Related
Hi everyone,
I always thought that Nexus devices comes with a pure AOSP version with some little closed-source extras, like GApps (Google Mobile Services, Play Store, Gmail, YouTube, Maps...) or hardware drivers. And for a "librist" like me, it seems fine : OS and main userspace parts are opensourced, and Google services are closed-source. All was fine in my beautiful world.
But with some search, I discovered that every time that Google push an AOSP apps on the Play Store, it is actually a closed-clone of the AOSP one.
For example :
AOSP Keyboard is not Google Keyboard (=missing gesture)
Camera is not Google Camera (=missing Photosphere)
Launcher is not "Google Experience Launcher (GEL)" (=missing Google Now Integration, normal, but also transparency)
Music is not Play Music
Search is not Google Now
recently : Email (not Gmail)
etc.
I was not worried about "additionnal closed source services/app of Google in Android" as they are what they are : additionnal.
But the new politic of Google seems to be "we have our Touchwizz/Sense of our own, now".
The main problem is : as far as I can see on the GIT source and with Android Emulator, when Google begins to develop his "alternative closed source apps of an AOSP opensource apps", the AOSP apps seems to be abandonware.
You can compare the look of Google Search (and disable Google Now, to compare properly without Google closed services) and AOSP Search. AOSP Search seems to be from FroYo design... The same with Music player.
What's your point of this situation? Does Google try to make his own front-end interface to AOSP Android like Samsung Touchwiz or HTC Sense?
What devices comes with AOSP by default and not "Android by Google" now, if Nexus is no more the case?
BONUS : Jean-Baptiste Queru, head of AOSP, resigns from Google. I don't know what happens to replace him...
Note : I am French so, if my English is not easily-readable, please forgive me .
*bump*
Here is a point of view of an official Android developers from Google (source : arstechnica[DOT]com/information-technology/2014/02/neither-microsoft-nokia-nor-anyone-else-should-fork-android-its-unforkable/?comments=1&post=26199423)
There is a good discussion to be had about Microsoft using Android, and a lot of good reasons for them to not do so... which makes it especially unfortunate that instead this was turned into yet another article here of increasingly specious and misleading claims about the "open-sourceness" of Android and Google's hidden plan to Control Android And Then The World.
First, let's make a clear statement. If Android was to be in the same position as Windows is in the PC industry, we'd have a radically more open computing environment, where it is a lot easier for small players to compete against the dominant platform on a more level playing field. I don't think anyone can argue against this. When we were designing and implementing Android at Google, this was actually one of our goals -- to create a more level playing field for everyone -- and that design perspective hasn't significantly changed over the years.
So let’s start with the setup:
Quote:
Google has worked to make Android functionally unforkable, with no practical way to simultaneously fork the platform and take advantage of its related strengths: abundant developers, and abundant applications.
Already we see the clear bias that the article is going to take. There is however another way to state this: Google provides a lot of value on top of Android, with an ecosystem that is difficult to compete with, of cloud-based applications and services that are useful to users and developers. This is at least as true a way to describe as the quoted statement from the article, and I will argue it more accurately states the situation.
The arguments start out soft, but still misleading:
Quote:
The first is the Android Open Source Platform (AOSP) codebase. This provides the basic bones of a smartphone operating system: it includes Android's version of the Linux kernel, the Dalvik virtual machine, and portions of the basic user interface (settings app, notification panel, lock screen).
AOSP is far more than the basic bones of a smartphone operating system. It is a complete smartphone operating system. The examples you provide for what it includes are very misleading -- what about the launcher, contacts app, dialer and phone app, calendar app, camera and gallery and on? The fact is, if you build AOSP today and put it on a phone, you will have a pretty fully functioning platform.
The thing you don’t have is stuff related to cloud services, and this is not an evil secret plan of Google, but a simple fact we have been clear about from the initial design of the platform: Android as an open-source platform simply can’t provide any cloud services, because those don’t run on the device where the platform code runs. This is a key point that seems to be completely missed. If you want to understand what Android is, how it is designed, and how the pieces fit together, you must understand this point.
One of the things that is interesting about platforms today vs. the traditional desktop is that these cloud services are becoming increasingly central to the core platform experience. This presents a special challenge to an open-source platform, which can’t really provide such cloud services as part of the standard platform implementation. In Android our solution to this is to design the platform so that cloud services can plug-in and integrated with it in various ways. These may be stand-alone apps like Google Play Music, they may be plug-in services like the calendar and contacts sync providers, they may be Google proprietary APIs on top of the platform like Google Play services.
Note, however, that in all of these cases the platform has been designed to provide an open, flexible, and rich enough API that these Google services can be delivered using the same standard SDK that other app developers use. This is part of the goal of creating a more level playing field for everyone. (There are some exception where things are very difficult to safely expose to developers, but they are rare -- the Play Store’s privileges for managing your apps is one, and even there we do provide in the platform side-loading APIs so that other app stores can be implemented.)
So, GMS is Google’s proprietary code implemented on top of Android for interacting with Google’s services. There is nothing nefarious about it being proprietary -- it is interacting with Google’s proprietary back-end services, so of course it is proprietary.
Thus this makes perfect sense:
Quote:
The split between AOSP and GMS is not constant, either. Google has slowly been migrating more and more functionality to GMS. For example, in the latest Nexus 5, the core phone user interface—the thing that you use to launch apps and show icons—has been rolled into the GMS Search app.
What has happened here? Google now has their own launcher that integrates with Google’s back-end services. And what is wrong with this? Why is this worse than Facebook or Yahoo doing their own proprietary launcher? It is bizarre to complain about this, especially when Google has open-sourced everything else in their launcher except the parts that are specific to their proprietary services!
And this is the same thing:
Quote:
Similarly, APIs have made the move. AOSP contains a location API, but GMS contains a newer, better one, with additional features. Google encourages developers to use the GMS API, and the AOSP Location API mostly dates back to Android 1.0, and hasn't seen any substantial changes since Android 1.5.
First, it s very misleading to act like the platform’s location manager has been unmaintained since Android 1.5. Important features like passive providers and criteria-based updates were added much later than that; but, even ignoring verifiable facts, the Google Play services location APIs didn’t appear until last year, so what you are actually implying with this is that Google basically didn’t do any significant improvements to location from 2009 to 2013. Probably not true.
The reason for the introduction of Google’s location API, however, is again because of back-end services. Location has become increasingly dependent on cloud services: for a while now network-based location, but increasingly more things. We went for a long time with parts of the platform’s LocationManager basically not implemented because it couldn’t be, with the need for some proprietary thing to be dropped in on top of it to have a fully functioning API. As time went on this became an increasingly bad situation because we don’t want our platform to be defining APIs that it can’t also provide an implementation of, to serve as the basis for everyone to share and a reference for how it should work. So, the decision was made that Google should take responsibility of further evolution of that API since that evolution is increasingly tied to cloud services.
Quote:
Each new release increases the level of integration with Google's own services, and Google is moving more and more new functionality to GMS, leaving AOSP a barebones husk.
This is such an exaggeration that it is really hard to know how to address. AOSP is a barebones husk? Please. AOSP is far richer and more powerful today than it was in 1.0, 1.5, 2.0, or 3.0. And most importantly, one of the things we have been doing over the years is providing increasingly rich facilities for any cloud services provider to plug in to the platform. For example, in the most recent 4.4 release we have our very extensive new storage framework API, which Google uses to provide their Google Drive services to any application, and allows any other cloud storage provider to do the same thing, operating on equal footing with Google.
Quote:
That's not a small category, either, since features such as in-app purchasing are in GMS.
This gets emphasized as a significant point, but, honestly, how would you propose that in-app purchasing not go through GMS? Some general platform API to allow the app to do an in-app purchase with whoever wants to be a “purchase provider?” I can’t imagine this being a solution that people will be happy with.
Quote:
Technically, however, a company with sufficient development resources could provide its own GMS replacement. The overhead would be not insignificant, especially as—to ensure optimal compatibility—the replacement would have to replicate not just correct functioning, but any bugs or quirks of the GMS implementation.
Of course, the vast vast vast majority of the work here is implementing the back-end services in the cloud, not the proprietary glue code that runs on the device. Failing to address this is deeply missing about what is going on.
Quote:
There are also lots of little awkward aspects of the GMS API; it includes such capabilities as "share with Google+" which few companies have any real counterpart to.
In other words you don’t have your own social network, so you can’t implement Google’s API for sharing to its social network? Okay, then just have the API do nothing? Or heck, share to Facebook?
Quote:
Another example: there is an API for handling turn-based multiplayer gaming. A company could implement this API and have its own server infrastructure for managing the gaming sessions, but obviously these gaming sessions would be completely separate from Google's gaming sessions, fragmenting the player base in a way that game developers are unlikely to be keen on.
