Hacker News Reader

Comment by negative_zero | Hacker News Reader

Odd. Google Pixel 7 with GrapheneOS here. OsmAnd works perfectly fine for me without disabling any exploit protection options.

View on HN

CoMaps behaves very very weirdly on GrapheneOS. Same with OrganicMaps.

Osmand and GMaps are working fine.

Waze is almost melting the poor thing. Beside of that working fine.

I use Comaps daily on GrapheneOS on a Pixel 8 Pro and it works great.

Waze works perfectly fine for me

Anyone writing about apps compatibility should specify if it's with or without the play services

Can you even run Waze/GMaps without Play services?

Yes.

For more precision:

Waze is fairly easy to run without play services. GMaps I haven't yet found a way to run, but also haven't looked in quite some time.

Google Maps used to work without it but recently gained a hard dependency on Play services. We could add more shims to make more apps work without it installed but that hasn't been a focus yet.

Makes sense. Any idea if there's any interest in a shim to get notifications working sans Play services?

I haven't looked at anything shim related in quite a while and am not super familiar with the notification stack for Android, so if that's a stupid question I apologize.

Neat, every day I inch closer to not needing Play Services anymore.

https://plexus.techlore.tech/apps?q=waze

Waze and Here Maps work well.

Osmand and OrganicMaps work flawlessly for me. Waze on 6 (not pro), works better than on my 9 Pro.

Weirdly how? CoMaps seemingly works fine out of the box on my device

Have had no noticable problems with organic maps.

comaps and organic maps shares some of the same codebase right?

AFAIK CoMaps is a fork of OrganicMaps after OrganicMaps added some sort of ads or sponsoring. They both use OSM

CoMaps and Waze definitely work well on GrapheneOS. There's a known performance issue experienced by some users with the OsmAnd OpenGL renderer which can be worked around disabling hardened_malloc. We could likely provide a performance vs. security toggle for hardened_malloc to avoid it, but we also plan to continue optimizing the default high security mode.

And yet problems exist. Live Updates are not rendered if both OsmAnd V2 rendering and hardened memory allocator are enabled: https://github.com/osmandapp/OsmAnd/issues/20190

Those are memory corruption bugs which are potentially exploitable vulnerabilities. There are no false positives for the security protections in hardened_malloc including the hardware memory tagging (MTE) integration. It only detects invalid memory corruptions via use-after-free or out-of-bounds accesses. Due to a relatively high number of apps having invalid memory accesses during regular use, we don't enable MTE for all user installed apps yet. We always use MTE for the kernel and userspace code in the base OS but it's opt-in for most user installed apps via a global toggle to enable it by default and a per-app toggle mainly intended for opting out for incompatible apps.

OsmAnd has a massive amount of legacy C++ code which hasn't been heavily tested with HWASan and MTE. It has a history of having many memory corruption bugs discovered and reported by GrapheneOS users. That's the exploit protections in GrapheneOS working as intended and it's why there are per-app compatibility toggles to work around apps which can't be used due to memory corruption during regular use. It would be better if apps had higher quality native code and didn't need us to provide compatibility toggles but that's the way things are. It's much worse on desktop operating systems.

Reply on news.ycombinator.com