less install a custom ROM. Everyday feels like the ecosystem is tightening around us.
moto g15 in hand, deguggled as much as possible right out of the box, no guggle accounts or big tech apps, bank through a browser, but there is defintly a lot of outright fraud as to bieng able to turn off google apps, it is an arcane procedure to turn off notifications, insisting that nothing will work without "play store" installed, though it is clear that going to a linux phone will become the only way to avoid adversurvielance security and tracking from taking over my device completly. keep in mind that our techno facist elite did provide the "intel" that led to ICE bieng sent to a particular area code in minaipolis, where they executed a mild mannered chearfull poet, who's last words, somehow knowing, were, "i dont hate you". "tech" is central to whatever comes next
https://calebhearth.com/dont-get-distracted
Get a phone that runs GrapheneOS (second-hand Pixel 7 or 8 will do fine). Run apps that do not require it without Google Play Services and run apps that do require Google Play Services with the sandboxed Google Play Services. That will constrain the data that can be collected a lot.
(Yes, there will still be issues if you use apps that require Google's remote attestation, but at least in Europe, many banks etc. do not require it.)
Yeah India, because a lot of people are having their lives ruined by scammers everyday. Get off your fucking high horse, it literally protects users. Before you start judging, do a simple search. It's not one off cases.
The scamming problem is a fault of the government. It's trivial for a national government to make rules forcing banks to become able to reverse wrongful transactions. That'd stop scammers cold. If your government doesn't do this, and instead transfers the responsibility to the client, it's because the government doesn't care for the people.
Oh Please! Can't protect the users without forcing them to log on to Google and subject themselves to surveillance? That too even for the weather and the emergency alerts? Give me a break! And stop ruining the discussion with your misguided condescension and nationalist rhetoric.
> The worse part is that, you can do all of those functionality with a browser on linux
This isn't true, actually. Banks and gov entities use those mobile apps as authenticators. They do have a distinct purpose.
I do not have a smartphone and have had no problem being a customer of multiple top banks. They strongly _encourage_ you to use apps, but if smartphones are against your unspecified religion, alternative paths always appear.
In EU? For internet banking you need a mobile phone or a dedicated hardware token (thing you own), as part of the Strong Customer Authentication (SCA) requirement under the PSD2 regulation: https://ec.europa.eu/newsroom/fisma/items/658958
I know in some countries (UK, Germany, Switzerland, Austria) they're used to hardware tokens already since they were in use long before PSD2. But I seriously, seriously doubt banks in e.g. Poland specifically implement support for hardware tokens issued to very few annoying customers who refuse to use an app but otherwise want internet banking.
Between what the law says and what actually happens there's sometimes a gap.
I'm in the EU and currently I do online banking with 3 banks without using any app, i.e. thru a laptop browser. The 1st literally lets me stay logged in with a simple cookie, with an SMS 2FA requirement every 90 days. The 2nd additionally asks for a PIN to be entered at each session. The 3rd is a neobank and is tougher, requiring a TOTP (which I generate on the same machine, needless to say).
A 4th does require an app, and in fact can hardly even be used with a desktop OS. That bank is Revolut and I therefore don't use it and I recommend others avoid it too.
The reason this happens is because big companies get their software pen tested. Part of the pen test report will include something like “accessible from jailbroken devices.”
The pen test results get put into the ticket system as immovable entries. Engineers will question them, only to be shot down by the cyber security department who organized the pen test. The engineers will eventually accept that they cannot convince cyber to drop the issue, and implement the jail break detection.
Why does cyber mandate it? Because no one in a large company wants to accept the risk, even imaginary risk. They want to be able to say, when security is breached, “we did our due diligence. Look at the report, we implemented everything in it”
Why do firms offering penetration testing keep putting junk like this into their reports? Because their automated tools list them out and they’re getting paid to find issues. The more the better.
It’s insane and entirely about passing off risk.
> Even some government apps in the EU
The Dutch ID app got rid of all trackers and such requirements last year, but they didn't go the full length and made an F-droid repo (or a government store or sth).
Google actively guiding developers to APIs like the Play Integrity API (which requires not only you register the phone with Google on a Google account, but also an untampered device, outdated or not.