Now this could be taken as just a good argument for why Microsoft wouldn’t get as much of a competitive advantage by using AOSP, since they would still be competing with Google’s cloud services. But then it is immediately followed by:
Quote:
As an added bonus, should the ultimate resolution of Google's long-running legal battle with Oracle be that APIs are, in fact, copyrightable, this kind of wholesale reimplementation of GMS would become legally actionable. Google could, if it chose to, shut it down through the courts.
Where in the world did this come from? Google is the one fighting against that. Microsoft actually filed an amicus brief supporting Oracle. Yet you write this almost as if this case would serve part of Google’s evil plan to control Android?
Quote:
The second option—AOSP with a few extra custom extras—has the upside of providing an opportunity for Microsoft to integrate its own services… It would certainly mean omitting any high-profile title using in-app purchasing, so, say, Plants vs. Zombies 2 or the latest iteration of Angry Birds would be out.
It’s strange to focus on in-app purchasing here. The issue is that you don’t have the Google Play store, so you need to get app developers to publish their apps on your own store. In fact providing a compatible in-app purchasing API and otherwise making it easy for them to publish their app without changing it is probably the lesser problem.
Quote:
Google has pushed very significant pieces of functionality into GMS, including messaging and the Chrome browser. The AOSP counterparts are buggy, feature deprived, and by at least some accounts, barely maintained. If a company wants to use AOSP without GMS, it has a lot of work to do if it wants to produce a high quality experience. The open source parts just aren't good enough.
Again the exaggerations. Chrome is available open-source as Chromium (of course without the integration with Google’s back-end services, but why in the world would Microsoft want those?). What parts of AOSP are “buggy” compared to Google’s stuff? In fact a lot of Google’s proprietary apps are built on top of the corresponding AOSP app -- that includes Google’s Launcher, Calendar, Email, and even Gmail now. Messaging has diverged from Hangouts, but Hangouts is deeply integrated into Google services, and there is a similar situation with Music. It would be nice if some of these apps were better maintained, but (a) there are lots of equivalent apps (often based off the AOSP version) that people have written which you could license and use, and (b) implementing these apps is pretty small potatoes compared to all the cloud services Google provides.
Quote:
For Microsoft, the effort required to build a GMS workalike on top of AOSP is going to be comparable to the effort required to build the Windows Phone shell and APIs on top of Windows.
Again, the vast majority of work here is providing the back-end cloud services. Not, as keeps being implied, the proprietary bits that Google has running on Android.
Quote:
Moreover, it still implicitly gives Google control over the platform. Various aspects of how Android is used are determined by the underlying APIs: sharing between applications, for example, is done in a particular Android way. Any platform using Android in this way would have only a limited ability to take the platform in a different direction from the one Google chose.
Okay this is just weird. Yes, the Android platform has a well-defined sharing facility, and if you want to have an Android-compatible platform you will want it to work the same way. Just like, I don’t know, Ubuntu has a C library and you probably don’t want to change that. How in the world is this different from every other open-source platform in the world? How is Google being all controlling here?
Quote:
The fourth option—use AOSP with an entirely new software stack on top—gives freedom and flexibility, but to what end? The kernel isn't the important bit.
Wait, what? The only way I can figure out how to interpret this is to suggest that they use Linux (the kernel) but nothing above it. That can’t be what you mean, right? I honestly have no idea what this is supposed to be saying, except that it again seems to be implying Google is being all nefarious.
Quote:
If Android were an open platform in the way that Firefox OS or Ubuntu for smartphones were an open platform, the forking suggestion would make more sense.
I’ll admit I am not super-familiar with these two, so I have a question: what are the things that they have that are not in AOSP?
And finally we have further blanket statements about how Google’s goal is to make Android increasingly closed, AOSP isn’t real open source, etc, etc. I’ll just leave with the final sentence:
Quote:
Suggestions that Microsoft scrap its own operating system in favor of such a fork simply betray a lack of understanding of the way Google has built the Android platform.
Actually, I don’t think you have an understanding of how Google has built Android. I have been actively involved in designing and implementing Android since early on, and it was very much designed to be an open-source platform. Part of that design was to allow Google (or anyone) to build integrated cloud-based services on top of it, and that aspect of Android design has gotten richer as the years go on. What you are concerned about is not a design problem in Android, but the richness of Google’s cloud-based services.
At least Android creates a much more equal playing field for others to compete with Google’s services than is provided by the proprietary platforms it is competing with. I also think a good argument can be made that Android’s strategy for addressing today’s need to integrate cloud services into the base platform is an entirely appropriate model for a “real” open-source platform to take.
Click to expand...
Click to collapse
== THREAD PURPOSE ==
I'm opening this thread to share and learn ideas about privacy solutions, please respect the purpose and keep this thread clean. My main language isn't English so if you spot errors or omissions please PM to me so I can correct them. Thank you.
All trolling or demotivating posts, disbelieving about privacy concerns or defending Google honor will be reported for cleaning.
== PROBLEM, HYPOTHESIS, TESTS, CONCLUSION ==
For years I've been very annoyed about privacy abuse on Internet and since Snowden and Assange revelations my concerns raised. I'm sure my personal and professional life is common and boring but I want privacy with my things just like I don't want a guy next table in the coffee shop listening to my talking subjects.
My first decision was to deploy a personal server, in my home, with OwnCloud. All went fine for some months until I realized the pain it was maintaining the system working, from server attacks and system fails to energy bills nothing could justify such paranoia. The OwnCloud Android client was also very bad those days.
The second idea was hosting OwnCloud and mail services on a private host, but this didn't made any sense because data wasn't encrypted and every employee could easily see my thermonuclear projects and my banana pancakes secret recipes. It was also a paid solution for nothing.
Finally I thought "If you're using German services you should be fine, Germany privacy data laws are the toughest in the world (even better than Swiss in this matter)". I'm in Europe so using European services was a no brainier decision, preferably in Germany and owned by German companies. Yes, I know you can't trust anyone but even so I think it's a well balanced solution.
== SERVICES ==
These are my services right now, share yours and try to justify why they're equal or even better. This list will be changed as needed:
Mail - GMX (Germany)
- Generally I really don't like 1&1 services but GMX is really good and working only on European servers. I advise you to don't use their other service, mail.com, because this one use USA servers. Unfortunately all other free German providers have low storage space. If you're willing to pay for privacy try Dutch StartMail but it's beta at the moment.
Contacts & calendar - fruux (Germany)
- Amazing services, great philosophy. For privacy and decentralization purposes I've opt for don't have this services on my mail provider. Unfortunately their servers are on Amazon Ireland, but I believe fruux have implemented cryptographic code on their system.
Cloud - HiDrive (Germany)
- I NEVER upload sensitive information to the cloud, even encrypted (remember Heartbleed and AES backdoor theory?). I was using Wuala for years but gave up after have been acquired by LaCie (USA). Tresorit shouldn't be trusted either, they're using Microsoft Azure servers, each uploaded and shared link pass through USA. Mega is darkness, I don't like the smell of it.
Apps - F-Droid (UK/France)
- FOSS is the way you should go, F-Droid is the obvious choice. F-Droid client was forked from Aptoide's source code.
Aptoide (Portugal) it's good but not consensual. Recently they're processing Google with Antitrust Complaint in EU proving they're concerned. You can only trust Aptoide IF you choose to install apps from their main centralized store (the default one, be ware and don't trust any other user store). http://m.aptoide.com/about
If you can't find what you're looking for then you can use Blank Store or Opera Mobile Store. Never choose Amazon Appstore, apps installed from there have proprietary code inserted.
Search engines - DuckDuckGo (USA!)
- Technically DuckDuckGo is a meta-search engine. It's amazingly good and you have lots of options to choose (did you know you can directly search images from Google if you search !gi [image you're searching for]?).
Another great alternative is Startpage (Netherlands).
== ANDROID SYSTEM ==
My Android system:
- CyanogenMod + freecyngn + NOGAPPS + SuperSU
- TWRP recovery
- Hardening Android for Security and Privacy
== APPS ==
My essential apps are:
Apps client - F-Droid (FOSS)
- See services above.
Privacy and cleaning - AdAway and AFWall+ (both OSS)
- Obvious choices on each privacy concerned system. Block almost everything, trust no one.
Android browser - Boat (proprietary code)
- I just love the options, specs, interface and speed. I know this choice will be highly controversial for some because it's a Chinese made browser, but isn't a cloud browser (like the also Chinese Maxthon) and it's really easy to firewall it from calling home (something somehow difficult with Dolphin). The obvious FOSS choice for almost everyone would be Firefox but I really hate their Android app and I have some bad thoughts about their Google connections. The FOSS best shot would be Tint or Lightning, but they're rather limited and AOSP it's even worse. Chrome it's obviously excluded for privacy sake.
