DivestOS: long term device support with enhanced privacy and security

Could you grab logcat immediately after the crash and share it?

1 Like

Logcat for Tor Browser crash says: Out of memory, and memory on device is very low and critical. It doesn’t freeze; it crashes. There were about 5-10 tabs open before crashing.

This time Mull had 25 tabs open before crashing! Big improvement. I won’t complain. It’s version 90.1.3 from DivestOS F-Droid repo. A couple updates newer than the latest on main F-Droid repo.

Backtrace parts of logcats are attached. Zipped with passwords, to be PM’d to @relan and @SkewedZeppelin . If more of the logcats would help, let me know.

mull-traceb.txt.zip (1.8 KB) torbrowser-traceb.txt.zip (1.5 KB)

Google Pixel 4a 5G (bramble) | DivestOS 18.1 / 11.0 / R

I’ve a Google Pixel 4a 5G (bramble) available for several weeks for testing purposes. I would be pleased if I could also try out a release of DivestOS 18.1 / 11.0 / R soon. Is there a chance or rather not?

@fossys

bramble

That is on the TODO list, but lower priority as GrapheneOS is more suitable imo.

Has DivistOS been successfully tested on OnePlus 7 Pro (guacamole)?
As for flashing this, do I install the latest lineage is 18.1 and install the divistOS on top of it?
TIA

@Bradzilla117

As per the site, guacamole has yet to be tested.
You just flash DivestOS on its own, no need to flash anything else,
except for stock in some cases.

My uncle tried flashing and was a bootloop. He has the oneplus 6t and his phone is decrypted because twrp doesn’t work on android 11 unless decrypted. He claimed he flashed stock oxygen os then divest os which caused the boot loop. His first attempt was flashing it ontop of cherish os which is a mix of oneplus (oxygen) and lineage os 18. Do you have any advice as to what I should share with him? Thanks
@SkewedZeppelin

@Bradzilla117

That is disappointing to hear.
Did it reboot after the OnePlus or DivestOS logo?

Backtrace parts of logcats are attached

Looks like a buggy OpenGL implementation on your device:

F DEBUG   : pid: 6049, tid: 6105, name: RenderThread  >>> us.spotco.fennec_dos <<<
F DEBUG   : uid: 10094
F DEBUG   : signal 6 (SIGABRT), code -1 (SI_QUEUE), fault addr --------
F DEBUG   : Abort message: 'GL errors! frameworks/base/libs/hwui/pipeline/skia/SkiaOpenGLPipeline.cpp:127'
1 Like

If your installation via TWRP does not work, try Lineage-Recovery for fajita.

Also, the OnePlus 6T (fajita) has an A/B partition scheme. If this fact is not taken into account, a bootloop is the consequence. Therefore, my tip: Follow the installation instructions of the LineageOS Wiki.
Good luck!

Short version


adb reboot bootloader
fastboot devices
fastboot oem unlock
fastboot flash boot lineage-18.1-20210805-recovery-fajita.img
Pre-install instructions: adb sideload copy-partitions-20210323_1922.zip
adb sideload divested-18.1-20210807-dos-fajita.zip


After the installation DOS will probably be installed as here Divest-Recovery?

1 Like

microG

Maybe too opinionated of me, but I believe most users can get by without microG just fine if they gave it a try.

I know that microG services offer me more advantages than disadvantages. Besides, I trust Marvin Wissfeld, the developer of microG, who says:

However, all of microG’s services that require a connection to Google services are optional and can easily be disabled for those services that do not require a connection to Google. It is important to note that these server connections remain anonymous as long as you are not logged into a Google account with microG.

That’s why I like to recommend CustomROMs with microG services integrated into the system as well as CustomROMs that are ‘Signature Spoofing’ “ready” and where the microG NoGoolag Edition can also be installed. Security and privacy freaks continue to use GrapheneOS and DivestOS.

I am happy that microG exists and Marvin has many contributions over the years and is an absolute pillar of this community.
If microG works for you, use it.

