<skatedown435:matrix.org> I urgently need Graphene OS to better secure my communications, so I bought a Pixel 3 Google edition and installed it. I activated a no-contract sim from myfamilymobile (which uses the T-Mobile network) with the phone prior to installing Graphene and successfully made a test call. After installing Graphene I was unable to connect to the cell network, and the phone acted like it didn't have a sim card.

<skatedown435:matrix.org>

<skatedown435:matrix.org> I had hot-swapped the sim with another phone and thought that I had blown out something, so I bought another Pixel 3 Google edition and got another "bring your own phone" sim, and tried again. I didn't activate this sim before installing Graphene, but did so online after. However, I get the same thing, no service. I swapped this sim into another phone and it works fine.

<skatedown435:matrix.org>

<skatedown435:matrix.org> Is there some issue with this carrier that prevents me from using Graphene OS? If so, can someone recommend a no-contract carrier that I can sign up with anonymously? Thanks.

<edsh:matrix.org> Phone calls are notorious insecure. Use something like Signal calls.

<skatedown435:matrix.org> I still need to connect to the cellular network to use data though. Is Graphene unable to connect to this network?

<yarikpm:matrix.org> Shouldnt be an issue with the OS

<yarikpm:matrix.org> have you checked if the device itself is compatible w the carrier?

<akc3n:grapheneos.org> yarikpm: he said that he was succesful with making a test call prior to installing GOS. (re: have you checked if the device itself is compatible w the carrier?)

<yarikpm:matrix.org> sorry, missed that bit

<akc3n:grapheneos.org> skatedown435: do you have another sim card you can try in the device that's not "a bring your own phone sim"

<strcat:grapheneos.org> skatedown435: sounds like you just need to configure it properly

<strcat:grapheneos.org> skatedown435: also strongly recommend against getting a Pixel 3 at this point

<strcat:grapheneos.org> if you can return those 2 phones for a refund you should

<strcat:grapheneos.org> grapheneos.org/faq#recommended-devices

<strcat:grapheneos.org> skatedown435: you know Pixel 3 end-of-life is at the end of this year?

<strcat:grapheneos.org> and they don't match the security of the current generation devices

<ccba:matrix.org> I just finished reading the whole FAQ a few times and I must say it really answered a lot of questions. Thx for whoever did this

<strcat:grapheneos.org> skatedown435: anyway sounds like you just need to do APN configuration

<high-q:matrix.org> I have a q about backups: Does each user need their own backup, or does the backup in the main/owner user include them?

<high-q:matrix.org> If each user needs their own backup (I think that is how this works) is there a way to copy the backup files between users automatically?

<akc3n:grapheneos.org> > <@high-q:matrix.org> I have a q about backups: Does each user need their own backup, or does the backup in the main/owner user include them?

<akc3n:grapheneos.org>

<akc3n:grapheneos.org> Yes, each profile needs to have backup toggled on. Initially you must explicitly enable backup toggle on in the owner profile. Then do so in secondary profiles as well.

<high-q:matrix.org> Do they all move the backup files to the owner profile, or do I need to connect each to the cloud?

<high-q:matrix.org> or whatever..

<strcat:grapheneos.org> they're separate, the backups don't move anywhere

<high-q:matrix.org> okie, thanks

<strcat:grapheneos.org> backups are basically just done to a storage provider

<strcat:grapheneos.org> can be external USB drive, can be profile's home directory, can be a sync app

<strcat:grapheneos.org> profiles are entirely separate for this and always will be

<strcat:grapheneos.org> each profile has their own encryption keys, if you boot up the device and log into owner the OS does not have the encryption keys available for other profiles

<strcat:grapheneos.org> it fundamentally cannot work to have owner back up other profiles

<high-q:matrix.org> But you cant log into the non-owner profiles without logging into owner first.

<high-q:matrix.org> so owner is always running.

<high-q:matrix.org> I guess that doesnt consider use cases that only use owner to unlock the phone.

<high-q:matrix.org> and dont install anything or do anything there.

<high-q:matrix.org> Okie, Thanks for humoring me :)

<akc3n:grapheneos.org> high-q: please read grapheneos.org/faq#encryption

<strcat:grapheneos.org> high-q: yeah because owner encrypts system data needed by other profiles to work

<strcat:grapheneos.org> system services essentially run as the owner user

<strcat:grapheneos.org> if they have sensitive data they need to avoid making it device encrypted and just use the default of it being protected by the profile's lock method

<hmenke:matrix.org> Is there any chance that [`/etc/sysconfig/google_experience.xml`](github.com/RattlesnakeOS/example-cu…11.0/prebuilt/google_experience.xml) would be included in GrapheneOS? This file restores compatibility with some Google applications.

<akc3n:grapheneos.org> > <@hmenke:matrix.org> Is there any chance that [`/etc/sysconfig/google_experience.xml`](github.com/RattlesnakeOS/example-cu…11.0/prebuilt/google_experience.xml) would be included in GrapheneOS? This file restores compatibility with some Google applications.

<akc3n:grapheneos.org>

<akc3n:grapheneos.org> grapheneos.org/faq#google-services

<hmenke:matrix.org> akc3n: No, this has nothing to do with Google Play Services.

<akc3n:grapheneos.org> > <@hmenke:matrix.org> akc3n: No, this has nothing to do with Google Play Services.

<akc3n:grapheneos.org>

<akc3n:grapheneos.org> Suggest you actually read that link for more details on our plans for filling in the gaps from not shipping Play services and Google apps.

<hmenke:matrix.org> akc3n: I'm happy to repeat that the presence of this file has nothing to do with Google Play Services.

<hmenke:matrix.org> There are however apps developed by Google that check the existence of this file or otherwise refuse to start.

<hmenke:matrix.org> Like Google Camera for example.

<hmenke:matrix.org> Google Camera worked on GrapheneOS with the help of github.com/lukaspieper/Gcam-Services-Provider (which again is *not* Google Play Services), but recently stopped working because now Google Camera checks for this system file.

<zanthed:eridan.me> everyone is aware of this. what he's trying to say is if you actually read the page, it's not required for baseline android compatibility

<akc3n:grapheneos.org> > <@hmenke:matrix.org> akc3n: I'm happy to repeat that the presence of this file has nothing to do with Google Play Services.

<akc3n:grapheneos.org>

<akc3n:grapheneos.org> I known and I'm happy to let you know that if you read the link you'd then learn about the baseline compatibility.

<zanthed:eridan.me> take this for example

<zanthed:eridan.me> > AOSP APIs not tied to Google but that are typically provided via Play services will continue to be implemented using open source providers like the Seedvault backup app.

<zanthed:eridan.me> google camera has an _open source_ replacement for it

<zanthed:eridan.me> take this for example

<zanthed:eridan.me> > AOSP APIs not tied to Google but that are typically provided via Play services will continue to be implemented using open source providers like the Seedvault backup app.

<zanthed:eridan.me>

<zanthed:eridan.me> google camera has an _open source_ replacement for it

<zanthed:eridan.me> getting things like gcam to work is solely up to the user. not the developers

<zanthed:eridan.me> there's a reason why GrapheneOS doesn't come with things like microG or enable signature spoofing. because it's not required for baseline compatibility

<hmenke:matrix.org> Eridan: In theory yes, but Google Camera requires the existence of `/etc/sysconfig/google_experience.xml` which cannot be placed by a user.

<sphinxcat:matrix.org> hmenke: GrapheneOS/os-issue-tracker #572 isn't closed so...