Boat devs also used to be active on Xda with many supporters. For security precautions block port range 192.241.158.0/24 and 211.151.0.0/24.
Email app - K-9 (FOSS)
- The oldest, most forked and trusted email client. Needs a deep design/interface Overhaulin' (hey, Chip Foose...)
Contacts and calendar sync - Fruux + Birthday Adapter (FOSS)
- See services above.
Password & confidential safe - KeePassDroid (FOSS)
- Believe me, I don't know a single password of my accounts and I have hundreds. The only really big and complex password I know is the one from KeePass.
Antivirus - NONE, JUST DON'T
- I will not discuss here about the needs or true benefits of these apps but I can assure your data is leaking each time you go online. All them claim about privacy but they're always collecting "unidentifiable data".
== I will post links for everything soon. Please include links in your posts when justified. Thanks. ==
== Android Alternative FOSS ==
This is a list of some well known apps and their open source alternatives. Incredibly some of them are even better than "official" or paid apps, some others are quite limited but evolving and much secure.
It's impossible to put everything here, only the best apps I've tried with success will be listed. Please keep posting your suggestions.
BitTorrent Sync > Syncthing
Chrome > Firefox
Dolphin > Tint Browser
Dropbox > OwnCloud, Seafile
Facebook > Tinfoil for Facebook
Gmail > k-9 Mail
Lux Auto Brightness > YAAB
Tasker > SwiP
Titanium Backup > oandbackup
Twitter > Twidere
Reserved, just in case.
Really great thread sancho_panzer. I never thought someone can be as paranoid as I am, but I found you.
I'd like to add a few services:
Posteo (Mail):
A german email provider that doesn't claim as much data aa most of them do. It just needs your mail, pw of course and you can add your mobile phone number if you like to (it will be saved hashed in their database). Posteo has great SSL connections and uses a the first (german) provider the new protocol DANE as well as DNSSEC. You can use their CalDav and CardDav server and choose to encrypt your address book and your calendar. The service costs 1€ per month (10 cents for additional aliases and 20ct for the next gig), that can be paid by post mail, PayPal or bank transfer. The last two way won't get linked to your account.
CalDav/CardDav
To manage my addressbook and calendar on multiple devices I use aCal from F-Droid.
For googling issues there is a browser add on for PCs that tunnels the Google searchs for you called disconnect.me
Greetz, and i appreciate your love to FOSS very much!
@traceless There are lots of people on Xda concerned about privacy on Android and the Internet. I really hope this thread could help them to take some measures about it and share alternatives.
Thank you for https://posteo.de/ suggestion. Could be a great service problem is I don't speak German. I really don't understand why the website don't have an English version. I'm also concerned with recent leaks news about *.de domains ( http://www.bbc.com/news/technology-25825784 ).
I've tried CalDav-sync and CardDav-sync and they're great little apps, but if you want a FOSS solution try DAVdroid and the very new Flock from F-Droid.
I really can't trust https://disconnect.me/ . ( http://www.darkreading.com/document.asp?doc_id=1251070& ) or Ghostery, both track you ( http://www.reddit.com/r/firefox/comments/1qkc2b/disconnect_vs_ghostery/ ). If you're using Firefox on PC or Android my advice is to install Adblock Edge (Adblock Plus is worse and heavy) + Self-Destructing Cookies (BetterPrivacy is also great) + NoScript. You should also consider CleanQuit.
@sancho_panzer
I knew, that Disconnect was founded by a former Google employee but didn't know he was linked to the NSA. Anyway my current FF configuration looks just as you recommended, but I additionally installed a plugin that's called FireGloves. This is especially useful if you want to make fingerprinting your browser harder. It disables or disguises trackable settings; if you'd like to every browsing session. How unique ones configuration is, can be seen here at Panopticlick.
I agree, that it's a pity some services aren't available in the most common languages. Posteo's webmailer can be changed to English, but the whole service is German. Btw you don't have to be worried about the de ccTLD, the 16m mail that were compromised earlier this year were most likely taken due a hack of a german online shop and as the most customers were germans, the majority of the mails end up with *.de. So it doesn't mean every german domain is compromised and mail provider are insecure.
As you don't speak german you could take a look at Secure-Mail, a mail service provided by the mainly german VPN Perfect Privacy. It hosts in NL and supposes to store no identifiable data and is also encrypted. I found no setting to change the language to english on Secure-mail, but I thought I've seen it once in english, maybe it canges only if your country is english-speaking.
Flock is really nice, but I stay with aCal, cause it comes with a calender other than the integrated one and I'm not dependent on the built-in one with the (also switchable) Googl sync.
Excellent thread, thank you for starting it.
Edit : I think HTTPS Everywhere by the EFF should be mentioned in a thread like this.
https://www.eff.org/https-everywhere
sancho_panzer said:
I'm sure my personal and professional life is common and boring but I want privacy with my things just like I don't want a guy next table in the coffee shop listening to my talking subjects.
Click to expand...
Click to collapse
It doesn't matter if you think you life is important enough to be watched or if it's just boring. The fact that you know you *could* be watched in every move you make, automatically changes your behaviour. It changes the way you think, it changes the way you speak and write. It influences the way you interact with others. Feeling watched makes you fear of what you do!
Opening a thread like this is a good thing to begin to overcome this fear. :good:
Good linux expert, my colleague, told me some finding, android wise.....
He has installed Android Firewall, and blocked every possible application and system modules, including kernel.
In apk log, found that all ip packets sent by android kernel are routed through some chinese ip address, regardless of theirs final destination.
After some research, turned out that this IP is used by NSA. Yes, all ip packets going out of our android phone are sniffed by NSA. Embedded in kernel.
My 2 cents here, and sorry if ot.
Cheers!
Sent from my GT-I9195 using Tapatalk
Nice thread, thanks! :good:
Some thoughts from my side:
I generally distrust every online service, especially if I don't pay for them. I think it is better to decentralise services and host them on self managed servers in families, groups of friends,... and thus basically only give data to trusted persons you know in real life.
Here are two good links that show alternatives to proprietary software/cloud services:
https://prism-break.org/en/
https://wiki.debian.org/FreedomBox/LeavingTheCloud
== SERVICES ==
Mail -
I think mails are generally difficult to self-host. So you need a good mail service. Posteo was mentioned here, another similar reliable german mail provider (with english translation) is mailbox.org. They even encrypt unencrypted incoming mails with your PGP-key before they store them.
Contacts & calendar -
Posteo and mail.org also include contact and calendar synchronisation via CalDav/CardDav. Even better: Host it by yourself.
Instant Messaging -
XMPP (Jabber) is an open decentralised protocol with lots of implementations for almost every platform. You can host it by yourself or use an existing server. There are also very good clients for Android like Conversations or Xabber
== ANDROID SYSTEM ==
Two additions:
Free Your Android! - campaign of the Free Software Foundation Europe
IMSI Catcher/Spy Detector
== APPS ==
sancho_panzer said:
Android browser - Boat (proprietary code)
Click to expand...
Click to collapse
Don't do this! Firefox for Android is also a good choice. And Orweb not to forget!
traceless said:
I use aCal from F-Droid
Click to expand...
Click to collapse
DAVdroid is also a very good FOSS CalDav/CardDav-provider that integrates with the contacts/calendar app of android. And it is under active development (in contrast to aCal)
I can only agree that using posteo.de is a must. Completely anonymous. I put cash in an envelop (didn't actually touch any of it myself ) and they opened my account no problem. Last time I checked their site alao had an English version. Feel free to pm me with translation issues. I speak both languages fluently. Also a thread like this without XPrivacy?
For those interested in tor along with afwall, I have posted instructions on getting them to work together in the afwall thread
I prefer the Android system to be: OMNI + NOGAPPS + SuperSU
Note that freecyngn & NOGAPPS author has switched to OMNI
Regarding OwnCloud: it's a great software, but you're right not to trust it when it runs on some server that is not under your control. That's why I run OwnCloud on a Raspberry Pi that is running at my home, behind my firewall. Syncing is made with CardDAV and CalDAV, and both apps use SSL. I think I can trust that one.
dvdram said:
Regarding OwnCloud: it's a great software, but you're right not to trust is when it runs on some server that is not under your control. That's why I run OwnCloud on a Raspberry Pi that is running at my home, behind my firewall. Syncing is made with CardDAV and CalDAV, and both apps use SSL. I think I can trust that one.
Click to expand...