I just feel like too many people immediately jump to it instead of trying to first live without it.

I wish I could find convincing arguments for whether Signature Spoofing really weakens security significantly or not. GrapheneOS used to have a negative paragraph on it:

“Our Play services app won’t have any special privileges or whitelisting in the OS like Play services or microG. There will be no support for bypassing arbitrary signature checks like the microG signature spoofing patch since it substantially compromises the OS security model and breaks other security features like verified boot. Instead, our app will be signed with a GrapheneOS Play services key and the only OS support for the app will be presenting the GrapheneOS Play services key as the Google Play services key.” Frequently Asked Questions | GrapheneOS

Now they don’t say anything about it.

I put high weight on LineageOS not supporting spoofing, since LineageOS is the basis for so many ROMs. If in doubt, better safe than sorry - no spoofing.

@anon46495926

The default signature spoofing patch lets any app request permission, however consider the following:

CalyxOS ships with a very strict version of signature spoofing that grants only the microG components the permission and only lets them spoof the Google signature.

DivestOS, if microG was enabled (it isn’t), restricts signature spoofing only to apps signed with the system key.
https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Patches/LineageOS-18.1/android_frameworks_base/0003-Harden_Sig_Spoofing.patch

Furthermore you can see here that /e/OS has not applied any additional restrictions on the permission.

1 Like

Does GPS work at all these days without microg?

1 Like

The gps should work even without microg (at least it works for me and I use lineageos without microg, sometimes it takes a while to find the position and usually you have to be outdoors).

4 Likes

microG has absolutely zero impact on GPS.
UnifiedNlp is a fused location provider for location lookups without GPS, to quickly get a rough location or for devices without GPS.

Like your weather app might need a location, but it doesn’t need GPS accuracy, it’ll query the system for last location which queries fused, which would query UnifiedNlp, which would query its enabled plugins such as DejaVu or Ichnaea.

In this case DivestOS includes UnifiedNlp, but not microG.

3 Likes

Okay, that’s good to know. Thanks for the feedback.

You’re wrong. On the one hand, I know that I’m a thorn in your side. On the other hand, I respect the assessment of the GOS specialist Daniel Micay. Other specialists have a different opinion. So everyone is free to form their own opinion and act accordingly.

1 Like

No. You’re wrong! :laughing: You’re not a thorn in my side.

The main difference is I will never intentionally put another Euro in Google’s pocket, so buying a Pixel is out of the question, and no one has yet offered me a free one with a dead battery. This eliminates CalyxOS and GrapheneOS, for me.

Here is a current statement by thestinger, a little more vague, but reading between the lines… And another by mar-v-in that convince me to stay with the GrapheneOS, LineageOS or DivestOS approach of avoiding spoofing and microG. As you say, YMMV.

thestinger:
“GrapheneOS is also hard at work on filling in gaps from not bundling Google apps and services into the OS. We aren’t against users using Google services but it doesn’t belong integrated into the OS in an invasive way. GrapheneOS won’t take the shortcut of simply bundling a very incomplete and poorly secured third party reimplementation of Google services into the OS. That wouldn’t ever be something users could rely upon. It will also always be chasing a moving target while offering poorer security than the real thing if the focus is on simply getting things working without great care for doing it robustly and securely.” Features overview | GrapheneOS

mar-v-in:
“Nothing is without costs. Using microG breaks many apps or makes them behave incorrectly. And I hope it’s clear to users that microG may have security issues that are not present in original Play services (and vice-versa). However I believe (and I guess the same is true for most microG users), that using an open-source and intentionally privacy-preserving implementation of the features provided by Play services is worth these costs. Your opinion may vary.” [Feature discussion] Alternative signature spoofing · Issue #1467 · microg/GmsCore · GitHub

@SkewedZeppelin:

CalyxOS ships with a very strict version of signature spoofing that grants only the microG components the permission and only lets them spoof the Google signature.

I appreciate in the above (somewhat embarassing) discussion at github, archived, what was said about sudo and apps. The less the better, on phones, IMHO.