<akc3n:grapheneos.org> hmenke Apps, service providers, or protocols that don't come with GrapheneOS. Services such as mail, messaging, and cloud storage services, are outside of GrapheneOS control and are better suited for #offtopic:grapheneos.org

<strcat:grapheneos.org> hmenke: and also requires a special SELinux domain giving it hardware access unavailable to other apps

<strcat:grapheneos.org> which at this point we haven't removed but there's another issue about removing that

<strcat:grapheneos.org> also adding that file will not make it work without hacks anyway

<strcat:grapheneos.org> just tells it that it should be able to work but it can't really especially if that domain is removed

<hmenke:matrix.org> Interesting. For me it works by adding that file and using the Gcam Services Provider stub.

<strcat:grapheneos.org> only relevant to Pixels, only when using awful hacks to temporarily get it working and not to other types of devices we'll support so it's not particularly interesting

<strcat:grapheneos.org> hmenke: because as I said

<strcat:grapheneos.org> > and also requires a special SELinux domain giving it hardware access unavailable to other apps

<strcat:grapheneos.org> > which at this point we haven't removed but there's another issue about removing that

<curiousforever:privacytools.io> > <@strcat:grapheneos.org> only relevant to Pixels, only when using awful hacks to temporarily get it working and not to other types of devices we'll support so it's not particularly interesting

<curiousforever:privacytools.io>

<curiousforever:privacytools.io> Do you plan on supporting other devices?

<strcat:grapheneos.org> hmenke: you're relying on the fact that we haven't completed that other issue

<strcat:grapheneos.org> Demi Obenour: yes we make that clear in the docs

<strcat:grapheneos.org> Pixels are a stopgap until we have hardware partners which is in progress but will take years

<curiousforever:privacytools.io> > <@strcat:grapheneos.org> Demi Obenour: yes we make that clear in the docs

<curiousforever:privacytools.io>

<curiousforever:privacytools.io> Ah I misunderstood them. My understanding was that you plan on someday switching to GrapheneOS-specific hardware.

<strcat:matrix.org> not necessarily GrapheneOS-specific but that is made to satisfy the requirements

<strcat:grapheneos.org> not necessarily GrapheneOS-specific but that is made to satisfy the requirements

<strcat:grapheneos.org> using wrong tab since I was clearing up old room

<strcat:grapheneos.org> using wrong tab since I was clearing out old room

<sycamore:nitro.chat> Hi all! I am new to this channel. I don’t have a technical background and no one in my environment who really cares for digital privacy and stuff, which means I am more or less on my limited own regarding understanding all these things. Therefore, please bear with me if a not well informed thought escapes my keyboard! :)

<sycamore:nitro.chat>

<sycamore:nitro.chat> Just yesterday, I switched to GrapheneOS using a brand-new Pixel 4a. The WebUSB Installer worked flawlessly. It’s actually my first time ever using Android, so I feel like there are a lot of things I need to learn (e.g. appstores). First off I want to thank Daniel Micay and all the other developers and contributors for this flagship project when it comes to a FOSS privacy and security focused mobile OS.

<sycamore:nitro.chat> For now, though, I was wondering how to best deploy “profiles” aka Settings-System-MultipleUsers. Is there general advice on this? I understand that encryption keys are handled on a per-profile basis. I am also aware that apps are strongly sandboxed anyway so profiles are not needed to prevent apps from communicating with each other. What are sensible general use cases for profiles?

<sycamore:nitro.chat> I gathered that it might make sense to have privacy-invasive apps like e.g. WhatsApp (WA) in a separate profile and only input WA contacts into that profile’s contact app. That way, WA would not gain access to other non-WA contacts which would be stored in another profile’s contact app. Does this make sense?

<sycamore:nitro.chat> Also I was wondering whether it makes sense in general to not really install/use the owner profile but rather always use profiles? Kind of to prevent Owner from being compromised as I think that Owner has some privileges insofar as it is the “profile” for system apps/services. I’d be happy to hear your thoughts! :)

<wrengulf:matrix.org> Welcome Sycamore, I'm also relatively new to Graphene and have quickly grown to really like it. I have recently tried using profiles and had some issues with apps refusing to install if another copy already existed in the owner profile. Something to be aware of and to test. These were APKs

<wrengulf:matrix.org> Perhaps trying multiple users and not touching the owner one could mitigate this. Let me know if it does.

<sycamore:nitro.chat> > <@wrengulf:matrix.org> Welcome Sycamore, I'm also relatively new to Graphene and have quickly grown to really like it. I have recently tried using profiles and had some issues with apps refusing to install if another copy already existed in the owner profile. Something to be aware of and to test. These were APKs

<sycamore:nitro.chat>

<sycamore:nitro.chat> Hi Wrengulf, thanks for the hint! So far, I haven't planned to use multiple instances of the same app in different profiles, but it's good to keep your point in mind, thanks! I think I read in this channel that this scenario might work if the version number of the app instances is exactly the same? I am really not sure though!

<wrengulf:matrix.org> That makes sense. I might try to find an old version and give it a shot.

<Hulk:telegram> this is the opposite of what you need to do (re @GrapheneOSBridgeBot: <wrengulf:matrix.org> That makes sense. I might try to find an old version and give it a shot.)

<Hulk:telegram> Android profiles have the rollback protection, that is, you cannot install old versions of the apps

<Hulk:telegram> this is the reason why people have issues with installing F-Droid more than once, as F-Droid themselves only publish an outdated apk on their main website

<wrengulf:matrix.org> Thanks hulk, appreciate the info.

<wrengulf:matrix.org> So what do graphene users do with multiple profiles that they need duplicate apps for things like fdroid or their VPN app ?

<Hulk:telegram> this might be a outdated, but it answers your question github.com/Peter-Easton/GrapheneOS-….md#what-app-store-do-you-recommend

<wrengulf:matrix.org> I'll give it a read. Tks

<Hulk:telegram> welcome aboard sycamore!

<Hulk:telegram> i see that you did quite some background reading, very well 👍

<Hulk:telegram> i think this chat log might be helpful to answer some of your questions and misunderstandings gist.githubusercontent.com/Peter-Ea…/NSA%2520Social%2520&%2520AndroMail (re @GrapheneOSBridgeBot: <sycamore:nitro.chat> For now, though, I was wondering how to best deploy “profiles” aka Settings-System-MultipleUsers. Is there general

<sycamore:nitro.chat> Thank you Hulk! I read up on that and am now seeing how "so profiles are not needed to prevent apps from communicating with each other" is a misconception, thanks for clearing this up for me. From the example TheJollyRoger typed out I take away that profiles might be in a way to prevent Inter-Process Communication when app devs are secretly coalescing in order to exchange data.

<m0rtyr:matrix.org> I use GrapheneOS on my private device and I´m in love with it. Great work!

<m0rtyr:matrix.org> I had a discussion at work about GrapheneOS in a company enviroment. Most companies use MDM / EMM to manage and configure their mobile devices. In my understanding admins can configure the device in two ways – device owner mode and profile owner mode. For corporate owned devices, provisioning the devices through Android device owner mode will give the organization full control over the device.

<m0rtyr:matrix.org> On other Smartphones a device owner can only be assigned during the initial setup process of the devices after touching 6 or 7 times when the Logo after a reset appears. I tested it with my Google Pixel 4a 5G and GrapheneOS and failed.

<m0rtyr:matrix.org>

<m0rtyr:matrix.org> So here is my question:

<m0rtyr:matrix.org> Is it possible to activate the device owner mode for full controll over a MDM / EMM Solution on GrapheneOS?

<sycamore:nitro.chat> Thank you Hulk! I read up on that and am now seeing how "so profiles are not needed to prevent apps from communicating with each other" is a misconception, thanks for clearing this up for me. From the example TheJollyRoger typed out I take away that profiles might be a way to prevent Inter-Process Communication when app devs are secretly coalescing in order to exchange data.