Click to collapse
And what connection are you using? I thought about exactly the same solution, but it's nearly useless with ADSL.. (6 MBit/s down and just 60kbits upstream)
Thank you guys for your contribution on this thread.
Ultramanoid said:
I think HTTPS Everywhere by the EFF should be mentioned in a thread like this.
https://www.eff.org/https-everywhere
Click to expand...
Click to collapse
@Ultramanoid You're absolutely right I forgot to mention it, I use it with Firefox on my laptop and it's great.
dvdram said:
Opening a thread like this is a good thing to begin to overcome this fear. :good:
Click to expand...
Click to collapse
@dvdram I agree and don't understand why so much people just don't care to talk about it.
jukyO said:
Good linux expert, my colleague, told me some finding, android wise.....
He has installed Android Firewall, and blocked every possible application and system modules, including kernel.
In apk log, found that all ip packets sent by android kernel are routed through some chinese ip address, regardless of theirs final destination.
After some research, turned out that this IP is used by NSA. Yes, all ip packets going out of our android phone are sniffed by NSA. Embedded in kernel.
Click to expand...
Click to collapse
@jukyO Lookout, the real test here should be made on a clean system, just ROM and a Firewall. That's the only way you can say it's kernel coded. Some apps use kernel to send and receive packets, your alert could be related to one of these.
Another debatable subject should be SElinux. Many ROMs, like CyanogenMod, have it in enforcing mode by default. If you install another kernel, like Alucard, SElinux become permissive. Even if SElinux is considered OS we all should not forget that was developed and implemented by NSA (!).
bastei said:
Here are two good links that show alternatives to proprietary software/cloud services:
https://prism-break.org/en/
https://wiki.debian.org/FreedomBox/LeavingTheCloud
== SERVICES ==
Mail -
I think mails are generally difficult to self-host. So you need a good mail service. Posteo was mentioned here, another similar reliable german mail provider (with english translation) is mailbox.org. They even encrypt unencrypted incoming mails with your PGP-key before they store them.
Contacts & calendar -
Posteo and mail.org also include contact and calendar synchronisation via CalDav/CardDav. Even better: Host it by yourself.
Instant Messaging -
XMPP (Jabber) is an open decentralised protocol with lots of implementations for almost every platform. You can host it by yourself or use an existing server. There are also very good clients for Android like Conversations or Xabber
== ANDROID SYSTEM ==
Two additions:
Free Your Android! - campaign of the Free Software Foundation Europe
IMSI Catcher/Spy Detector
== APPS ==
Don't do this! Firefox for Android is also a good choice. And Orweb not to forget!
DAVdroid is also a very good FOSS CalDav/CardDav-provider that integrates with the contacts/calendar app of android. And it is under active development (in contrast to aCal)
Click to expand...
Click to collapse
@bastei Thanks for your useful input. I know Boat would be controversial talk but if you read my comments you'll see I'm aware about the dangers of such decision. Even so I'm convinced about the safety of it.
Firefox is my primary choice on my laptops since the earlier version 3. Even if I tried alternatives on some occasions I've always returned to Firefox security and true development power (I always use it to analyse code and test all websites I make), the only real alternative was Opera (the original one with Presto engine, not the crap they use these days).
Android Firefox is a completely different beast. It's heavy, buggy, need extras for simple tasks like automatic close and clean or user agent changing, but above all WHY THE HELL CAN'T WE MAKE FOLDERS and organise favorites at will? The only solution I found for favourites was to sync them with my PC, organise all there and sync them back. Did I mentioned the ridiculous times it FC? Maybe in the future, right now the only FOSS I could consider is Tint Browser.
an0n981 said:
Also a thread like this without XPrivacy?
For those interested in tor along with afwall, I have posted instructions on getting them to work together in the afwall thread
Click to expand...
Click to collapse
@an0n981 XPrivacy and Xposed could be all we need IF they were OSS. The other problem are the inevitable lags introduced by these layers.
I've tested several configurations on my phones and tablets over the time but ultimately my OP describes my options at this moment. This subject isn't closed and will never be, there aren't perfect security systems, and that's the purpose of this thread, I'm sure the OP will be changed on some occasions. Please keep suggesting alternatives and solutions, your contribution will be greatly appreciated.
aelmahmoudy said:
I prefer the Android system to be: OMNI + NOGAPPS + SuperSU
Note that freecyngn & NOGAPPS author has switched to OMNI
Click to expand...
Click to collapse
@aelmahmoudy OMNI is a valid CM alternative, developed and maintained by well know Xda developers. Unfortunately I don't really like the excessive cleanliness and limitations. The only way I could advise it would be complemented with Xposed+XPrivacy+GravityBox, besides NOGAPPS and SuperSU.
I can't talk for them but I believe @MaR-V-iN and many other ditched CM after the group became comercial oriented, the inclusion of analytical and proprietary code didn't helped either. CM it's still the base for lots of ROMs and I'm still convinced it's the best for me, provided that are VM snapshots and thoroughly cleaned and modded like mentioned on my OP.
sancho_panzer said:
...
@an0n981 XPrivacy and Xposed could be all we need IF they were OSS. The other problem are the inevitable lags introduced by these layers...
Click to expand...
Click to collapse
Both are 100% open source, just not distributed through F-Droid. You can compile them yourself, source is on GitHub. Security software will always add some lag.
an0n981 said:
Both are 100% open source, just not distributed through F-Droid. You can compile them yourself, source is on GitHub. Security software will always add some lag.
Click to expand...
Click to collapse
You're absolutely right, my mistake. Still when I used them my system felt somehow lagging.
:delete:
err on the side of kindness
traceless said:
And what connection are you using? I thought about exactly the same solution, but it's nearly useless with ADSL.. (6 MBit/s down and just 60kbits upstream)
Click to expand...
Click to collapse
I admit I have a bit more speed than you, but it depends on what you want to use OwnCloud for. I use it only for syncing calendars and contacts, and for that few bits of information even your speed is more than enough, although you should consider to do the first time syncing over WiFi. Later, when you add contacts and calendar entries, you won't notice much disadvantage.
Of course, if you want to sync pictures and movies, that speed will not be enough. But do you really need that? Is it not much more efficient to copy pictures and photos via USB cable, when you're at home? Do you really need to sync them while on the road?
That is what you need to ask yourself. Like I said: contacts and meetings are very small pieces of information, less than a text message. A 60k download (from your phone's point of view) is more than enough for that.
dvdram said:
I admit I have a bit more speed than you, but it depends on what you want to use OwnCloud for. I use it only for syncing calendars and contacts, and for that few bits of information even your speed is more than enough, although you should consider to do the first time syncing over WiFi. Later, when you add contacts and calendar entries, you won't notice much disadvantage.
Of course, if you want to sync pictures and movies, that speed will not be enough. But do you really need that? Is it not much more efficient to copy pictures and photos via USB cable, when you're at home? Do you really need to sync them while on the road?
That is what you need to ask yourself. Like I said: contacts and meetings are very small pieces of information, less than a text message. A 60k download (from your phone's point of view) is more than enough for that.
Click to expand...
Click to collapse
Thanks. Firstly I wanted to use it for an alternative to Dropbox but then I found out the Cal- and CardDAV support. And you're totally right with syncing after first initialisation. Maybe I get an RPi later and try this one and also the owncloud feed reader [emoji2]
Any idea how to use the FF sync of owncloud, since FF only supports upgrading old accs to the new mozilla ones but personally I'd prefer the old way.
Greetz
I'm wondering, based on experience witch of these people would recommend for mobile app development. (Please mention which of these you actually have experience using.)
I'm an "old school" developer and am proficient in PHP/PERL, HTML, CSS and Javascript. I don't have time to learn a new language like C# and I refuse to use Microsoft's tolls (like .NET, Visual Studio, etc.) but I would spend the time maybe to pickup up RUBY (or maybe Java) if enough benefit was there in the associated mobile app development tool.
I want as close to native as possible with 90%+ cross-platform solution, meaning, 5-10% of the source code may differ due to differences in platform. I will only be developing for Android and IOS (sorry Windows) but may develop for Windows Down the road. Some apps I may develop may be enterprise class that need to get remote data from SQL Server, etc. I have done research and narrowed down my selection and am looking for further insight from those that have actually used these tools. Things that are also important to me include:
- Low cost (I can't afford to pay $100+ a month in fees)
- Good/Large Developer Community
- Good Support from Maker (good roadmap with improvements, bug fixes frequent, etc.)
PhoneGap - This seems like the most popular but it sounds like the "quickest" route for most web developers that are familiar with HTML and Javascript/CSS but to me it sounds like I might want something that is closer to native being that my primary core knowledge has always been as a coder first, and a web developer/designer second.