I don't even root my devices, just using something like Lineage already gets you the basic-integrity Max. Not enough for many banking apps.
There was a time when we did call it spying. Programs that had what we would now call telemetry used to be called spyware.
The term has fallen by the wayside and hardly ever gets used nowadays.
We just call it "apps" now.
That's a very good observation
It's the security of the ecosystem, where the interests of app vendors are fundamental: content distributors can count on enforcing DRM, and banks are relying on the camera used for KYC actually being a camera and not a virtual device.
It's about keeping google's device secure *from* the user.
Just accept being spied on, it’s not as if there are genocidal billionaires out there.
I think you had the wrong idea on security here, the security is for the device manufacturers benefit to obsolete the hardware and force you to buy a new one not for your benefit. All the data is already being shipped off to where the hell ever for building models of you for advertising and more.
Android does have a meaningfully improved security over typical Linux desktop: the segmentation of data between apps. Imagine what would happen if people run all the proprietary crap they do on a typical Linux box. That's multiple spyware apps with full filesystem access.
Unfortunately, Google also uses it to abuse the user by also segmenting the user's access as well, "protecting" apps from the user, which is an abomination.
We have Flatpak/bubblewrap that can accomplish the same sandboxing on the Linux desktop, with no need for clumsy hacks like app-specific user ID's.
And yet, I keep all my important stuff on my Linux laptop and not on my phone. There's maybe a lesson here that security is also about trust.
Me too. But you have to be a lot more careful about not running proprietary crap on the desktop, which is easier to do than on phone. Ever been forced to install some crap for some event/business/etc?
I have the somewhat controversial opinion that most Android apps are pretty much useless as native and they would be okay as a webapp if it would be more seamless.
Exceptions would maybe be games.
The whole security of both Android and iOS is a joke at this point. We know now that plenty of apps/games have proxy services built in, allowing the publisher to monetize their users, by selling proxy services to AI companies. If that can happen, with all the "security" those platforms and store supposedly offer, then I fail to see the point.
We're being prevented from installing and updating software on the devices we own, but Google and Apple will happily approve and sign malware in their stores?
They’re one in the same. You can’t exploit privilege escalation vulnerabilities unless you are vulnerable to them!
Android devices are enraging. ARM in general, why is there never a boot loader?
I have a little Android handheld game device that will allow me to dual boot a Linux from SD quite easily... but why can't I overwrite the existing install? I thought Android was more open and hackable than that.
Well there is a bootloader - on Qualcomm its even UEFI, but you don't have access to it.
https://worthdoingbadly.com/qcomxbl/
That's somehow worse. Good for them that they made it convenient to launch their software on the device I paid for.
I've got an Anbernic RG353M, came with a dual boot as you've described. I completely wiped it and only have ROCKNIX on there, a minimal distro based on LibreELEC, I believe. I actually maintained an Android + ROCKNIX dualboot at first, but it breaks the sleep function for some reason, and the ROCKNIX docs for this device say to remove Android, so eventually I did. I didn't actually use the Android side but had kept it around just in case before.
Not all these devices have the same level of support, so do your research on your model before trying to overwrite the install.
I went with a Retroid after seeing articles about people booting ROCKNIX on it. And one can, from SD. But I did not do enough research to see there was no documentation on writing Linux to the internal storage.
I'm so tired of doing research. I'd just like it to be a functioning BIOS. I at least learned my lesson and have stayed clear of other Android devices.
Those AI translations are really bad these days... In german it says in the subline "Verwenden Sie das Android-Betriebssystem, um Ihr Gerät mit Strom zu versorgen.", that means: Use Android to power your device with electricity.
Please don't show me your crappy translations any more.
I checked and it's indeed the translation Google Translate gives for "Use the Android operating system to power your device."
Gemini 3 Pro offers "Nutzen Sie die Power von Android für Ihr Gerät." as a modern, tech-savvy alternative, as well as more literal translations that correctly recognize the idiom.
Yeah, I, too, was confused by this translation at first glance... That reminded me of when I had to install M$ Office for work. The download button read "Büro herunterladen" (Büro is the exact german translation of Office)
Android started out as an open ecosystem that is slowly being closed. How much funding would it take to re-create a credible open-source ecosystem for phones?