<Hulk:telegram> yes, very good, i hope this helps answering your questions :) (re @GrapheneOSBridgeBot: <sycamore:nitro.chat> Thank you Hulk! I read up on that and am now seeing how "so profiles are not needed to prevent apps from communicating with each other" is a misconception, thanks for clearing this up for me. From the example TheJollyRoger typed out I take away that profiles might be a way to prevent Inter-Process Communication

<unannunciated:matrix.org> first post on matrix so bear with me :) Does any one here use Myki as a password manager on GrapheneOS ? Myki differs from all others in that their server infrastructure only relays encrypted creds, doesn't store them. The creds live on your phone. Myki is deep inside my workflow, but I'm also fed up with walking around with a device that I paid for but spies on me all the time. So hopefully I don't have to

<ghostsplintersix:matrix.org> > <@unannunciated:matrix.org> first post on matrix so bear with me :) Does any one here use Myki as a password manager on GrapheneOS ? Myki differs from all others in that their server infrastructure only relays encrypted creds, doesn't store them. The creds live on your phone. Myki is deep inside my workflow, but I'm also fed up with walking around with a device that I paid for but spies on me all the ti

<ghostsplintersix:matrix.org>

<ghostsplintersix:matrix.org> I would ask this in the Off-Topic room: #offtopic:grapheneos.org

<ghostsplintersix:matrix.org> > <@unannunciated:matrix.org> first post on matrix so bear with me :) Does any one here use Myki as a password manager on GrapheneOS ? Myki differs from all others in that their server infrastructure only relays encrypted creds, doesn't store them. The creds live on your phone. Myki is deep inside my workflow, but I'm also fed up with walking around with a device that I paid for but spies on me all the ti

<ghostsplintersix:matrix.org>

<ghostsplintersix:matrix.org> I would ask this in the Off-Topic room: #offtopic:grapheneos.org . This room is specifically for discussions and questions regarding the OS itself.

<southron:matrix.org> I was surprised when my 4a 5G got an update this morning. I was expecting it to take longer.

<tb14:librem.one> Is there a firewall option I'm missing? Zello worked on lineage but won't receive anything on graphene . sending appears to work and I see status but no messages come inbound

<sachinsmc:matrix.org> From MacBook I am not able to flash using web install

<sachinsmc:matrix.org>

<sachinsmc:matrix.org> Device keeps disconnecting

<sachinsmc:matrix.org> Does web install works with new MacBook?

<Hulk:telegram> it does work

<Hulk:telegram> are you phone and cable new or refurbished?

<xagki:matrix.org> If I have a brand new pixel phone (not even turned on for the first time), do I have to do anything before installing graphene? Do I have to sign in with a google account to download updates? Or can I can just go through the setup without signing in? Do I need to have internet on my phone or can I do everything offline?

<xagki:matrix.org> I mean by setup the initial setup of an android phone

<Hulk:telegram> please read this grapheneos.org/install/web#prerequisites (re @GrapheneOSBridgeBot: <xagki:matrix.org> If I have a brand new pixel phone (not even turned on for the first time), do I have to do anything before installing graphene? Do I have to sign in with a google account to download updates? Or can I can just go through the setup without signing in? Do I need to have internet on my phone or can I do everythin

<Hulk:telegram> you can use your pixel without logging into a Google account

<resist.berlin:matrix.org> It might not be possible to do allow OEM unlocking without an internet connection

<resist.berlin:matrix.org> It might not be possible to allow OEM unlocking without an internet connection

<xagki:matrix.org> It says in the guide "It's best practice to update the device before installing GrapheneOS to have the latest firmware for connecting the phone to the computer and performing the early flashing process."

<xagki:matrix.org>

<xagki:matrix.org> Do I need to sign in with a google account to update the device or is it possible without signing in?

<resist.berlin:matrix.org> That is definitely possible without signing in

<xagki:matrix.org> > <@resist.berlin:matrix.org> That is definitely possible without signing in

<xagki:matrix.org>

<xagki:matrix.org> OK, so I only have to be connected with the internet

<resist.berlin:matrix.org> Yes, because otherwise the OEM unlocking toggle will be greyed out

<xagki:matrix.org> > <@resist.berlin:matrix.org> Yes, because otherwise the OEM unlocking toggle will be greyed out

<xagki:matrix.org>

<xagki:matrix.org> OK, thank you very much!

<resist.berlin:matrix.org> xagki: please follow the official instructions carefully. Using the web installer is recommended unless you're well versed using the command line and you know exactly what you're doing

<xagki:matrix.org> > <@resist.berlin:matrix.org> xagki: please follow the official instructions carefully. Using the web installer is recommended unless you're well versed using the command line and you know exactly what you're doing

<xagki:matrix.org>

<xagki:matrix.org> Does the linux mint chromium version work for the web install?

<xagki:matrix.org> It says to avoid using the Ubuntu version

<xagki:matrix.org> But Mint is based on Ubuntu

<resist.berlin:matrix.org> > <@xagki:matrix.org> It says to avoid using the Ubuntu version

<resist.berlin:matrix.org>

<resist.berlin:matrix.org> I don't know for sure. Iirc Linux Mint is trying to avoid snap, so it might *not* have Ubuntu's broken Chromium. But that is just a guess.

<resist.berlin:matrix.org> You could give it a shot, but it is not among the official installation methods

<xagki:matrix.org> > <@resist.berlin:matrix.org> I don't know for sure. Iirc Linux Mint is trying to avoid snap, so it might *not* have Ubuntu's broken Chromium. But that is just a guess.

<xagki:matrix.org>

<xagki:matrix.org> Mint has its own chromium 😅

<resist.berlin:matrix.org> > <@xagki:matrix.org> Mint has its own chromium 😅

<resist.berlin:matrix.org>

<resist.berlin:matrix.org> That increases the chances of it working

<xagki:matrix.org> > <@resist.berlin:matrix.org> That increases the chances of it working

<xagki:matrix.org>

<xagki:matrix.org> What happens if it doesn't work, can I just try again? I'm afraid of bricking the phone

<resist.berlin:matrix.org> Bricking the phone using the web installer is almost impossible

<resist.berlin:matrix.org> Make sure the USB connection is stable & reliable

<xagki:matrix.org> > <@resist.berlin:matrix.org> Bricking the phone using the web installer is almost impossible

<xagki:matrix.org>

<xagki:matrix.org> I'm also in Germany, can you recommend any USB-C to USB-A cables sold in stores here? I was recommended Anker cables but I think I can't just buy those online

<xagki:matrix.org> > <@resist.berlin:matrix.org> Bricking the phone using the web installer is almost impossible

<xagki:matrix.org>

<xagki:matrix.org> I'm also in Germany, can you recommend any USB-C to USB-A cables sold in stores here? I was recommended Anker cables but I think I can only buy those online

<resist.berlin:matrix.org> > <@xagki:matrix.org> I'm also in Germany, can you recommend any USB-C to USB-A cables sold in stores here? I was recommended Anker cables but I think I can't just buy those online

<resist.berlin:matrix.org>

<resist.berlin:matrix.org> I'm using a vivanco cable. It has never not worked for me but of course I cannot guarantee it works for you. Your computer's USB port also has to be of decent quality

<resist.berlin:matrix.org> Don't go for super cheap cables

<xagki:matrix.org> And yes if the install doesn't work I can just try again with the web install?

<resist.berlin:matrix.org> > <@xagki:matrix.org> And yes if the install doesn't work I can just try again with the web install?

<resist.berlin:matrix.org>

<resist.berlin:matrix.org> Yes. Just try again

<resist.berlin:matrix.org> If it still doesn't work, change cable and/or port

<zanthed:eridan.me> > <@xagki:matrix.org> I'm also in Germany, can you recommend any USB-C to USB-A cables sold in stores here? I was recommended Anker cables but I think I can only buy those online

<zanthed:eridan.me>

<zanthed:eridan.me> Belkin is also a good one if you wanna see if you can try getting that

<xagki:matrix.org> > <@resist.berlin:matrix.org> Yes. Just try again

<xagki:matrix.org>

<xagki:matrix.org> OK, thank you for the advice. Are you like a store in Berlin or a person or group?

