[JoshTriplett]

> I'm not knowledgeable enough -- what would it take to escape the Apple/Google duopoly?

At this point? Reliable emulation that can run 99% of Android apps, to provide a bridge until the platform is interesting enough for people to develop for it "natively".

I think the easiest way to do that would be to run Android in a VM.

[rjdj377dhabsn]

> I think the easiest way to do that would be to run Android in a VM.

The problem is the critical payment and government ID apps that will never run in an Android VM because they intentionally break without hardware attestation.

[A4ET8a8uTh0_v2]

Yep, otherwise, VM is effectively one of the better ( and maybe even safer ) way of trying to escape the established ecosystem.

[lanfeust6]

Isn't this spoofable with root access?

[rjdj377dhabsn]

The private key used for attestation is stored in the secure element hardware, which runs its own OS, completely inaccessible to the main hardware's OS, even with root.

Some apps don't actually check the attestation signatures, so they could be spoofed for now, but if spoofing became common, apps would just get strict about checking attestation.

[JoshTriplett]

Parts of it are, parts of it aren't. Some of it is based on hardware attestation.

[charcircuit]

Why not run Android directly, such as using Graphene OS. It's decades ahead in both OS architecture, developer tools, and developers compared to non Android based Linux operating systems.

[fsflover]

Graphene uses the Google codebase, so Google is choosing its long-term development strategy and standards it will support. It's like choosing Chromium to escape Chrome.

[DANmode]

Not the worst choices!

[fsflover]

Indeed. However, in terms of the independence, better choices exist.

[charcircuit]

If someone is making a new browser, considering you want to support the same web standards as everyone else, being independent is pretty low on the priority lists. In fact it is more of a liability since it could make for compatibility issues.

[fsflover]

I don't understand what you're talking about. Firefox supports all reasonable standards and so does GNU/Linux.

[charcircuit]

The same can be said about the Linux codebase. Tomorrow Linus could private his branch and stop supporting public releases. If AOSP goes closed source then people can fork it and continue to maintain it.

[fsflover]

Linus is not known for decisions hostile to the users. Google is.

[akdev1l]

The Linux kernel cannot be relicensed. Linus does not hold copyright to most code.

[kahnclusions]

Linux doesn’t really rely on Linus for coding anymore…

[gf000]

It does on Intel, AMD and a bunch of other huge corps though

[fsflover]

Which is not the same as one single, hostile corp.

[bossyTeacher]

Graphene OS exists because Google lets it. You can't rely on competitors that can only exist in this manner

[lawn]

Similar to how Valve is managing the transition from Windows to Linux.

[stOneskull]

it'd be cool if they made Steam Phone.. it could be to Steam Deck as iPhone was to iPod Touch.

[palata]

Well if you rely on running Android apps, you still rely on Android.

Actually, if you rely on the app, you really on the Android SDK which is not open source.

Now if you could run AOSP but your own apps built with an open source SDK, that would be a different story. Some people seem to really want to do that with PWAs. I personnally tend to hate webapps, but I have to admit that they can be open source.

[gunalx]

You can go the waydroid style with namespacing, or native containers if using the linux kernel. No need to do a full vm

[JoshTriplett]

You could, but using containers requires that your kernel directly provide and secure Android-compatible functionality, such as binder. A VM gives you more options for abstracting that functionality.

If you expect to be "essentially android, but a little different", containers make sense. If you want to build an entirely different mobile OS, but provide Android compatibility, I think a VM is much more likely to give you the flexibility to not defer to Android design decisions.

[mschuster91]

> I think the easiest way to do that would be to run Android in a VM.

Sony's cameras used to have an Android userland that they used for their PlayMemories apps. No idea how exactly that one was implemented though, but it should be possible to get Android apps without going into being an Android fork.

[jazzyjackson]

Has no one mentioned not using a smartphone as an option?

[palata]

How do you run WhatsApp or Signal without a smartphone? Pretty hard.

If your answer is "don't use them", then you're not living in a country where the vast majority of communications are done on WhatsApp or Signal, good for you I guess.

[jazzyjackson]

Yes that's fair. I have a an old iPhone without a sim that I use as my master for those apps, but I keep it in a drawer since the desktop apps work fine. Funny enough the phone the app is installed on doesn't have to be the same phone you use to register by number, so the number I registered with is my flip phone

[_heimdall]

Access to Signal and Bitwarden are the only two apps I really need daily that keep me on a smartphone. I have tried using a feature phone in the last couple years, but honestly I might as well just not have a phone at that point as almost all my communication is via Signal.

[kQq9oHeAz6wLLS]

> then you're not living in a country where the vast majority of communications are done on WhatsApp or Signal

I live in the USA and use Signal for, like, 3 friends that I also can call or text, and I've never used WhatsApp in my life.

So, if you live in the USA, you can absolutely get by without those two.

But there are likely other apps that would be more difficult to do without. Not impossible, mind you, just more effort.

[palata]

I tell you that if you live in a country where most communications happen on WhatsApp or Signal, then it's difficult not to use WhatsApp or Signal.

And your answer is to give me an example of a country that is irrelevant to my point? How does that help?

[udev4096]

Signal can be used without a phone using signal-cli. You can sign up with it and either attach your account to signal-desktop or keep using signal-cli

[palata]

"You don't need a smartphone, you can just carry a laptop with you" :-)

[prmoustache]

You don't have to be available on instant messaging 24/7.

It is a convenience or inconvenience you decides to have or not.

[palata]

"You don't need to connect to the Internet at all".

How is that an answer to someone saying that they don't see how they can stay connected without having a smartphone?

[tranq_cassowary]

Doesn't really make sense in a conversation about security (the HN post was referencing security).

Traditional desktop OSes (Windows, MacOS, traditional Linux distros) are just at an entirely different level than modern mobile OSes (Android OSes, iOS) and ChromeOS. They also often run on less secure hardware, especially compared to a Pixel.

[mrgaro]

It's not really an option. Beside various communication tools, many many banks require you to have a smartphone as their 2FA option.

[prmoustache]

They don't publicize it because they'd rather sell all the data they don't have already through your payments and bank movements but many still send you a dedicated device if you mention you don't have a smartphone.