I thought QPR2 and QPR4 were the only releases anyone cared about regardless.
So here's what I don't get. What's the point of this? Like, what is the downside to Google releasing the source to a version as they ship it?
The only thing left as GPL is the Linux kernel.
And since Project Treble you wouldn't even get the drivers, because Android Linux is a pseudo-microkernel now, where drivers run in userspace and talk via Android IPC (Binder) with the kernel, enforced since Android 8.
This is driven by the EU forcing them to allow alternative payment methods in the Play Store.
They are trying to avoid it, but I doubt the EU will let this stand:
https://www.developer-tech.com/news/google-alters-play-store...
Android is open source partly because they can fund it from Play Store profits. Google is thinking that their Play Store profits are going to be cut, and they want to make the profit up elsewhere - and importantly, maintain control of the platform. This is their method.
They've already used this playbook in the past with Google Play Services, and even before that when they abandoned all the built-in open source apps (Email, Calendar, etc.).
Aren't they legally obligated to release the source code of whatever GPL software they ship? ie the version shipped that is
By GPL, they're only obligated to release an offer that allows costumers to request the source code. They can still keep the source "closed" by default.
No they have to actually fulfill that request too. Once someone has the source they are then free to distribute it.
I don't remember if this is in the original text, but is there a time constraints on distributing the source on request?
If a user asks for the source, and the distributor says "sure" and then delivers it 12 months later, have they violated the license?
It has to be the source of the distribution the user currently has a copy of. So they can't just say "sure" and then wait until the next public release. I'm not sure about timeliness, though.
This is why most of Android outside of linux kernel is not GPL.
From other discussions, it sounds like they are shipping the copyleft source on time, only the permissive/pushover licensed stuff gets delayed source releases.
I think eventually we will get to ... Ah this is too hard to open source at all... Come at us with GPL requests..
redirect your efforts into other areas. I'd love a simpler device like https://www.waveshare.com/esp32-p4-wifi6-touch-lcd-7-8-10.1.... to be well supported with a lightweight friendly OS. This is about as root as you can get for those who want root access. You'll have to put in an effort yourselves or you'll forever be using slop devices and software.
This sounds like defeat - essentially retreating into niches that only a handful of enthusiasts will be using, while leaving the mainstream to Google etc.
why is everyone so negative about anything alternative. it won't succeed and all. how do you know? maybe it's not defeat. maybe you'd be better off without any devices.
android is plagged with planned obsolescence. Don't know if that's going to help.
>ensure platform stability for the ecosystem
Aka "We will do less releases because certain OEMs don't want to be seen as outdated as they don't want to spend the resources to rebase even 4 times per year."
That's not clear to me: Will they do fewer releases, or will they have the same quarterly release cadence as now, just with only every second release open source?
I would assume the Q1 and Q3 quarterly releases are going away altogether.
They are not.
Well it does prevent them from shipping things prematurely. I guess.
They can still ship play services and their own apps at a faster cadence.
I meant OEMs rushing the gun on new features that aren't fully baked. That probably does add support burden. (I don't know if it happens anymore but it used to be a problem on the OEM forks)
They push half-baked stuff all the time anyway, I don't think this meaningfully affects that frequency.
Well, now they can only ship half baked stuff twice a year.
They should at least be shipping monthly updates with the months security updates. Well some months have not had any since Google is now trying to batch them to be quarterly because OEMs couldn't keep up with monthly security fixes.
AOSP has felt different lately, what’s going on? Not much. ~
More like a change of tone.
Quarterly releases given more emphasis. More precise stability language. Rather than feeling like an afterthought, feature flags are now receiving first-class treatment.
My view.
The isolation of platform work is earlier.
Landing flags are occurring more frequently than ever.
By “Stable,” it appears the Intuit team is suggesting “boring” which is deliberate.
I have been using a simple lens.
The surface of the platform is slow and predictable.
A gated and reversible design.
The OEM risk will be pushed later.
I wonder how other people see it.
Is Android giving off more conservative vibes?
Are flags cutting down on breakage, or just relocating it?
Has your testing strategy changed if you’ve shipped against AOSP?
In a practitioner’s take, not in a press narrative.