<xagki:matrix.org> > <@zanthed:eridan.me> Belkin is also a good one if you wanna see if you can try getting that

<xagki:matrix.org>

<xagki:matrix.org> Thanks!

<resist.berlin:matrix.org> > <@xagki:matrix.org> OK, thank you for the advice. Are you like a store in Berlin or a person or group?

<resist.berlin:matrix.org>

<resist.berlin:matrix.org> Send me a direct message please

<xagki:matrix.org> Ok

<nolanderthal:matrix.org> I read on the website that the pixel devices older than 4a aren’t recommended due to EOL issues. Exactly how long will the 4 XL be supported? Is this something that will be discontinued like..next month, or something closer to being next year?

<resist.berlin:matrix.org> > <@nolanderthal:matrix.org> I read on the website that the pixel devices older than 4a aren’t recommended due to EOL issues. Exactly how long will the 4 XL be supported? Is this something that will be discontinued like..next month, or something closer to being next year?

<resist.berlin:matrix.org>

<resist.berlin:matrix.org> support.google.com/pixelphone/answer/4457705

<resist.berlin:matrix.org> 4 XL is supported at least until October 2022

<nolanderthal:matrix.org> Hell yeah. Thank you for the quick response.

<foxtrek_64:matrix.org> I don't know what Samsung did with their gesture-based navigation but for some reason it's terrible and unresponsive.

<foxtrek_64:matrix.org> On my Pixel with Graphene though it works fine.

<foxtrek_64:matrix.org> On Samsung, you're half as liable to click something you didn't intend to before doing the gesture you wanted. I was trying to close youtube and I clicked on two different videos before my swipe gesture took as "go home"

<foxtrek_64:matrix.org> I can't wait to get properly moved over.

<dddddaniel:matrix.org> Hi, i wonder is there a way to see how big a update is ? Cant find that info on phone or on the website?

<Jeremy:telegram> Has anyone found an option to get gcam working on a pixel 4a 5g?

<zanthed:eridan.me> > <@dddddaniel:matrix.org> Hi, i wonder is there a way to see how big a update is ? Cant find that info on phone or on the website?

<zanthed:eridan.me>

<zanthed:eridan.me> grapheneos.org/releases

<zanthed:eridan.me> View the size of the ota_update zip

<zanthed:eridan.me> matrix.grapheneos.org/_matrix/media…/eridan.me/IzPTOXFcLoGDGwFEloCgSBDV

<resist.berlin:matrix.org> Incremental updates (what the phone installs on its own) are usually much smaller, sometimes just a few MB

<mrsenshi:matrix.org> I was just wondering, how do I make sure that alarms work after an OTA? When an update occurs, my device reboots, but my alarms are not in the admin profile, so I tend not to be alerted if that happens.

<strcat:grapheneos.org> MrSenshi: turn off auto-idle-reboot for updates if you don't want it

<strcat:grapheneos.org> it's not enabled by default

<strcat:grapheneos.org> or put the alarms in owner so they can work after reboot

<blackeyess:matrix.org> hello to use the web installer

<blackeyess:matrix.org> which USB option should i use tethering , file transfer

<strcat:grapheneos.org> neither

<strcat:grapheneos.org> please follow the instructions at grapheneos.org/install/web

<strcat:grapheneos.org> it explains everything

<strcat:grapheneos.org> don't do anything that's not there

<blackeyess:matrix.org> thanks found my mistake

<dddddaniel:matrix.org> > <@zanthed:eridan.me> sent an image.

<dddddaniel:matrix.org>

<dddddaniel:matrix.org> Okey so i have to try to download it to see the size, there is no other way because i dont want to download , my phone does this automaticlly but i just want to know how big the size is every time because of my carrier data

<zanthed:eridan.me> > <@resist.berlin:matrix.org> Incremental updates (what the phone installs on its own) are usually much smaller, sometimes just a few MB

<zanthed:eridan.me>

<zanthed:eridan.me> refer to this if you’re already on grapheneos

<sb13x:matrix.org> I suppose adding the option to update only on wifi would be a good thing? Can't see it in the options.

<strcat:grapheneos.org> dddddaniel: over-the-air updates do not download the full update unless you fell behind

<dddddaniel:matrix.org> Well if thats true the last update took fore ever , that stange if it s only few mb

<strcat:grapheneos.org> you were behind then

<strcat:grapheneos.org> or you're talking about installing rather than downloading

<dddddaniel:matrix.org> Yes i think so

<strcat:grapheneos.org> if you fall behind it will use drastically more bandwidth

<dddddaniel:matrix.org> The phone was off for few weeks

<floralshoppe:privacytools.io> so i have an app with local data that i do not need accessing the internet. the app does not start unless it has network permissions. My fix to this is to put my phone in airplane mode and 'allow' it network permissions and when im done with the app i revoke the permission and then turn airplane mode back off.

<floralshoppe:privacytools.io>

<floralshoppe:privacytools.io>

<floralshoppe:privacytools.io> my question is there a better way to use this app without giving it network permissions and putting my phone in airplane mode? (grapheneos)

<zanthed:eridan.me> definitely fell behind then

<dddddaniel:matrix.org> Okey understood

<zanthed:eridan.me> as long as you keep up to date, incremental updates are very small

<dddddaniel:matrix.org> Okey thank you for the quick responce

<strcat:grapheneos.org> ```

<strcat:grapheneos.org> -rw-r--r-- 1 root root 85M Jun 10 12:18 /srv/releases/blueline-incremental-2021.05.29.09-2021.06.09.13.zip

<strcat:grapheneos.org> -rw-r--r-- 1 root root 2.2M Jun 10 12:02 /srv/releases/blueline-incremental-2021.06.08.06-2021.06.09.13.zip

<strcat:grapheneos.org> -rw-r--r-- 1 root root 771M Jun 9 18:15 /srv/releases/blueline-ota_update-2021.06.09.13.zip

<strcat:grapheneos.org> -rw-r--r-- 1 root root 95M Jun 10 11:21 /srv/releases/bonito-incremental-2021.05.29.09-2021.06.09.13.zip

<strcat:grapheneos.org> -rw-r--r-- 1 root root 2.0M Jun 10 11:04 /srv/releases/bonito-incremental-2021.06.08.06-2021.06.09.13.zip

<strcat:grapheneos.org> -rw-r--r-- 1 root root 796M Jun 10 01:28 /srv/releases/bonito-ota_update-2021.06.09.13.zip

<strcat:grapheneos.org> -rw-r--r-- 1 root root 124M Jun 13 08:05 /srv/releases/bramble-incremental-2021.05.29.09-2021.06.09.13.zip

<strcat:grapheneos.org> -rw-r--r-- 1 root root 875M Jun 13 07:25 /srv/releases/bramble-ota_update-2021.06.09.13.zip

<strcat:grapheneos.org> -rw-r--r-- 1 root root 96M Jun 10 10:41 /srv/releases/coral-incremental-2021.05.29.09-2021.06.09.13.zip

<strcat:grapheneos.org> -rw-r--r-- 1 root root 2.0M Jun 10 10:22 /srv/releases/coral-incremental-2021.06.08.06-2021.06.09.13.zip

<strcat:grapheneos.org> -rw-r--r-- 1 root root 912M Jun 10 06:58 /srv/releases/coral-ota_update-2021.06.09.13.zip

<strcat:grapheneos.org> -rw-r--r-- 1 root root 86M Jun 10 11:59 /srv/releases/crosshatch-incremental-2021.05.29.09-2021.06.09.13.zip

