← Back to context

Comment by codedokode

7 hours ago

Think how bad the market got. Today we have preinstalled garbage apps like LinkedIn, garbage apps mandated to be preinstalled by the government, ads, cloud accounts, notifications spam, telemetry. This is not only Chinese smartphones, for example Samsung also plays this game. I assume there are Chinese backdoors, American backdoors and national government backdoors on almost every phone.

And there seems to be no way to buy a "free" smartphone without Google Services and telemetry below $250. Why 250? Because free OS have multiple bugs and issues and it is not rational to pay more than that.

I am considering two options, one, try to clean up and patch the firmware for a cheap smartphone (remove almost everything proprietary including Google Services, Unrusted Execution Environment, except for basic GUI and launcher), or two, port something like Lineage OS to my phone. Also I need to examine the network traffic and scan for potential weak points like SUID binaries. It is scary to think how much time I will have to waste for this.

Also, it is pretty stupid, in my opinion, to make an OS not based on Android, for example, use Qt for GUI, because there will be no apps for it.

Not sure what timescale you're referring to when you're talking about "how bad the market got" and "today", but back around 2012 I got my first and last Samsung smartphone, must have been a Galaxy 3 or something, that had all of those problematic things too.

It seems like this starting to happen as soon as apps were installable on phones, even iPhones came (and still comes) with a ton of apps you cannot remove regardless of how little you use them. Android, because of the whole OEM story, of course is much worse, but I don't feel like any of what you share is new, been going on for decades at this point.

  • And operators preloading questionable stuff is a much older practice than post-iPhone smartphones. If you had a feature phone in the 2000's, the operator would have customised it one way or another. The iPhone was revolutionary in how much Apple forced the network operators to relinquish control.

    • I can remember Verizon being sued for forcing device makers to disable the ability to transfer files from feature phones to computers over Bluetooth, because they charged a per file fee to transfer files with their own proprietary software.

  • I can't remember if it was Samsung or something, but one of the providers shipped Android tablets with a custom-but-default keyboard which sent ALL your keystrokes back to the provider. That was a big nail in the Android coffin for me.

    • Remember the days of Facebook being preinstalled on Android devices with root permissions and being non removable?

      You couldn't even revoke permission to access the camera and Mic. It had permission to do literally anything, and you couldn't change it or remove it.

  • Apple changed that years ago, what apps can’t you remove from an iPhone?

    • You can't remove the Phone app from an iPad in iPadOS 26. Even when the iPad in question has no cellular functionality. The best you can do is remove the icon, but you get a dialog telling you it won't be removed.

      Which is stupid as I don't want my iPad to be getting every voice mail and imessage and so on that my phone does. They are different devices and serve different purposes. My iPad is totally a media consumption device and I have no interest in it being integrated into my phone's communication functions.

      2 replies →

On that last point, GNOME/Gtk/Adwaita apps generally function really well on small screen sizes. The design language naturally suits it, and in my experience most apps will even make some layout adjustments where they're needed when resized to ~phone screen dimensions.

Anecdotally, out of the ~50 or so I have installed right now on my laptop, which covers the basic calculator/calendar/contacts/etc., and also things like file compression, torrenting, a Mastodon client, RSS reader, and so on, all of them are ready to use on a phone.

Alas, if only there was a (reasonably priced + fully functional) phone that could use them.

Although you will have to buy a used phone in order to pay less than 250$, it seems like GrapheneOS is the best solution for that problem. Not optimal, but the best among what we have.

  • I was thinking the same. But it worries me that these news about Motorola in particular doing shady shit. I was looking forward to the upcoming GrapheneOS/Motorola partnership :(

Cheap smartphone path is harder and harder. Unfortunately the pixel series is easiest but comes in double they number for unlocking the bootloader and flashing lineage, etc.

Xiaomi has been ironically the pioneer in this field, but their phones are inaccessible in the USA assuming you’re USA based. The mediatek chipset also is more fun for this over Qualcomm.

Besides suid binaries, the radio firmware and subsequent radios for WiFi and Bluetooth do give out a lot of information and are open to exploitation.

The most opaque and privileged attack surface is often the modem/baseband and vendor diagnostic stack and allow carriers to process local side AT commands.

Qualcomm is more documented, though there are fun discoveries on mediatek I’ve made just using binwalk.

> Think how bad the market got.

How bad it's always been? Go find a Windows Recovery image for a Sony Vaio from the 2000s. Prepackaged shitware has always been a thing. I read this article and thought "wow someone finally matched an old Vaio."

That said, I want to hear a statement from Motorola on this. The GrapheneOS phones they announced a few months ago were going to be my "out" from this kind of nonsense. I want confirmation that I'll be able to trust them when it finally gets released.

The paranoia is completely warranted, but there is a solution.

