Graphene generally seems to feel that running official signed Google adware is more secure than using open source alternatives that might require signature spoofing or having root on your own device.
I have never understood why people using MicroG can use apps like SNCF-Connect, while I cannot.
SNCF-connect is the largest online marchant in France. Since june, I cannot click the "pay" button anymore. It coincides with the new feature of Pay with Google.
So : is it because MicroG allows calls to Google services on e/OS devices, while my LineageOS refuses ? Or because MicroG implemented a try catch around this call, without any call to Google's servers ?
Some Play Services calls are stubbed out as no-ops and others are reimplemented either with fully free replacements (e.g. navigation) or else by calling proprietary Google remote endpoints (e.g. firebase)
This is why I always think emperor git wears no clothes. Hiding these kind of intermediate junk commits from history should not require rewriting and breaking the distributed history you all share. imho the correct solution would be a tag-like layer for annotating existing commits with metadata (additional signatures, hide-flags, retroactive comments, etc) or just a full 2nd dag, but whatever: git sucks at annotating history and annotating history is a core workflow in git.
It's too bad you have to rely on signature spoofing to be able to use this as an alternative (but obviously I understand why). The spoofing looks narrowly scoped on LineageOS, but in general I imagine it creates some risk.
Why can't they signature spoof for those fundamental apps and prevent installing or uninstalling them, similar to how you can't uninstall google stuff on stock android?
This about Play Services and not the Play Store. Play Services are a bunch of extra APIs/services that Google does not make available as part of AOSP. The non-nefarious reason is to make it possible to fix bugs and roll out features faster because the OEMs are terrible at rolling out new Android versions. The possible nefarious reason is to make more of Android closed-source.
At any rate, microG is a reimplementation of Play Services.
Note that MindTheGapps is distributed at https://github.com/MindTheGapps/. The dot-com domain looks like unaffiliated SEO squatting and could change download links to malware anytime.
https://grapheneos.org/features#sandboxed-google-play
SNCF-connect is the largest online marchant in France. Since june, I cannot click the "pay" button anymore. It coincides with the new feature of Pay with Google.
So : is it because MicroG allows calls to Google services on e/OS devices, while my LineageOS refuses ? Or because MicroG implemented a try catch around this call, without any call to Google's servers ?
[1] https://doc.e.foundation/os/apps/app-lounge/
At any rate, microG is a reimplementation of Play Services.
You can directly download the Telegram APK from: https://telegram.org/android
(Or using the app store that is part of /e/OS and serves as a front for both the Play Store and F-Droid.)
The real reason to me is that they want to avoid Android forks outside of their control.
https://mindthegapps.com/
I mean Google!