6 ms·

This is a step in the right direction for security/privacy, and I appreciate the effort, but ultimately you have no real control over your device if you are for

This is a step in the right direction for security/privacy, and I appreciate the effort, but ultimately you have no real control over your device if you are forced to use the proprietary OS that came with the phone. (Unfortunately this is the case with most Android phones, aside from the Google Pixel series, which allow custom versions of Android, like open-source GrapheneOS, to be installed.) Fortunately, as of now, it seems most Android OEMs allow you to disable their bloatware with adb, but there's no reason they have to allow this, and they could easily block it with a software update.

JoeyBananas 5y ago
> Unfortunately this is the case with most Android phones, aside from the Google Pixel series, which allow custom versions of Android, like open-source GrapheneOS, to be installed. In my experience, what's important is not the manufacturer of the phone, but whether or not the phone was bought from the carrier or the original manufacturer. If you buy a Pixel directly from Google, then the bootloader will be unlocked allowing you to install a different OS. If you buy the phone from a carrier like Verizon or At&t, the bootloader will be locked and it will be impossible to install a different OS.
hagbard_c 5y ago
There are far more Android phones which support AOSP-derived distributions. Have a look at the support list for e.g. LineageOS [1], it shows 27 brands with 195 models in total. [1] https://download.lineageos.org/ https://download.lineageos.org/
- NotPractical 5y ago
  Most of these devices don't "support" LineageOS though; rather, LineageOS supports them. As in, they are not designed to support custom OSes, but people make it work anyway through bootloader unlock exploits and other weird hacks, which may introduce security issues. Using hacks to install a custom open-source OS might be better than sticking with the proprietary one it came with, but ideally your device would natively support custom OSes.
  - hagbard_c 5y ago
    This is not true for many, if not most of the devices on that list. You may have to jump through some hoops to unlock the bootloader but once that is done installing alternative distributions is no more difficult than installing a vendor distribution. Have a look at the installation instructions (click on a model and follow the 'Installation instructions' link in the header) to see how things are done for that model.
    - NotPractical 5y ago
      That may be true, but most of the devices on that list are either old or not devices people actually want to use. Apple, Samsung, Lenovo (Motorola), and LG combined make up 94% of the market share in the US, while others make up only 6% [1]. Of these, only Motorola seems to allow bootloader unlocking. Samsung locks bootloaders on all US smartphones (though international versions reportedly aren't locked) and uses proprietary "download mode" instead of fastboot mode. [1] https://www.counterpointresearch.com/us-market-smartphone-share/ https://www.counterpointresearch.com/us-market-smartphone-sh...
      - hagbard_c 5y ago
        Going down the list: - Apple: next... - Samsung: supports unlocking the bootloader (enable developer options, enable OEM unlock, boot into download mode and follow the on-screen instructions for "Unlock Bootloader") - LG: supports unlocking the bootloader (see http://developer.lge.com/resource/mobile/RetrieveBootloader.dev http://developer.lge.com/resource/mobile/RetrieveBootloader....) - Lenovo: supports unlocking the bootloader (see https://www.zui.com/iunlock https://www.zui.com/iunlock) - Motorola: supports unlocking the bootloader (see http://motorola-global-portal.custhelp.com/app/standalone/bootloader/unlock-your-device-a http://motorola-global-portal.custhelp.com/app/standalone/bo...) In other words, all devices in your list support unlocking the bootloader. I've used devices from many different manufacturers from around 2010 onwards, none of them run vendor distributions. It used to be difficult to install new distributions but this has not been the case for more recent devices. I'm in Europe but often source devices from elsewhere since they are not 'officially' sold here.
ignoramous 5y ago
> disable their bloatware with adb, but there's no reason they have to allow this There's a reason. It is Google and its Compatibility Definition Document: https://source.android.com/compatibility/ https://source.android.com/compatibility/ So no: OEMs that want to market their phones as running "Android" cannot break things as they please.
- NotPractical 5y ago
  Can you please link to somewhere it says that OEMs can't prevent adb from disabling system apps? They obviously can't disable adb entirely (because it's useful to Android developers), but they can probably add restrictions on top of it.
  - ignoramous 5y ago
    (disclosure: I co-develop apps in the android sec/privacy space) Every device branded as running "Android" must pass Google's Compatibility Test Suite (CTS) [0]. One look at the tests suggest that many of the adb commands Universal Android Debloater (UAD) [1] relies on are infact part of CTS: - pm uninstall: https://cs.android.com/android/platform/superproject/+/master:cts/tests/tests/content/src/android/content/pm/cts/PackageManagerTest.java;drc=e2f88805cab390f89c1805e35ed2ba5f444430b7;l=1465 https://cs.android.com/android/platform/superproject/+/maste... - pm clear: https://cs.android.com/android/platform/superproject/+/master:cts/tests/tests/role/src/android/app/role/cts/RoleManagerTest.java;drc=512939f36d4b60f6ef3f2ebfd22d3d77fd712417;l=408 https://cs.android.com/android/platform/superproject/+/maste... - am force-stop: https://cs.android.com/android/platform/superproject/+/master:cts/tests/tests/os/src/android/os/cts/AutoRevokeTest.kt;drc=4ebe4f93bd823ef7b56747937d639c38dc8b75fc;l=407 https://cs.android.com/android/platform/superproject/+/maste... and so on... [0] https://source.android.com/compatibility/cts https://source.android.com/compatibility/cts [1] adb commands used by UAD: https://github.com/0x192/universal-android-debloater/blob/28647f38cbf9497af60a4d31eb0c230aeeae294d/src/core/sync.rs#L119-L229 https://github.com/0x192/universal-android-debloater/blob/28...
    - kiallmacinnes 5y ago

