[Someone]

If I understand this correctly, this removes one layer of Google code, but keeps building on the Google layers beneath it.

If so, what is the gain here? Can the Exposure Notification Framework be trusted less than the rest of Android? Or does this support more hardware?

[BubuIIC]

> removes one layer of Google code, but keeps building on the Google layers beneath it.

Well, the layers beneath it are AOSP and free software. The situation is certainly not great, with source drops, nonfree firmware blobs, etc. But it is relatively easy to grab an AOSP source-tree for your device, make some changes, rebuild the OS and install this to your phone, given an unlocked/unlockable bootloader. In my opinion this is a highly desirable property of any system I'm using. It also enables things like GrapheneOS and CalyxOS which are Android distributions which focus explicitly on security and privacy.

> Can the Exposure Notification Framework be trusted less than the rest of Android?

ENF is part of Google Play Services and thus proprietary software. It is also a hugely scary and absolutely giant bundle of software you need to keep running in it's entirety, you cannot use just the ENF part. Play services can remotely update any software on your phone, they have also been known to "accidentally" not respect users (location)-tracking opt-out choices. So while I personally don't consider googles ENF implementation problematic (from their docs, the sources are ofc not available) the rest of play services most certainly is.

> Or does this support more hardware?

Apart from the already mentioned gapps free ROMS it supports modern Huawei phones (which also come without gapps). Making it work on Android 5 will probably happen (Google ENF supports Android 6+ afaik)

[danhor]

You can use it on a device without GApps, so without closed-source google code, using only the open source Android codebase (and the blobs and drivers from the manufacturer, depending on your device). This means you don't have to trust Google.

[danhor]

It uses code from microg for this, which is a free GApps replacement, but needs to be installed at a system level, while this can work on any device

[rurban]

The biggest problem is identification. The latest Android system update for the low-energy bluetooth support which was needed for those tracing apps, added the generation of the random id centrally. Which is security nightmare, like registering your private SSH key at Google. So Google knows now your health status, and via Google the NSA, and via the NSA all their partners.