Appcellerator Titanium - This seems like the other most popular tool that claims to compile so the app uses the devices native controls (via Titanium API) instead of essentially an HTML page masquarading as an app (like PhoneGap) My gut says this one suits my situation better than Phonegap. Why do people use PhoneGap instead of this, because it's easier for non-programmers?
RhoMobile Rhodes - I am wondering how this compares to the two above assuming I learn RUBY on Rails.
Telerik Icenium (now called AppBuilder) - This one I have found the least discussion about.
I just ran across Codename One too which sounded intriguing as would require me to learn Java.
It seems most everyone (that isn't doing native) is using PhoneGap or Titanium and the second two are lesser known so I'm having a hard time finding people that has at least some brief experience using all four or five of these.
Any insight is greatly appreciated.
jazee said:
I'm wondering, based on experience witch of these people would recommend for mobile app development. (Please mention which of these you actually have experience using.)
I'm an "old school" developer and am proficient in PHP/PERL, HTML, CSS and Javascript. I don't have time to learn a new language like C# and I refuse to use Microsoft's tolls (like .NET, Visual Studio, etc.) but I would spend the time maybe to pickup up RUBY (or maybe Java) if enough benefit was there in the associated mobile app development tool.
I want as close to native as possible with 90%+ cross-platform solution, meaning, 5-10% of the source code may differ due to differences in platform. I will only be developing for Android and IOS (sorry Windows) but may develop for Windows Down the road. Some apps I may develop may be enterprise class that need to get remote data from SQL Server, etc. I have done research and narrowed down my selection and am looking for further insight from those that have actually used these tools. Things that are also important to me include:
- Low cost (I can't afford to pay $100+ a month in fees)
- Good/Large Developer Community
- Good Support from Maker (good roadmap with improvements, bug fixes frequent, etc.)
PhoneGap - This seems like the most popular but it sounds like the "quickest" route for most web developers that are familiar with HTML and Javascript/CSS but to me it sounds like I might want something that is closer to native being that my primary core knowledge has always been as a coder first, and a web developer/designer second.
Appcellerator Titanium - This seems like the other most popular tool that claims to compile so the app uses the devices native controls (via Titanium API) instead of essentially an HTML page masquarading as an app (like PhoneGap) My gut says this one suits my situation better than Phonegap. Why do people use PhoneGap instead of this, because it's easier for non-programmers?
RhoMobile Rhodes - I am wondering how this compares to the two above assuming I learn RUBY on Rails.
Telerik Icenium (now called AppBuilder) - This one I have found the least discussion about.
I just ran across Codename One too which sounded intriguing as would require me to learn Java.
It seems most everyone (that isn't doing native) is using Cordova/PhoneGap or Titanium and the second two are lesser known so I'm having a hard time finding people that has at least some brief experience using all four or five of these.
Any insight is greatly appreciated.
Click to expand...
Click to collapse
Both Phonegap and Appcelerator compile into a native package containing a mix of native and javascript and with both you develop your code using Javascript. As you've pointed out, one of the key differences is that Appcelerator will use the native device OS widgets rather than web widgets. In simple terms the layout is abstracted into an XML format which is then rendered into native equivalents during compilation for each of the platforms.
Depending on your application, native widgets may be important, or not. For example if you're developing a game then it could actually be advantages not to use the native widgets and have an essentially identical look and feel across all device platforms and screen aspect ratios.
The other difference is that Phonegap is free, (though their optional build service is not). Appcelerator is priced on a monthly subscription, but you also get some cloud features included in that.
Other popular cross platform tools to check out: Xamarin (native widgets, C# development, non-Free), ReactJS (native widgets, Javascript development, free-open source)
You can also try using Ionic and Cordova frameworks, They support cross-platform development and in my opinion have good documentation support
This question has been made, but mine is a little specific.
Apologies if this has already been made.
1: I'd love a recommendation to learn code. (Apps, computers, etc. I'm a masters student in public health, so I'm very broke right now...cheaper the better).
2: I've searched for a solution to transfer JAVA into apple's language, but I'm only coming up with "build your app" sites to fit both of them.
3: My app will be running on a home server, but I lack then skill bind the server to the app depending on user's input.
I've been watching tons of android studio videos, but it is so linear; it simply avoids the foundational aspects of coding.
Again, sorry if this question has already been posed before.
APP DESCRIPTION MINUS DETAILS
consider it instagram, with a main social hub, in app chat, and other app integration for the share function. I won't say much about it until I have a functional prototype (All I have is the layout, and overall UI finished).
medicraze said:
This question has been made, but mine is a little specific.
Apologies if this has already been made.
1: I'd love a recommendation to learn code. (Apps, computers, etc. I'm a masters student in public health, so I'm very broke right now...cheaper the better).
2: I've searched for a solution to transfer JAVA into apple's language, but I'm only coming up with "build your app" sites to fit both of them.
3: My app will be running on a home server, but I lack then skill bind the server to the app depending on user's input.
I've been watching tons of android studio videos, but it is so linear; it simply avoids the foundational aspects of coding.
Again, sorry if this question has already been posed before.
APP DESCRIPTION MINUS DETAILS
consider it instagram, with a main social hub, in app chat, and other app integration for the share function. I won't say much about it until I have a functional prototype (All I have is the layout, and overall UI finished).
Click to expand...
Click to collapse
https://www.google.co.in/url?sa=t&r...Xbb5Mjfl4XXoH2M-2TPHXw&bvm=bv.139138859,d.c2I
go here....its your best bet...good luck
Hi guys,
I'm starting this thread to discuss the "eelo" project and post news about it.
"eelo" is an initiative to release a global and appealing alternative to Apple, Google, ... with as much privacy as possible, with open-source as an ideal.
The eelo ROM is going to be forked form LineageOS and won't include anything from Google proprietary services.
eelo web-services will include email, search, online office... as a consistent, sustainable and global offering.
I've been thinking about this project for several years, and now I think most of the bricks for the project are available. They "just" need to be put together and polished as a consistent offer.
This is a non-profit project, in the public interest.
I'd love to read your your ideas/suggestions about eelo!
Cheers,
Gaël
Update: I'm posting here the "foundation" articles about eelo:
1/ Leaving Apple and Google : my “eelo odyssey” – Introduction
In 1998, I created Mandrake Linux, because I was both a Linux fan and didn’t like Windows on the desktop. It’s been a long time, and I’m very happy I’ve been one of the actors who contributed to make the Linux desktop possible, even though it didn’t completely succeed. Since then, the smartphone has emerged. And it’s now a “companion of life” for many of us. On my side, I’ve been using Apple iPhones exclusively, since 2007. The main reason behind this choice is that I like iOS. It covers my needs, it looks great and elegant, and I find it very intuitive to use.
Also, over the past years, I moved from my (Mandrake/Mandriva and then Ulteo) Linux desktop to MacOS. There has been a professionnal reason for that, since I often need XCode for building iOS applications. But also, it’s very convenient to use in conjunction with other Apple devices. I can get my text messages on MacOS, I can answer a call hand-free, I have my notes synced accross my devices.
But talking with friends this year, I realized that I had become lazy and that my data privacy had vanished.
Not only I wasn’t using Linux anymore as my main operating system, but I was also using a proprietary OS on my smartphone. And I was using Google more and more. Search of course, but also Google Mail, Google drive and Google docs. And Google Maps.
I’M DEFINITELY NOT HAPPY WITH THAT SITUATION.
I’m not happy of this situation because iOS is proprietary and I prefer Open Source Software. And Apple is getting crazy, with their latest products. Too expensive, not really exciting. It also has some design issues in my opinion. It has become a social act to buy an iPhone: “see, I can buy it”. Buying an iPhone has become a snob attitude and I hate that.
Also I’m not happy because Google has become too big and is tracking us by catching a lot of information about what we do. They want to know us as much as possible to sell advertizing.
Like millions others, I’VE BECOME A PRODUCT OF GOOGLE.
Last, I think that, in the long run, Apple, Google, Facebook etc. business models are harmful for our economical and social environments.
So I want to stop that. People are free to do what they want. They can choose to be volunteery slaves. But I do not want this situation for me anymore.
Reconquer my privacy
I want to reconquer my privacy. My data is MY data. And I want to use Open Source software as much as possible.
At the same time, what exists at the moment doesn’t exactly fit my needs: of course I don’t want to use stock Android. It’s Google everywhere and its default user interface is bad (my taste).
Also, I’d like to find good online tools such as office, email services etc. that don’t belong to Google.
And I’d like to have the same confort that I have with iOS and MacOS with synchronized services.