<strcat:grapheneos.org> -rw-r--r-- 1 root root 2.0M Jun 10 11:43 /srv/releases/crosshatch-incremental-2021.06.08.06-2021.06.09.13.zip

<strcat:grapheneos.org> -rw-r--r-- 1 root root 771M Jun 9 15:38 /srv/releases/crosshatch-ota_update-2021.06.09.13.zip

<strcat:grapheneos.org> -rw-r--r-- 1 root root 96M Jun 10 11:02 /srv/releases/flame-incremental-2021.05.29.09-2021.06.09.13.zip

<strcat:grapheneos.org> -rw-r--r-- 1 root root 2.0M Jun 10 10:43 /srv/releases/flame-incremental-2021.06.08.06-2021.06.09.13.zip

<strcat:grapheneos.org> -rw-r--r-- 1 root root 912M Jun 10 10:05 /srv/releases/flame-ota_update-2021.06.09.13.zip

<strcat:grapheneos.org> -rw-r--r-- 1 root root 124M Jun 13 02:28 /srv/releases/redfin-incremental-2021.05.29.09-2021.06.09.13.zip

<strcat:grapheneos.org> -rw-r--r-- 1 root root 875M Jun 13 01:54 /srv/releases/redfin-ota_update-2021.06.09.13.zip

<strcat:grapheneos.org> -rw-r--r-- 1 root root 95M Jun 10 11:40 /srv/releases/sargo-incremental-2021.05.29.09-2021.06.09.13.zip

<strcat:grapheneos.org> -rw-r--r-- 1 root root 2.0M Jun 10 11:24 /srv/releases/sargo-incremental-2021.06.08.06-2021.06.09.13.zip

<strcat:grapheneos.org> -rw-r--r-- 1 root root 797M Jun 9 22:52 /srv/releases/sargo-ota_update-2021.06.09.13.zip

<strcat:grapheneos.org> -rw-r--r-- 1 root root 95M Jun 10 10:20 /srv/releases/sunfish-incremental-2021.05.29.09-2021.06.09.13.zip

<strcat:grapheneos.org> -rw-r--r-- 1 root root 2.0M Jun 10 10:01 /srv/releases/sunfish-incremental-2021.06.08.06-2021.06.09.13.zip

<strcat:grapheneos.org> -rw-r--r-- 1 root root 793M Jun 10 03:14 /srv/releases/sunfish-ota_update-2021.06.09.13.zip

<strcat:grapheneos.org> redfin/bramble didn't get 2021.06.08.06 due to issues that had to be resolved for the next release which is why there's no incremental for that

<strcat:grapheneos.org> also this is a Quarterly Platform Release, usually incrementals are much smaller than 90M

<dddddaniel:matrix.org> Oke those are very small indeed, i can update with mobile data than , because the last took foreever i wanted to only uodate by wifi but i fell behind for sure , so if i dont miss any uodates than updating with mobile data is not a problem thanks once again everyone

<malakoi:matrix.org> Can grapheneos get hacked through false update with bundled Malware, like Encrochat phone?

<strcat:grapheneos.org> please read grapheneos.org/releases#about-the-releases

<strcat:grapheneos.org> and grapheneos.org/usage#updates

<strcat:grapheneos.org> topic is well covered in the documentation, read that first

<strcat:grapheneos.org> >The update server isn't a trusted party since updates are signed and verified along with downgrade attacks being prevented. The update protocol doesn't send identifiable information to the update server and works well over a VPN / Tor. GrapheneOS isn't able to comply with a government order to build, sign and ship a malicious update to a specific user's device based on information like the IMEI, serial number,

<skatedown435:matrix.org> strcat: I posted yesterday regarding issues I was having trying to connect a pixel 3

<skatedown435:matrix.org> strcat: I posted yesterday regarding issues I was having trying to connect a pixel 3 to Family Mobile service, which uses the T-Mobile network. You suggested that I may need to edit the APN, and I think that you are right. I compared the pixel 3 APN info to the working phone I have, and the APN data is significantly different. I tried to create a new APN profile to use, copying the data from the working ph

<strcat:grapheneos.org> can you just use a carrier without these issues?

<skatedown435:matrix.org> I assume so, but won I run into these issues with another carrier? Also, I chose Family Mobile because they

<flyingduckall:telegram> Is face unlock functional on a pixel 4 xl?

<amyosx:telegram> It's proprietary

<skatedown435:matrix.org> I assume so, but won I run into these issues with another carrier? Also, I chose Family Mobile because they do no contract with no personally identifiable information.

<Hulk:telegram> yes, it works (re @flyingduckall: Is face unlock functional on a pixel 4 xl?)

<Hulk:telegram> it is part of AOSP

<amyosx:telegram> But it isn't 🤔

<Hulk:telegram> that's misinformation

<strcat:grapheneos.org> it works fine

<strcat:grapheneos.org> it's implemented by hardware like fingerprint unlock not the OS

<flyingduckall:telegram> Oh I can't wait to see that, just bought one for a friend, will install tonight (re @Hulk: it is part of AOSP)

<strcat:grapheneos.org> source.android.com/security/biometric/face-authentication

<strcat:telegram> It's not the same thing as the obsolete Play services face unlock feature which used to exist

<strcat:telegram> As part of the Play services smart lock

<strcat:telegram> It's a hardware feature similar to fingerprint unlock and it's not simply using a front camera...

<strcat:telegram> It's a 3D version of what fingerprint unlock does

<clannad:telegram> Retinal scan anyone?

<Hulk:telegram> sign me in (re @clannad: Retinal scan anyone?)

<Atlantistux:telegram> Hello

<Atlantistux:telegram> I have a problem when i restart my pixel with graphene

<flawedworld:matrix.org> > <@grapheneosbridge:grapheneos.org> <Atlantistux:telegram> I have a problem when i restart my pixel with graphene

<flawedworld:matrix.org>

<flawedworld:matrix.org> could you elaborate please?

<Atlantistux:telegram> i have a message saying the operating system is not genuine, is there any way to suppress this message?

<akc3n:grapheneos.org> > <@grapheneosbridge:grapheneos.org> <Atlantistux:telegram> i have a message saying the operating system is not genuine, is there any way to suppress this message?

<akc3n:grapheneos.org>

<akc3n:grapheneos.org> That's normal.

<strcat:matrix.org> please be clear what the message actually says

<strcat:grapheneos.org> please be clear about what the message actually says

<strcat:grapheneos.org> it's supposed to show a notice with a yellow symbol that you're booting an alternate OS

<Atlantistux:telegram> Yes (re @GrapheneOSBridgeBot: <strcat:grapheneos.org> it's supposed to show a notice with a yellow symbol that you're booting an alternate OS)

<Atlantistux:telegram> 👍

<strcat:grapheneos.org> if it shows an orange symbol saying the OS is not being verified and it cannot be checked that it's genuine you did not complete the install properly

<strcat:grapheneos.org> @Atlantistux please check this, you may not have completed the install and finishing it will require wiping your data

<Atlantistux:telegram> Its yellow symbol

<strcat:grapheneos.org> just make sure it says it's booting an alternate OS

<strcat:grapheneos.org> you can use Auditor to verify the install

<Atlantistux:telegram> Yellow warning

<akc3n:grapheneos.org> > <@grapheneosbridge:grapheneos.org> <Atlantistux:telegram> Yellow warning

<akc3n:grapheneos.org>

<akc3n:grapheneos.org> attestation.app/about

<Atlantistux:telegram> I can't use Auditor, i have no device compatible with (re @GrapheneOSBridgeBot: <strcat:grapheneos.org> you can use Auditor to verify the install)

<akc3n:grapheneos.org> > <@grapheneosbridge:grapheneos.org> <Atlantistux:telegram> Yellow warning