Just root your Android phone and put a custom ROM like LineageOS etc

If you want a stretch goal try and de-Google yourself, I have tried but failed twice now.

  • I recently spent twenty minutes sitting outside of an MLB stadium because MLB decided they needed the same level of play protection as a foreign banking app and it refused to work on my friend's LineageOS phone.

    We only got in by installing the app on my Sony and him signing into his account. They charge a fee now to get paper tickets from the box office.

    • Brutal. I had a similarly annoying experience recently, where in order to enter my local big arena for a concert, the TicketMaster app was not enough. I had to step out of the entrance line to download the _arena-specific_ TicketMaster app to access my tickets. I hate the ticket systems that dominate the market, we deserve better.

  • 1) My phone is not officially supported by LineageOS so I will have to port it first.

    2) I did not analyze LineageOS yet and how it is different from stock Android, so I need to go through complete diff.

    > If you want a stretch goal try and de-Google yourself

    My goal is to have an open source system that is under my full control and doesn't play tricks on my by sending telemetry or collecting forensic databases. Because now I cannot even connect the phone to Internet and it is not as useful as it could be.

    • I’d assume that with such a level of required inspection, you also have quite some security requirements. I’d say at that level nothing works as well as GrapheneOS (though you have to either delay security updates or accept temporarily closed source (they get access to the code only in exchange for not publishing it until X days or something) updates, thanks Google). As that currently requires a Google phone, the only way to get close to your price target would be buying it used.

  • Easier said than done in the US. Even of the phones that allow for rooting (which is few and far between these days) you're at the complete mercy of the carrier for whether or not that ability is actually available to you. Even if the gracious lords may allow it, you have to engage in a long and drawn out Byzantine rite just for the privilege. Currently sitting on a Pixel 10 that will not let me have root.

    Give me a Linux phone with halfway decent modem drivers, or give me death.

    • If you do not update the phone, chances are high that there is some Linux vulnerability you could expoloit. The privileged vendor software also can have vulnerabilities. For example, here [1] researches hacked the phone with Verified Boot using a boot logo parsing error.

      My impression that you should treat your phone as something that can be hacked any moment and not store anything important there.

      [1] https://www.sstic.org/media/SSTIC2024/SSTIC-actes/when_vendo...

  • My biggest obstacle to de-Googling is the GBoard keyboard of all things. There's really no good open source alternative that even comes close.

    • I was in the same boat until a year ago or so. FUTO^[1] finally provided a good text prediction/correction pair + that simply better feeling the Gboard has^[2].

      [1]: https://keyboard.futo.org/

      [2]: I never investigated this, so I always assumed that GBoard predicted what key I wanted to press when close to two letters. With FOSS keyboards, with a physically identical layout, I tended to make way more mistakes.

    • Heliboard is an option. No gesture typing out of the box but you can install an external library for that and it works good.

    • Evidently some disagree, but I'm on your side. Biggest reason I didn't immediately think of "But what would I use for a keyboard" is my Q25 has on built-in.

      UnifiedPush, F-Droid, a GMaps webview (arguably cheating, but I'm not RMS), NewPipe or Invidious are all good-enough alternatives, but I remember struggling to find a keyboard that felt right when I was using a Pixel 2 for a fortnight.

      I think I went with the oldest Fleksy or Minuum APK I could find (from a reputable source), as they were fine without GApps.

      Though I'd also like to call out the fact that AOSP has talkback, the accessibility service built-in, but there's no AOSP TTS engine to use it with. This is especially noticable when trying to use any spoken directions in OSMAnd, as it requires a TTS engine to use that function.

      The only reason it's not the dumbest thing about Google's stewardship of AOSP is that I'm not sight impaired - as it stands, the multi-trillion-dollar corporation ripping out the built-in SIP client in their phone OS takes that prize

  • Re: de-Googling yourself:

    Goldman Sachs paid $6 million to try to get its [soon-to-be] former chief counsel Kathryn Ruemmler's Google search results highlighting her close friendship and many-years-long association with Jeffrey Epstein off the first few pages of results.

    Today, the first result on the first page of a Google search for her is the opening paragraph of her Wikipedia biography:

    >Kathryn H. Ruemmler (born April 19, 1971) is an American attorney who was principal deputy White House counsel and then White House Counsel to President Barack Obama.[1] Previously a partner at Latham and Watkins co-chairing its white-collar defense group,[2] Ruemmler joined Goldman Sachs in 2020 and was Chief Legal Officer and General Counsel.[3] She announced her resignation from this position in February 2026, effective at the end of June, over her links to child sex offender Jeffrey Epstein.[4][5][6]

    https://en.wikipedia.org/wiki/Kathryn_Ruemmler

    >How a Secretive Firm Tried (and Failed) to Fix an Epstein Friend’s Tattered Image

    https://archive.ph/Biztm