I know about a few initiatives, in particular “PureOS” is very interesting and appealing if you want a 100% pure-Free Software. But that is definitely not something I would use daily, at least not in its current state. I need something I could even recommend to my parents or my children. Something appealing, with guarantees for more privacy. Something that we could build in a reasonable amount of time, something that will get better and better over time.
So let’s build something new! “eelo”
My decision is taken: I’m going to build something new that will be open source (as much as possible) and very attractive. At least for me, but probably it could be attractive for a few others as well.
I’ve played with LineageOS for a few months and I think it’s the way to go. You can recompile it, improve it, fork it… and that’s what I’m going to do.
Some nice web services also seem to be viable alternatives to Google apps, so I’m going to explore that and possibly aggregate that into a single service. And offer guarantees to users of this new project.
This is an odyssey, this is a non-profit project
I call the project “eelo” because eels are small fish that can hide into the sea. That’s perfect for my quest of more privacy.
I want eelo to be a non-profit project “in the public interest”. I think operating systems and web services should be a common resource: as I explained a few year ago, this is infrastructure, like phone networks, rail tracks, roads…
Non-profit doesn’t mean nothing will be for sale. Probably some eelo smartphone will be for sale, and some premium services will be available for corporates. But profit won’t be the first focus of eelo.
Eelo will be for users first, for everyone who cares about their data privacy, for everyone who wants to use exciting products, for everyone who wants to join an exciting new project.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
So… starting from now, I will periodically post my progresses to release an appealing alternative for the mobile and for web services.
Next time, I’ll show how LineageOS can be hacked, rebuilt and improved for eelo!
If you are interested in that odyssey, as a potential user or contributor, you can register at the eelo.io website.
Next part in this thread:
- 2/ eelo: the mobile OS
- 3/ eelo: web services
New post about eelo web services: "Leaving Apple and Google: my “eelo odyssey”. Part2: web services"
(URL removed per request from this forum mods)
leaglavud said:
New post about eelo web services:
Leaving Apple and Google: my “eelo odyssey”. Part2: web services
Click to expand...
Click to collapse
You write about a new launcher. Can we see the sources?
kurtn said:
You write about a new launcher. Can we see the sources?
We will release sources on GitHun and APK builds of eelo's BlissLauncher on F-droid and APKPure once we think its stable enough and compatible with common screen resolutions.
Click to expand...
Click to collapse
Great!
Please don't use XDA as a way to make money. This includes posting links to crowdfunding campaigns
Thread Cleaned
mark manning said:
Please don't use XDA as a way to make money. This includes posting links to crowdfunding campaigns
Thread Cleaned
Click to expand...
Click to collapse
Hello, I don't see where XDA forbids to post links to crowdfunding campaigns. Can you point me to the correct place in your terms of use?
leaglavud said:
Hello, I don't see where XDA forbids to post links to crowdfunding campaigns. Can you point me to the correct place in your terms of use?
Click to expand...
Click to collapse
No problem mate
13. Advertising and Income Generation
Commercial advertising, advertising referral links, pay-per-click links, all forms of crypto-mining and other income generating methods are forbidden. Do not use XDA-Developers as a means to make money
Click to expand...
Click to collapse
We're not "making money", we have a kickstarter campaign to support eelo, which is non-profit. That's quite different.
leaglavud said:
We're not "making money", we have a kickstarter campaign to support eelo, which is non-profit. That's quite different.
Click to expand...
Click to collapse
https://forum.xda-developers.com/showthread.php?t=3725368
On the thread above I have briefly explained why the crowdfunding / kickstarter threads are not allowed, as you can see, another user opened it up on the same topic.
No one is directly accusing you of trying to make money, no one said you're selling something and we actually appreciate the project initiative but "donate to us to make this happen" is not allowed as per quoted rule.
The funding goal is the amount of money that a creator needs to complete their project. Funding on Kickstarter is all-or-nothing. ... A creator is the person or team behind the project idea, working to bring it to life. Backers are folks who pledge money to join creators in bringing projects to life.
Click to expand...
Click to collapse
I don't really feel happy with keeping this conversation here but as long as you're the OP I feel obliged to do it .
There are hundreds of developers and project initiators around, what if everyone will ask for funding in order to sustain their plans?
The rules says clearly, present / develop the project and if anyone wants to donate is free to do so by freely hitting the donate button, there's no restrictions.
all moderators are illuminati? just 4 gk
:v
Amar 721 said:
all moderators are illuminati? just 4 gk
:v
Click to expand...
Click to collapse
No... I'm on the Darkside
xanthrax said:
No... I'm on the Darkside
Click to expand...
Click to collapse
what does that mean
dark side of the brightness
:v
Leaving Apple and Google: my “eelo odyssey”: the mobile OS
2/ Leaving Apple and Google: my “eelo odyssey”. Part1: the mobile OS
So I came out about my decision to leave Apple and Google. It’s a lifestyle choice to escape the tech giants that make me a product by privatizing my personal data .And I don’t like what Apple is doing now, Apple’s attitude, new iPhone and their price… It’s also an act of freedom for my children and all the people who will care: I want them to have a choice, and also a clear and informed view on how their choices can impact their life and their economical ecosystem as well. That’s what eelo is all about: offering a viable and attractive alternative to users for their digital life.
In this new post I’m going to describe what I was able to do so far on the mobile to get rid of Google and Apple, and what remains to do (spoiler: there’s a lot). In the next part I will explain what how things will need to be adressed on web services and draw a whole picture of the eelo project.
What’s wrong with default AOSP/LineageOS?
Talking about LineageOS, you might think “why do you want to hack something that is already mostly open source and works well?”
The answer is easy: the core of AOSP/LineageOS is usable, and performing well, but it’s not good enough for my needs: the design is not very attractive and there are tons of micro-details that can be showstoppers for a regular user. Also, unless you are a geek, LineageOS is not realistically usable if you don’t want google inside.
The design point
Regarding design, I know that some Android users like it, but I really dislike the default graphical user interface. I find it ugly: icons don’t look good, colors are sad, and I don’t like the launcher ergonomy and behaviour.
So at least we need a new launcher, and better icons. Default notifications don’t look very good either, and I’m not a big fan of the settings part. Compared to the rest of the UI it could be worse, but it’s still quite sad, with a single green color in LineageOS. I’d like something more appealing, and probably better organized.
“Good news”: you can find hundreds of custom launchers and icon themes in the Google Play Store. But either you have to pay for them, or you get free stuff with lots of ads and possibly scams. So not for me.
Bad news, good news
The bad news is that I’m new to Android development and I don’t consider myself a great developer. I can hack things, I can recompile and integrate stuff, but I don’t have enough practise to program a new launcher from scratch without spending weeks on it.
The good news is that I have found a very talendted full-stack developer who is interested in the project. We have agreed, as a first collaboration, to release a new launcher, new notification system and new “control center”.
First successes
I’ve choosen to test custom builds of LineageOS/eelo on a LeEco Le2. It’s a nice 5.5″ smartphone with a 1080×1920 pixel screen, 3GB RAM, 32GB storage, finger sensor in the back, and a 4K camera. It costs about 130€. Yes, that’s about $150. Yes.
Also I’m waiting for a Xiaomi Mi 5S. It’s got a smaller screen and I prefer smaller devices for my own usage. And I’ll probably give a try to the LG G6. (Want to suggest a device? tell me!)
After several weeks of work, we now have a new launcher! It still lacks a few features (such as uninstalling an application), but it’s already fully functional. On this video, you can see the “icon group” feature, and swiping between several launcher pages:
eelo BlissLauncher 1 from eelo on Vimeo.
On this one you can see the “docking icon” feature:
eelo BlissLauncher 2 from eelo on Vimeo.
We call it the “BlissLauncher” just because it’s a great launcher. And we also have a first new notification system and a new unlock screen:
Next time will be to have all that integrated by default in a new fresh build. And at the time of finishing this post, I already succeeded to flash a fresh build with the new launcher and the new notification system.
Getting rid of Google stuff completely
Now we have a better launcher for eelo, and I’m working with a great and very professional designer. He contributed a lot to the Mandrake Linux interface icons in the past, when we redefined all the user interface and all icons. Later he also contributed to first releases of Ulteo, when it was still a cloud-operating system project, and not a Citrix-alternative. We’re working together to redesign default application icons, some wallpapers, splashscreens, and also a first real eelo logo. On the long term, we will have to redesign the full user interface.
But what we want is not only something good-looking, attractive and easy to use. We want more privacy! And Google services are not compatible with my idea of privacy.
Therefore, we don’t want Google Services. We don’t want Google play store. And we probably don’t want most of Google apps such as Calendar, Email etc.