<akc3n:grapheneos.org>

<akc3n:grapheneos.org> source.android.com/security/verifiedboot/boot-flow

<akc3n:grapheneos.org> > <@grapheneosbridge:grapheneos.org> <Atlantistux:telegram> I can't use Auditor, i have no device compatible with (re @GrapheneOSBridgeBot: <strcat:grapheneos.org> you can use Auditor to verify the install)

<akc3n:grapheneos.org>

<akc3n:grapheneos.org> You can schedule remote

<strcat:grapheneos.org> @Atlantistux the Auditor side only needs to be any Android 8+ device, does not need to be a device supported for verification

<Atlantistux:telegram> it lengthens the boot time

<strcat:grapheneos.org> and there's the attestation.app service for remote verification

<akc3n:grapheneos.org> > <@grapheneosbridge:grapheneos.org> <Atlantistux:telegram> it lengthens the boot time

<akc3n:grapheneos.org>

<akc3n:grapheneos.org> attestation.app/tutorial#scheduled-remote-verification

<strcat:grapheneos.org> @Atlantistux you can skip the message by double tapping power if you really care

<strcat:grapheneos.org> it's supposed to show that

<strcat:grapheneos.org> > <@strcat:grapheneos.org> sent an image.

<strcat:grapheneos.org>

<strcat:grapheneos.org> this shows how it works

<Atlantistux:telegram> No way to change this message ? (re @GrapheneOSBridgeBot: <strcat:grapheneos.org> @Atlantistux you can skip the message by double tapping power if you really care)

<Atlantistux:telegram> So the message is normal ?

<strcat:grapheneos.org> it's supposed to be there

<Atlantistux:telegram> All users of GrapheneOS have this message ?

<strcat:grapheneos.org> if it's not there something is seriously wrong

<strcat:grapheneos.org> yes, it's supposed to be there

<strcat:grapheneos.org> look at the flow chart

<strcat:grapheneos.org> read what the message says

<strcat:grapheneos.org> a device built to run GrapheneOS as the stock OS would not have the message for the official releases but rather only other alternative OSes

<Atlantistux:telegram> Hm ok

<Atlantistux:telegram> it's stressful

<strcat:grapheneos.org> look at the flow chart

<Atlantistux:telegram> Flow chart ?

<flawedworld:matrix.org> ah the flow chart has not come thru on telegram

<akc3n:grapheneos.org> Flowchart @atlantistux

<akc3n:grapheneos.org> source.android.com/security/verifiedboot/boot-flow

<akc3n:grapheneos.org>

<akc3n:grapheneos.org> That's the link above I pasted that strcat is explaining to you about.

<Atlantistux:telegram> Oh ok

<Gabe:telegram> @Atlantistux :

<Atlantistux:telegram> ^^"

<strcat:grapheneos.org> reminder to join #community:grapheneos.org if you have a client like Element with Spaces support

<Atlantistux:telegram> I install (re @GrapheneOSBridgeBot: <strcat:grapheneos.org> reminder to join #community:grapheneos.org if you have a client like Element with Spaces support)

<Atlantistux:telegram> i will install it soon

<Atlantistux:telegram> thank you for the information

<strcat:grapheneos.org> was for the channel as a whole rather than you in particular fwiw

<Atlantistux:telegram> I have the second image of the link : source.android.com/security/verifiedboot/boot-flow

<Atlantistux:telegram> After flow chart

<strcat:grapheneos.org> yes that's what you're supposed to have

<strcat:grapheneos.org> when using a non-stock OS with verified boot enabled / bootloader locked

<blackeyess:matrix.org> just want to say thank you i just finished the flash

<Atlantistux:telegram> But the boot is verified, no ??

<strcat:grapheneos.org> yes, as it says, verified boot is enabled

<Atlantistux:telegram> And bootloader is relocked

<strcat:grapheneos.org> yes, that's why you get that screen

<strcat:grapheneos.org> it's telling you that it's verified

<blackeyess:matrix.org> and i found a lot changed

<Atlantistux:telegram> I also have a problem with the updates, it seems not to work, because when I click on "check for updates", it rolls back, it looks like a bug

<strcat:grapheneos.org> don't know what you mean by "it rolls back"

<sycamore:nitro.chat> Hi all, just wanted to reiterate something I'm still not sure about. Earlier today, Hulk cleared up a misconception I had about using profiles. However, I am still not sure what a good approach is to use profiles. Is it recommendable to not really install/use Owner at all but rather always use profiles? And does it make sense to have privacy-invasive apps like e.g. WhatsApp (WA) in a separate profile and only in

<strcat:grapheneos.org> it's fine to use the owner profile

<Atlantistux:telegram> he returns to the menu before (re @GrapheneOSBridgeBot: <strcat:grapheneos.org> don't know what you mean by "it rolls back")

<strcat:grapheneos.org> nothing dangerous about it

<strcat:grapheneos.org> @Atlantistux it's not supposed to go to another menu

<strcat:grapheneos.org> @Atlantistux not clear what you are confused about

<strcat:grapheneos.org> you can check which version you're running in Settings -> About phone

<Atlantistux:telegram> Hmm, it's complicated to explain

<strcat:grapheneos.org> check for updates does what it says: schedules an update check as soon as conditions for it are satisfied (the ones you choose below)

<Atlantistux:telegram> Yes, but the updates don't work (re @GrapheneOSBridgeBot: <strcat:grapheneos.org> you can check which version you're running in Settings -> About phone)

<strcat:grapheneos.org> what about it doesn't work? you aren't clear

<strcat:grapheneos.org> it's not currently supposed to show anything it just does an update check

<strcat:grapheneos.org> check what version you're currently on

<strcat:grapheneos.org> take a screen of Build number at the bottom of About phone

<strcat:grapheneos.org> take a screenshot of Build number at the bottom of About phone

<strcat:grapheneos.org> profiles are separate workspaces with their own instances of apps and data, that's it

<strcat:grapheneos.org> with shared data across them

<strcat:grapheneos.org> with no shared data across them

<strcat:grapheneos.org> you can use them as you see fit

<Atlantistux:telegram> nothing happens, and returns to the menu, in system, advanced, it returns to system (re @GrapheneOSBridgeBot: <strcat:grapheneos.org> what about it doesn't work? you aren't clear)

<strcat:grapheneos.org> @Atlantistux please check Build number at the bottom of About phone

<strcat:grapheneos.org> take a screenshot of it

<strcat:grapheneos.org> no further help can be provided until you do that

<strcat:grapheneos.org> it's not clear what you're describing

<strcat:grapheneos.org> if you don't have enough free space it won't be able to update

<Atlantistux:telegram> RQ3A.210605.005.2021.06.09.13

<Atlantistux:telegram> I don't have the latest update for Vanadium

<sycamore:nitro.chat> > <@strcat:grapheneos.org> profiles are separate workspaces with their own instances of apps and data, that's it

<sycamore:nitro.chat>

<sycamore:nitro.chat> Ok thanks! So there can be privacy advantages I guess, right? For example, when putting WhatsApp (WA) in a separate profile which only has WA-contacts in its contact app, WA cannot gain access to other non-WA contacts which would be stored in another profile’s contact app! This is nice towards all non-WA contacts since their details are not scraped by WA.

<strcat:grapheneos.org> an app can't gain access to contacts unless you authorize it

<strcat:grapheneos.org> if the app cannot work without having access to the profile's contacts, then yeah, using it in another profile is useful

<strcat:grapheneos.org> you can make a profile specific to the app if you want

<sycamore:nitro.chat> Thanks so much for the confirmation strcat! :) I sadly come from years of iPhone usage and never had Android exposure before, so many things to catch up on.