JoeyBananas 5y ago

> Unfortunately this is the case with most Android phones, aside from the Google Pixel series, which allow custom versions of Android, like open-source GrapheneOS, to be installed. In my experience, what's important is not the manufacturer of the phone, but whether or not the phone was bought from the carrier or the original manufacturer. If you buy a Pixel directly from Google, then the bootloader will be unlocked allowing you to install a different OS. If you buy the phone from a carrier like Verizon or At&t, the bootloader will be locked and it will be impossible to install a different OS.

hagbard_c 5y ago

There are far more Android phones which support AOSP-derived distributions. Have a look at the support list for e.g. LineageOS [1], it shows 27 brands with 195 models in total. [1] https://download.lineageos.org/ https://download.lineageos.org/

NotPractical 5y ago
Most of these devices don't "support" LineageOS though; rather, LineageOS supports them. As in, they are not designed to support custom OSes, but people make it work anyway through bootloader unlock exploits and other weird hacks, which may introduce security issues. Using hacks to install a custom open-source OS might be better than sticking with the proprietary one it came with, but ideally your device would natively support custom OSes.
- hagbard_c 5y ago
  This is not true for many, if not most of the devices on that list. You may have to jump through some hoops to unlock the bootloader but once that is done installing alternative distributions is no more difficult than installing a vendor distribution. Have a look at the installation instructions (click on a model and follow the 'Installation instructions' link in the header) to see how things are done for that model.
  - NotPractical 5y ago
    That may be true, but most of the devices on that list are either old or not devices people actually want to use. Apple, Samsung, Lenovo (Motorola), and LG combined make up 94% of the market share in the US, while others make up only 6% [1]. Of these, only Motorola seems to allow bootloader unlocking. Samsung locks bootloaders on all US smartphones (though international versions reportedly aren't locked) and uses proprietary "download mode" instead of fastboot mode. [1] https://www.counterpointresearch.com/us-market-smartphone-share/ https://www.counterpointresearch.com/us-market-smartphone-sh...
    - hagbard_c 5y ago
      Going down the list: - Apple: next... - Samsung: supports unlocking the bootloader (enable developer options, enable OEM unlock, boot into download mode and follow the on-screen instructions for "Unlock Bootloader") - LG: supports unlocking the bootloader (see http://developer.lge.com/resource/mobile/RetrieveBootloader.dev http://developer.lge.com/resource/mobile/RetrieveBootloader....) - Lenovo: supports unlocking the bootloader (see https://www.zui.com/iunlock https://www.zui.com/iunlock) - Motorola: supports unlocking the bootloader (see http://motorola-global-portal.custhelp.com/app/standalone/bootloader/unlock-your-device-a http://motorola-global-portal.custhelp.com/app/standalone/bo...) In other words, all devices in your list support unlocking the bootloader. I've used devices from many different manufacturers from around 2010 onwards, none of them run vendor distributions. It used to be difficult to install new distributions but this has not been the case for more recent devices. I'm in Europe but often source devices from elsewhere since they are not 'officially' sold here.

ignoramous 5y ago

> disable their bloatware with adb, but there's no reason they have to allow this There's a reason. It is Google and its Compatibility Definition Document: https://source.android.com/compatibility/ https://source.android.com/compatibility/ So no: OEMs that want to market their phones as running "Android" cannot break things as they please.

NotPractical 5y ago
Can you please link to somewhere it says that OEMs can't prevent adb from disabling system apps? They obviously can't disable adb entirely (because it's useful to Android developers), but they can probably add restrictions on top of it.
- ignoramous 5y ago
  (disclosure: I co-develop apps in the android sec/privacy space) Every device branded as running "Android" must pass Google's Compatibility Test Suite (CTS) [0]. One look at the tests suggest that many of the adb commands Universal Android Debloater (UAD) [1] relies on are infact part of CTS: - pm uninstall: https://cs.android.com/android/platform/superproject/+/master:cts/tests/tests/content/src/android/content/pm/cts/PackageManagerTest.java;drc=e2f88805cab390f89c1805e35ed2ba5f444430b7;l=1465 https://cs.android.com/android/platform/superproject/+/maste... - pm clear: https://cs.android.com/android/platform/superproject/+/master:cts/tests/tests/role/src/android/app/role/cts/RoleManagerTest.java;drc=512939f36d4b60f6ef3f2ebfd22d3d77fd712417;l=408 https://cs.android.com/android/platform/superproject/+/maste... - am force-stop: https://cs.android.com/android/platform/superproject/+/master:cts/tests/tests/os/src/android/os/cts/AutoRevokeTest.kt;drc=4ebe4f93bd823ef7b56747937d639c38dc8b75fc;l=407 https://cs.android.com/android/platform/superproject/+/maste... and so on... [0] https://source.android.com/compatibility/cts https://source.android.com/compatibility/cts [1] adb commands used by UAD: https://github.com/0x192/universal-android-debloater/blob/28647f38cbf9497af60a4d31eb0c230aeeae294d/src/core/sync.rs#L119-L229 https://github.com/0x192/universal-android-debloater/blob/28...
  - kiallmacinnes 5y ago