Also, we probably don’t want Facebook either and some other so-called “free” services. This will be user’s choice to install them or not. I know that we cannot change the world in one iteration, this will be step by step.
Each of this point will need to be addressed in Eelo. We will need an independent application repository, an independent and secure email provider, an independent online drive, online office services… All that well integrated in eelo. In the user interest first.
First round without Google
The first time I was able to recompile and flash LineageOS, I soon had to install Google Play Store and Google Play Services to install common applications, or I could do pretty nothing.
But there are some alternative stores. For instance, F-Droid is a very successful APK application repository that provides only 100% open source software applications.
There are other alternative app stores for non-open source applications. For instance there is Aptoide. It provides most common applications such as Twitter, Waze etc. But unfortunately when I checked Aptoide APK packages signatures and sizes, I realized that they were not the same as on Google Play Store. I’m not sure to understand well the reasons behind this situation, at least for common applications, so I looked for other alternatives.
I found APKPure to be a great store for free applications. And trust me, a lot of applications are free! Actually, I realized that on my iPhone I had only free applications. And I know many people who are using only free applications. So APKPure is a great way to go if you don’t want to use Google Play Store and don’t need non-free applications. I checked many of their packages, and they are bit-to-bit identical to the ones available on Google Play Store. There are only official packages.
An alternative to APKPure is Yalp. Yalp is an open source application that is acting as a kind of anonymous proxy to Google Play Store, also providing only official APK packages.
So for applications, I’m now using both F-Droid and APKPure. That’s already very confortable, and I successfully tried dozens apps, including the most used apps (Facebook, Messenger, Twitter, Waze, Telegram, Skype, LinkedIn, Spotify…).
But I think we’d need an “eelo store” that would deliver both:
- official free applications like APKPure
- open source applications like in F-Droid
All that into a single, appealing and fast application, where users could check easily if an app is open source or not, where users could evaluate the application level of privacy, and where users could be able to report some scam issues. We definitely need to add this to the eelo roadmap.
Lovely Google Services
There is a feature that Google has created to jail users within their environment. That’s called “Google Services”. It’s a non-open source service that you have to install if you want to use Google Play Store, for instance. It’s also used by several applications. It provides services such as:
- analytics
- account authentication
- cloud messaging (notifications)
- drive
- geofancing
- maps API
- mobile ads
- games API
…
Developers of Android applications are not forced to use them, but obviously Google is doing their best effort to make them desirable as much as possible, if not mandatory for certain features.
The good news is that many common applications, the ones that everybody is using everyday, are not using Google Services, or they do not rely a lot on them. Probably a lot of developers don’t like to be jailed in a single ecosystem.
As far as I tried, the most problematic applications in this regard seem to be some games, such as Pokemon Go. This one doesn’t seem to be usable unless you have Google Play services installed.
The good news is that there is a nice project that is providing open-source alternatives to Google Services. It’s called MicroG, and eelo will probably integrate it.
Another “great idea” of Google is their SafetyNet Attestation API. It’s something that Android application developers can use to check if the user’s device is an official device that complies with Google’s environment. It examines the hardware, the software, checks wether the device is rooted or not. In the end this can be used to prevent to application to run if the environment doesn’t comply enough with Google’s rules. Fortunately, there is “Magisk” to circumvent this issue. We will probably need to integrate it by default in eelo as well.
What about web search?
Many parts of a modern operating system can lead to “Privacy indiscretions”. So far, I’ve talked about privacy issues that come from within the system.
But if you search for something on Google, it’s very likely that Google can determine that YOU are looking for something in particular. Even if you are not using a google account in you Chrome browser, they can track your IP for instance.
So we definitely need to provide a default search engine alternative to Google search. Probably that we don’t want Bing or Yahoo either, although it’s better to use various search engines so that each of them doesn’t know exactly everything about your searches and therefore cannot consolidate your private information efficiently. We have a few alternatives:
- the well-known DuckDuckGo: even though it heavily relies on Google Search results, it offers privacy guarantees that Google doesn’t offer.
- Qwant is a new search engine that is making big progresses and now has its own index and is offering guarantees on privacy
- there is also the fully open CommonSearch: project, but it’s not ready yet
So I’m considering offering both DuckDuckGo and Qwant as default search engines for eelo search and web browsers that will ship with eelo, while still offering Google (and others) as an option. It’s true that in some cases, it is still offering the best results.
And also…
There is a long list of Internet services that can track you, send and process your personal data in many ways. For instance, using a Gmail (or similar) email account is a great way for Google to learn a lot about you.
But also, some of you probably know about the very fast Google DNS resolver: 8.8.8.8 and 8.8.4.4. DNS resolvers are used all the time and by many applications. They convert domain names to IP addresses. And I say: DO NOT USE Google DNS resolvers. Each time your smartphone is looking for a domain name, Google knows about it and they can add this information to other information they know about you.
Instead, you can use 9.9.9.9 (or 2620:fe::fe IPv6) which is a fast public DNS resolver operated by a non-profit research institute that does not store your IP. And it be accessed throught a secure protocole (TLS).
Of course, it’s all the web-service ecosystem that we need to address. As I said earlier, eelo will provide a mobile system with better privacy, but also some web services such as an online office suite, some online storage etc. We will aggregate some existing web services, improve them if needed, or build new services if nothing is available.
Still, we will face one dark zone: low-level proprietary hardware drivers on smartphones. They are driving the camera, the GPS, various sensors… Hardware vendors do not provide source code for these drivers. And they are extremely difficult to rewrite unless doing some heavy and resource-consuming reverse-engineering. And of course, some of those “black box” drivers could possibly leak users’ private data.
Future options for eelo to address this issue will be to:
- partner with FairPhone or similar 100% open hardware projects
- audit low-level drivers to detect unappropriate behaviors
- design an eelo phone…
Join the eelo odyssey!
As you can see, eelo is a true odyssey. But I think that, maybe for the first time, all bricks are available to build a new, consistent, attractive, independent and mostly-free digital ecosystem that will be more respectful of users, and respect their privacy. And this could eventually challenge the advertizing model that is probably the source of this such bad and supposedly “free” model.
Again, eelo is a non-profit project, it’s a project in the public interest. Everyone who wants to join, please do!
There are many ways to contribute:
- say hello! ? having supporters help a lot
- contribute some ideas, some resources, what you are good at
- introduce us to people who can help
- talk about eelo, share eelo news and articles…
- offer a few mɃ to pay some servers
Also, I’ve started to work on a crowdfunding campaign for eelo, because some resources are needed to bootstrap this project correctly. I’m not sure exactly what this campaign will be able to offer in rewards, but I’m thinking about it. Anybody’s suggestions are welcome!
Next part: 3/ Leaving Apple and Google: my “eelo odyssey”: web services
Leaving Apple and Google: my “eelo odyssey”: web services
3/ Leaving Apple and Google: my “eelo odyssey”: web services
I’m leaving Apple and Google for those reasons and I’m putting this effort into a new project: “eelo“. For this project, one big part is the operating system, in particular the smartphone operating system. I started to work on this part with others, and had first results that make me feel that maybe my move to a better digital privacy is going to be easier than expected ?
But today, a smartphone without internet services would be like a car without gasoline. We need email, we need online storage, we need advanced online applications… Also people like to access our data from several places and devices. The operating system has turned global.
So eelo needs to provide tools that can be accessed from other places, such as a web browser, but probably also from other computers and operating systems: notes, messages, calendar… And of course, we want all this with full respect of the user’s privacy, and no ads.
Many services to address
We need to address a number of internet services and find good alternatives that we can put together into a consistent, intuitive, secure, sustainable and global eelo service.
Here is a scheme of the eelo global system as I have it in mind:
A web service review
– Email
Email means some postfix configuration on servers, with POP3 and IMAP, all with all access secured over TLS. Plus a webmail access (I’m considering to use Mailpile).
iRedMail can set up all that easily, with DKIM and SPF correct configuration, and will even make possible to offer custom domains for the eelo email service.
But if we want a private service, we’ll need security on servers, where emails are stored. That’s a key aspect and we need to apply the best practises for setting up a rock-solid secure server for storing email.
– Search / Maps
I’ve already talked a bit about search in my previous posts. DuckDuckGo and Qwant have become two excellent alternatives to Google/Bing/etc.
But I think we need to set up a generic wrapper for search, like search.eelo.io, and we’ll put whatever we consider to be good behind. That could be an aggregation service as well.
As for maps, there is an awesome and adorable project that is OpenStreetMaps. It’s growing and is catching more and more attention from users and medias as an real alternative to Google Maps.
It also now offers directions and there is a “street view” ongoing project.
We’ll have to integrate it as maps.eelo.io, probably with some customization and dedicated servers.