<ghostsplintersix:matrix.org> Welcome to the family 😎

<sycamore:nitro.chat> Another thing important to me is to express my gratitude to you, strcat, and all the other developers and contributors for this flagship project when it comes to a FOSS privacy and security focused mobile OS! Thank you!

<Atlantistux:telegram> Yess, the best Android rom ^^

<strcat:grapheneos.org> it's an OS not a ROM

<Atlantistux:telegram> Yes, an AOSP rom

<nat:nekopon.pl> android open source project read only memory

<sycamore:nitro.chat> Really confused still about how to get apps. JollyRoger's GitHub recommends not using FDroid - the GrapheneOS community wiki does mention FDroid as a way to get apps though. How are people doing it here? So far I planned to use FDroid for FOSS apps with decent reputation (e.g., Nextcloud), and Aurora for non-FOSS apps like Whatsapp. Not sure about apks for e.g. Signal or Briar or whether it's somehow better to ge

<Atlantistux:telegram> Briar support only text message

<Atlantistux:telegram> so what does Jolly recommend, because apart from f-droid, I don't see what we could use as another application (re @GrapheneOSBridgeBot: <sycamore:nitro.chat> Really confused still about how to get apps. JollyRoger's GitHub recommends not using FDroid - the GrapheneOS community wiki does mention FDroid as a way to get apps though. How are people doing it here? So far I planned to use FDroid for FOSS apps with de

<akc3n:grapheneos.org> > <@grapheneosbridge:grapheneos.org> <Atlantistux:telegram> Briar support only text message

<akc3n:grapheneos.org>

<akc3n:grapheneos.org> #offtopic:grapheneos.org is better suited for app discussion

<strcat:grapheneos.org> @Atlantistux it's not a ROM, the only ROMs are the boot ROMs on different components, i.e. read-only firmware built into them used to bootstrap code that can be updated

<strcat:grapheneos.org> by definition we cannot ship ROMs as part of the OS since they can't be written/updated

<Atlantistux:telegram> Signal is more friendly, but less secure

<sycamore:nitro.chat> > <@grapheneosbridge:grapheneos.org> <Atlantistux:telegram> so what does Jolly recommend, because apart from f-droid, I don't see what we could use as another application (re @GrapheneOSBridgeBot: <sycamore:nitro.chat> Really confused still about how to get apps. JollyRoger's GitHub recommends not using FDroid - the GrapheneOS community wiki does mention FDroid as a way to get apps though. How are people doing it

<sycamore:nitro.chat>

<sycamore:nitro.chat> To be clear, this is what I mean: github.com/Peter-Easton/GrapheneOS-….md#what-app-store-do-you-recommend

<strcat:grapheneos.org> all firmware that can be updated (the vast majority of it) is updated by GrapheneOS

<nat:nekopon.pl> sycamore: reread that again

<strcat:grapheneos.org> don't really understand why people misuse that term and it's confusing/misleading

<nat:nekopon.pl> You can avoid unmaintained apps manually

<strcat:grapheneos.org> you can use a mix of self-updating apps from their authors like Signal website apk, Aurora Store, F-Droid, etc.

<nat:nekopon.pl> And when it comes to updates on f-droid there is usually wave of updates every 1-2 weeks

<nat:nekopon.pl> ofc unmaintained apps don't get rebuilt

<sycamore:nitro.chat> Right, thanks! This sounds a bit like it depends really on the specific app and its developers and not so much on the way one gets the app?

<nat:nekopon.pl> Also in few rare cases targeting older api is required for app to work as people are used to

<nat:nekopon.pl> For example Termux which would be very annoying to use if they updated api

<sycamore:nitro.chat> > <@strcat:grapheneos.org> you can use a mix of self-updating apps from their authors like Signal website apk, Aurora Store, F-Droid, etc.

<sycamore:nitro.chat>

<sycamore:nitro.chat> Is there a principled way to determine whether an apk will be self-updating?

<strcat:grapheneos.org> don't know what you mean by that

<strcat:grapheneos.org> they probably say if it is

<strcat:grapheneos.org> if not you will quickly find out if they tell you about new releases

<nat:nekopon.pl> If app is actively maintained then f-droid has updates every 1-2 weeks as I said before

<nat:nekopon.pl> On aurora store it depends on developers that publish their app on google play

<strcat:grapheneos.org> in Android 12 you'll be able to authorize them to update themselves automatically (with the usual key pinning + downgrade protection the OS package manager always provides)

<sycamore:nitro.chat> > <@strcat:grapheneos.org> if not you will quickly find out if they tell you about new releases

<sycamore:nitro.chat>

<sycamore:nitro.chat> Ah right, I see, thanks!

<sycamore:nitro.chat> Is it possible for an Android app to not notify the user when there is an update and to also not being self-updating? As in that the user has to check or even reinstall a new version?

<nat:nekopon.pl> On a11 you have to manually accept updates

<nat:nekopon.pl> On a12 you will be able to give apps permission to update without manual action

<strcat:grapheneos.org> sycamore: don't know what you mean

<strcat:grapheneos.org> if course it's possible for an app to not check for updates to itself, it's code they have to implement

<strcat:grapheneos.org> currently, it's not possible for apps to do unattended upgrades unless a highly dangerous unattended installation permission is baked into the OS for them which is what the privileged extensions do for F-Droid / Aurora Store

<strcat:grapheneos.org> which causes a severe, negative security impact

<strcat:grapheneos.org> in Android 12, as I said above, there's a way to grant apps the ability to do unattended upgrades without the negative security impact of those privileged permissions which have to be baked into the OS for specific apps

<strcat:grapheneos.org> because it does not allow them to do unattended installs, only upgrades, which like any other app upgrade have key pinning + downgrade protection for app version and API level

<zanthed:eridan.me> > <@sycamore:nitro.chat> Is it possible for an Android app to not notify the user when there is an update and to also not being self-updating? As in that the user has to check or even reinstall a new version?

<zanthed:eridan.me>

<zanthed:eridan.me> for alerting if there's an update, that's up to the app itself to implement that without utilizing any google play services of any kind.

<zanthed:eridan.me> unattended updates, read what strcat said.

<strcat:grapheneos.org> of course it's possible for an app to not check for updates to itself, it's code they have to implement

<sycamore:nitro.chat> > <@strcat:grapheneos.org> of course it's possible for an app to not check for updates to itself, it's code they have to implement

<sycamore:nitro.chat>

<sycamore:nitro.chat> Ha yeah thanks! I guess coming from an Apple-only life one is quite used of having everything managed for oneself, as in e.g. always being alerted to upgrades and the like!

<strcat:grapheneos.org> sycamore: you're welcome to install apps from an app store

<strcat:grapheneos.org> as mentioned above

<strcat:grapheneos.org> why are you installing apps without their own automatic upgrades via an apk?

<sycamore:nitro.chat> > <@sycamore:nitro.chat> Ha yeah thanks! I guess coming from an Apple-only life one is quite used of having everything managed for oneself, as in e.g. always being alerted to upgrades and the like!

<sycamore:nitro.chat>

<sycamore:nitro.chat> I don't want to insinuate that being a good thing.

<strcat:grapheneos.org> suggest just dropping the topic because it's bordering on misinformation / FUD now

<sycamore:nitro.chat> I am confused why my message got deleted?

<sycamore:nitro.chat> > <@strcat:grapheneos.org> why are you installing apps without their own automatic upgrades via an apk?

<sycamore:nitro.chat>

<sycamore:nitro.chat> No I am not, haven't installed anything yet, wanted to understand a bit better beforehand :)

<strcat:grapheneos.org> if you install apps from an app store you'll get notified by that app of upgrades assuming it supports that

<strcat:grapheneos.org> there is no reason you have to manually install and keep track of update availability for apps

<strcat:grapheneos.org> unless you just want to make your life harder for some reason

<sycamore:nitro.chat> > <@strcat:grapheneos.org> suggest just dropping the topic because it's bordering on misinformation / FUD now

<sycamore:nitro.chat>

<sycamore:nitro.chat> I think I seem to have misworded what I wanted to express, which is just where I was coming from / my limited working model of how things could work :)

<strcat:grapheneos.org> there is no reason you have to manually keep track of update availability for apps

<superstig124:matrix.org> I think you worded it fine imo.