Of course, all these default settings will be integrated in the eelo ROM (the smartphone operating system).
– Office
We have two choices for a good and open-source Office alternative for online usage: LibreOffice/Collabora and OnlyOffice. My preference goes for OnlyOffice because it’s attractive, efficient and allows realtime online collaboration between several users on office documents.
I’ve used OnlyOffice on my servers for several weeks now, and beside a few glitches, it’s a fully viable alternative to Google Docs or Office365.
– Drive / notes / calendar
The “cloud storage” service is a big and key part of the project. It needs to be very carefully choosen and integrated because it’s going to be at the center of users’ digital life.
There are several projects that offer these features, such as cozy.io, OwnCloud and NextCloud. For now I have tested NextCloud successfully and I must say that it’s amazing!
You can easily set up a NextCloud client on your smartphone, and do the same on other PCs. Then you get all your content synchronized. Very convenient for pictures, documents, notes… I’ve tried on Linux (and Mac) and it works well.
The good news is that NextCloud can also serve a calendar that can be shared/accessed from various devices.
So for now, I’m going with NextCloud. I’m not sure about OwnCloud benefits over NextCloud. Any advice?
The first goal of eelo will be to offer a fully functional and secured implementation of OnlyOffice+NextCloud. As there is a debate about self-hosting, eelo will also provide the service as software instances that can be installed on a user’s server, in the cloud or at home, if they will so.
– Social / Messaging
Of course you are using Facebook. I do as well, not very often though. There is also Twitter. Facebook in particular is a real nightmare in term of users’ privacy. They know a lot about billions users. If you happened to do an advertizing campaign on Facebook, you probably noticed that you can target people categories. Age, gender, place of living, income, … There are dozens criterias that prove that they really know a lot about people.
So Facebook is something we should stop to use in favor of better alternatives. There is a good news: you can use Mastodon. It’s a decentralized social network. Without any central big brother who can use your data to fuel a business model.
The issue is that social networks have a greater value when you can find most of your friends/family there. Which is not the case yet on Mastodon, but in tech communities.
So we’ll keep an eye on Mastodon and see how eelo can interact with the project and possibly integrate it.
As for messaging, everyone will be able to use their messaging app of choice, but eelo will ship with Telegram by default. The reason is that Telegram is probably the most secure messaging app, and also the most respectful of user’s privacy. It also provides quality voice calls over IP. Last but not least, its client is open source (although the server infrastructure is not).
And also…
– ID / translations / …
We will need an identity provider at some point. It will be a central point for authentication. OpenID is an option, although it clearly lacks some momentum at the moment. Brainstorming is needed on this!
While it may be a more minor aspect we’ll also probably need a translation service, voice recognition service, speech service, video/voice streaming services… There are many initiatives in this field, but they are not a priority for now.
About eelo tokens
I’m thinking about releasing eelo tokens, based on Ethereum. It would be a way to get access to some eelo services, and also to thank contributors. Again, most eelo services will be free because it’s the only way to compete against the so-called “free” services from Google, etc., and it will remain in the public interest first. But selling some premium services, high-end eelo smartphones, consulting… will be part of the model to fuel the project and make possible the free services. I have the feeling that using eelo tokens could help a lot to ease service transactions between all the parties involved in eelo.
Next steps for eelo
As we’re continuing the work on the eelo custom ROM, new launcher, and integration of web services, I’m still listening to user’s suggestions about the project, ideas… Many people have already contacted me and hundreds have registered on the eelo landing page, that’s awesome ?
We’ll also probably have a separate eelo development branch for more advanced projects. Actually, I’ve been thinking a lot for a while to turn the smartphone into a conversational device – text or vocal – with conversational apps instead of legacy applications. But that’s cutting-edge development and won’t be available into eelo by default.
An eelo website is now available at eelo.io and we have a Kickstarter campaign that has already done more than 300% of its initial target. Watch the eelo campaign video.
We're recruiting developers!
- android developers
- LineageOS developers/ROM maintainers
- ...
Contact us at [email protected]
— Gaël (follow me on Twitter @gael_duval / on Mastodon @gael@mastodon.social)
This is old text. Where are the sources for the launcher?
A couple of random thoughts:
1: Eelo is an awful name. It sounds like something a baby would come out with, while learning to talk
2: As well as freeing yourself (ourselves) from the tentacles of Google and, if this is about privacy and freedom from tracking; it should aim to avoid using services based in any of the Five-Eyes Countries
Hence:
* Consider Wire (based in Switzerland) instead of Telegram.
* Quitter..no is a pretty full-featured replacement for Twitter. Running on GNUsocial and based in Norway
* Qwant in preference to DDG [France vs US -based]
* Jottacloud -also based in Norway, is a pretty good like-for-like replacement for Dropbox. Same kind of free/paid account tiers.
3: While we're being all 'European' about this (well, I am), can you make sure and use 'European English' in your documentation when you set up the website? Drives me mad when I see Europe-based companies using "color", "center", "...ize", etc.
4: In the same vein, make sure the website invites people to "Contact" you. There's a special place in hell reserved for anyone who uses that puke-inducing phrase 'Reach out"!
kurtn said:
Where are the sources for the launcher?
Click to expand...
Click to collapse
We will release sources on GitHub and APK builds of eelo's BlissLauncher on F-droid and APKPure once we think its stable enough and compatible with common screen resolutions.
xxxmadraxxx said:
A couple of random thoughts:
1: Eelo is an awful name. It sounds like something a baby would come out with, while learning to talk
Click to expand...
Click to collapse
That's not too bad for a just-born project.
2: As well as freeing yourself (ourselves) from the tentacles of Google and, if this is about privacy and freedom from tracking; it should aim to avoid using services based in any of the Five-Eyes Countries
Hence:
* Consider Wire (based in Switzerland) instead of Telegram.
* Quitter..no is a pretty full-featured replacement for Twitter. Running on GNUsocial and based in Norway
* Qwant in preference to DDG [France vs US -based]
* Jottacloud -also based in Norway, is a pretty good like-for-like replacement for Dropbox. Same kind of free/paid account tiers.
Click to expand...
Click to collapse
Thank you for your suggestions. Some of them were already considered actually!
3: While we're being all 'European' about this (well, I am), can you make sure and use 'European English' in your documentation when you set up the website? Drives me mad when I see Europe-based companies using "color", "center", "...ize", etc.
Click to expand...
Click to collapse
What would be your suggestion of wording for a project that is not specially "European" or "American", e.g. worldwide project?
4: In the same vein, make sure the website invites people to "Contact" you. There's a special place in hell reserved for anyone who uses that puke-inducing phrase 'Reach out"!
Click to expand...
Click to collapse
At eelo.io, we have "contact eelo" and "get in touch"
leaglavud said:
What would be your suggestion of wording for a project that is not specially "European" or "American", e.g. worldwide project?
Click to expand...
Click to collapse
Well. Call me a pedant if you like. But if you're offering a language option, you should use the official version of that language, not a regional dialect. As far as I can see, when people pick French, Spanish, Portuguese language options on a website, they're not then given Quebecoise, Mexican Spanish, Brasilian Portuguese... etc. But English speakers are nearly always served up American English --even on sites / by projects that are not based in the US. [Yes, I'm looking at you Ubuntu & Linux Mint!]
It may seem a trivially unimportant point. But, as well as the privacy and data-harvesting concerns, my interest in projects such as yours also stems from a wider worry about the Americanisation of the world, which is being driven by the overwhelming dominance of big American companies in the tech & media worlds. Not automatically defaulting to US English is just one more small gesture non-US-based projects can make towards offering an "alternate viewpoint".
Man, what an undertaking!
Personally, I think the main thing should be to focus on Power Users and Privacy Conscious users, not the masses. Not yet.
First make a 'beautiful' reliable OS according to your desires. Focus on making that the best & a real point of differentiation from what is out there already. Make it as useful and unique as possible. Make it run on the widest range of hardware possible, and as easily as possible. That should be enough of a challenge.
Don't worry about creating cloud services or bundling this-and-that yet. I think that is extremely unimportant to Power Users who will install what they prefer anyway, and use the hardware they prefer ( & can obtain easily or cheaply). It might be useful to sell one model with everything as you envisaged it but I think the main focus should be on testing with a wide variety of phone / tablet hardware available and making it work there.
My priorities go like this:
1. buy cheap Chinese hardware
2. root, remove as disable as much obvious spyware as possible
3. fulfil 95% of app needs from f-droid
4. fulfil 5% of app needs from Play Store using sites such as https://apps.evozi.com/apk-downloader/
5. use device
If you can make step 2 ( above) easy and painless on as much hardware as possible, then I think that would be the best focus of time and resources.