<superstig124:matrix.org> This room isn't always friendly to newcomers.

<sycamore:nitro.chat> That I don't know. Maybe some implicit rule I was unaware of.

<strcat:grapheneos.org> please stop

<strcat:grapheneos.org> i.e. don't engage with trolls

<sycamore:nitro.chat> Oh sorry, I didn't know he is a known troll!

<dddddaniel:matrix.org> Just to jump in this uodate discussion, when i installed signal from their website, self updating apk, in 1 month i did not get 1 update, but my other phone what is using aurora store got 2 uodates that months

<dddddaniel:matrix.org> So is it better to uodate from aurora/f droid instead of downloading self updating apps

<dddddaniel:matrix.org> Because in my experience aurora/f droid have more updates

<dddddaniel:matrix.org> Have 2 say this experience is based on 1 app, only signal so dont know if this is with every app

<strcat:grapheneos.org> dddddaniel: that's specific to Signal not something in general

<dddddaniel:matrix.org> Is there a differents in terms of security between using an store of an self updating app?

<strcat:grapheneos.org> yes, you're trusting an additional party, the app store, unless they simply ship it signed with the developer's key (in which case you're only trusting them for the initial install)

<nat:nekopon.pl> I didn't know that signal can selfupdate without google play store

<strcat:grapheneos.org> nat: they have a website apk which is only different via inclusion of the update check code

<nat:nekopon.pl> I think they're both signed with same keys too

<nat:nekopon.pl> So its possible to update apk from website with for example aurora store

<dddddaniel:matrix.org> So its better to use website self updating apk if i understand you correct?

<strcat:grapheneos.org> it's your choice

<nat:nekopon.pl> In case of signal it doesn't matter because both play store and apk from their website are signed with same keys

<strcat:grapheneos.org> Signal doesn't update their website apk at the same rate, for unclear reasons

<dddddaniel:matrix.org> I know a while ago in the channel there is a possibility that grapheneos wil have a own app store

<dddddaniel:matrix.org> Hope that wil be soon i trust that for sure

<strcat:grapheneos.org> Signal is somewhat hostile towards not using Play Store / Play services and only reluctantly supports it

<strcat:grapheneos.org> dddddaniel: we will have our own app install/update system on top of the OS package manager based on a first party app repository, with far more robust/secure updates than what other app stores provide

<strcat:grapheneos.org> and proper delta updates like we have for OS updates

<nat:nekopon.pl> If you got your friends on signal, then maybe you will be able to migrate them to Matrix too :)

<dddddaniel:matrix.org> Is that store going to come anytime soon? Or is that still a long term project

<strcat:grapheneos.org> it's a priority

<strcat:grapheneos.org> we haven't found a good developer to fund to work on it yet

<strcat:grapheneos.org> another priority is memory tagging support for hardened_malloc for ARMv8.5 / ARMv9

<dddddaniel:matrix.org> And to get back aboit signal, i was reading this also

<dddddaniel:matrix.org> dt.gl/signal-hasnt-updated-their-se…ost-a-year-how-worried-should-we-be

<dddddaniel:matrix.org> I know they now included the code but it took pretty long

<strcat:grapheneos.org> they ended up publishing it again recently

<strcat:grapheneos.org> but what they publish is not complete, it's missing their Intel SGX code and other things

<sphinxcat:matrix.org> > <@strcat:grapheneos.org> we haven't found a good developer to fund to work on it yet

<sphinxcat:matrix.org>

<sphinxcat:matrix.org> isn't inthewaves working on it?

<strcat:grapheneos.org> it may be enough to host a Signal server but it isn't complete

<strcat:grapheneos.org> sphinx: I don't think they have time to be very active atm

<strcat:grapheneos.org> sphinx: so not really

<dddddaniel:matrix.org> So signal is not fully opensource amymore?

<strcat:grapheneos.org> the server has not been fully open source for a long time

<strcat:grapheneos.org> it was only partially open source with delayed releases of source + missing things

<strcat:grapheneos.org> and then they went a whole year without publishing any of the sources

<strcat:grapheneos.org> Signal is a proprietary service with an open source app like Telegram

<strcat:grapheneos.org> semi-open-source server code, unlike Telegram

<strcat:grapheneos.org> but still

<dddddaniel:matrix.org> I tought signal was the gold standard

<strcat:grapheneos.org> doesn't really change anything

<strcat:grapheneos.org> about privacy or security

<dddddaniel:matrix.org> Can we still trust signal in your opinion?

<strcat:grapheneos.org> dddddaniel: open source server code wouldn't make it any more private/secure

<strcat:grapheneos.org> dddddaniel: fully open source server code wouldn't make it any more private/secure

<dddddaniel:matrix.org> I mean is it still safe to use the app

<strcat:grapheneos.org> you don't know what a server is actually running anyway

<strcat:grapheneos.org> dddddaniel: this doesn't impact privacy, security or safety of the app in any way

<dddddaniel:matrix.org> Okeyy understood

<zanthed:eridan.me> molly.im exists if you want a more safer client app. server-wise it's kinda speculation

<zanthed:eridan.me> molly.im exists if you want a more paranoid client app. server-wise it's kinda speculation

<dddddaniel:matrix.org> Sorry for going little bit off topic in here

<strcat:grapheneos.org> there's no guarantee/proof that when server code is published that's what is actually run on the server, and regardless, it being published doesn't make it safer / more private / more secure

<dddddaniel:matrix.org> I am already using molly but it s the same as signal only a few small adjustments tight?

<strcat:grapheneos.org> yes it's off-topic and should probably be moved to #offtopic:grapheneos.org

<anon24322:matrix.org> Hello, for someone who has just flashed Grapheneos which parameter do you advise not to touch ?

<strcat:grapheneos.org> turn off dev options after disabling OEM unlocking as recommended in the post installation section in the install guides

<strcat:grapheneos.org> and don't mess with the base OS components (system apps), i.e. non-user-facing components that are part of the OS

<strcat:grapheneos.org> can't really give you a bunch of advice based on such a vague / general question

<anon24322:matrix.org> I'm the kind of person who changes the system and application settings when I get a new phone and I'd like to know if there are things I shouldn't touch, like what you mentioned or like the browser settings so as not to change the fingerprint

<strcat:grapheneos.org> it's too broad / vague

<strcat:grapheneos.org> the defaults are largely very good already

<zanthed:eridan.me> do not touch any developer options except for disabling OEM unlocking

<zanthed:eridan.me> they're hidden for a reason

<anon24322:matrix.org> Okay, I thank you for your answer, I will try to touch as little as possible

<anon24322:matrix.org>

<anon24322:matrix.org> And sorry for my bad English I use a translator

<vowags78:matrix.org> in what cases would it be good to disable the sensors permission for an app?

<mrsenshi:matrix.org> Hmm, am I being pinged? Could have sworn there was a mention...

<strcat:grapheneos.org> MrSenshi: you aren't

<strcat:grapheneos.org> MrSenshi: unless you mean in the legacy rooms, where people are being told to migrate here and leave those

<strcat:grapheneos.org> you aren't in either of those so that's not it

<mrsenshi:matrix.org> Oh well, must be FluffyChat weirdness again

<strcat:grapheneos.org> MrSenshi: maybe you have words set to highlight you?

<strcat:grapheneos.org> don't know

<strcat:grapheneos.org> seems odd