Signature spoofing violates the android security model. It means giving privileged access to microG, which means giving privileged access to google. For a privacy project, granting 3rd parties privileged access is unacceptable.
microG has a poor privacy and security track record. They've repeatedly had severe privacy and security issues which are publicly discovered and then go unfixed for years. One of those which involved leaking location data to apps which weren't supposed to have access to it was documented on their wiki but yet not addressed for years. There are still privacy holes in the location implementation, although the most severe issue was fixed.
GrapheneOS does provide open source reimplementations of Google Play APIs including location. It provides those as OS libraries running in the apps using them instead of an extra service. That means location data access is restricted by the standard sandbox and permission model rather than needing to reimplement it in a service. Reimplementing it in a service means mistakes or failure to keep up with the modern permission model can create privacy holes, which has happened with the microG location service repeatedly and taken years to address.
The sad thing about GOS is that, despite whatever technical merits it may actually claim, the sheer toxicity of its community is enough to drive many interested users as far away as possible.
Case in point: this very comment by "grapheneos" predictably lambasting MicroG in great detail and then - without a hint of irony - giving GOS props for doing things the "right" way.
Your message would go so much further if for once you considered how it is being conveyed.
Edit: just came across several other essays-as-a-comment in this thread, further vindicating the sentiment.
Look at ForHackernews' comments and you'll understand why we counter them.
What's toxic about responding to people attacking GrapheneOS?
Why do you consider it an attack to accurately summarize your own opinions?
Contrary to how you're portraying it, our own compatibility layer is fully open source software. microG exists to provide compatibility with apps using closed source Google libraries. Our compatibility layer exists to provide compatibility with closed source Google apps and apps using closed source Google code. Both are open source projects. Neither would have any significant real world use if apps weren't using Google's closed source libraries. We already have standalone network-based location, geocoding and other features. Those do not require compatibility with Google Play APIs and we disagree with it being strongly tied together.
GrapheneOS provides both standalone reimplementations of Google service features not tied to their closed source apps and libraries along with a compatibility layer for their closed source apps and libraries. All of our code for all of this is open source. microG is not an open source alternative to what we've built and are in the process of expanding ourselves. Both are open source and it's wrong to keep misleading people about what we provide and are building.
1) a user having root inside a VM is not the same thing as having root and I suspect you well know that.
2) No one is claiming microG is an alternative to your sandbox - it's an alternative to the GApps you suggest people install into your sandbox. Again, you clearly know this.
GrapheneOS reimplements a growing portion of the services normally provided by Google Play services including network location and geocoding. It does this without having Google services built into the base OS with privileged access as /e/ does with microG. It doesn't strongly tie those services to Google Play services APIs as microG does.
GrapheneOS has a reimplementation of Google APIs including the location APIs and will be greatly expanding that over time. The existing implementations avoid the pitfalls of how this is approached in microG. We'll be continuing to expand this as the project scales up and it will become increasingly capable of running apps depending on Google Play APIs without without ever installing any Google apps.
Our Google Play compatibility layer is not a special sandbox for running Google Play. It's a compatibility layer to enable apps to run without privileged Google integration into the OS. It enables both Google apps and those depending on them to run. Over time, it will be expanding how much of the APIs are reimplemented by us to enable using more apps without Google Play than it currently does.
GrapheneOS doesn't recommend installing Google Play as you keep claiming. /e/ makes many connections to Google servers by default and gives highly privileged access to the implementation of those services (microG). microG on /e/ downloads Google executables (droidguard) by default and runs those with privileged access. GrapheneOS never gives that kind of highly privileged access and data to Google apps.
Our approach to reimplementing their APIs redirects them to other implementations from within the app using it instead of having a new highly privileged component sharing data across apps and having to enforce a permission model for them. Our Google Play location service reimplementation doesn't have to perform any permission checks itself since it just has apps query the OS location APIs including the OS network location provider when available. Those are standard AOSP APIs and we implement the Google Play APIs locally inside of the app using it on top of those.
https://grapheneos.org/usage#sandboxed-google-play
¯\_(ツ)_/¯
It is not recommended over vastly more sane alternatives like Accrescent and getting apps directly from their respective developers (as signed by them) given you have an update mechanism of your own (or the app embeds one) and a manner of verifying the app's public signing key's provenance as something actually belonging to the developers you got said app from (where the former is a proper app store in construction and the latter is nigh impossible to perform cleanly due to typical developer non-cooperation). Nonetheless, Play Store ranks below these two for a third-party app source as it engages in weird practices like Play App Signing, etc. Users are not advised to get Play Store apps from non-Play Store app sources because Play Store already ranks the furthest behind, meaning nothing is recommended beyond it.
Aurora Store is recommendable in exceptional cases, namely when an app can't be downloaded from Google Play due to Play Integrity gating on the app's store listing, but which is known to work (eg. not perform Play Integrity checks itself in the intended manner, etc) after somehow downloaded and installed.
Although as you can verify, this recommended app source ladder is pushed on social media and official chat platform community spaces of GrapheneOS, not the website.
> What's toxic about responding to people attacking GrapheneOS?
You're making my point for me. Which, to be clear, I find sad because I want GrapheneOS to succeed, but that's really hindered by this behaviour.
Here's one of the main corporations behind microG smearing hardened devices as being for criminals and pedophiles, which they have done repeatedly:
https://www.clubic.com/actualite-604786-murena-e-os-intervie...
https://grapheneos.social/@GrapheneOS/116353973732143171
That's only a small portion of it. There's a massive amount of this and much more from microG developers and multiple corporations supporting it including vile personal attacks and spreading of harassment content by the CEO of Murena and many others involved in it.
I'm commenting on what I see as a consistent pattern of behaviour. An observation that is only increasingly apparent with every one of these (frankly) unhinged responses. To wit: I observe that you lambaste MicroG before, and here in response you double-down with even harsher rhetoric.
Graphene is highly regarded on the technical merits, with a notable uptick in stories on HN to this effect of late - why would you constantly and unrelentingly sully that like this?
Please do not respond with a list of grievances, re MicroG (or others) - I'd genuinely like a specific response to my very unambiguous and direct question.
Your posts are misdirection from the substance we provided. Your accusations are cover for your toxicity towards us. It's an attempt to falsely accuse us of engaging in what you're doing because we'll defend ourselves from it. These tactics have been used against us for years and don't work well anymore. Most people can see right through it. Your first post was a personal attack derailing the thread and you've continued down that path.
None of your points above have any relation to each other nor does one explain another.
You concocted a weak argument to justify ad hominem and say 'community toxic'.
Well done in providing an example of vapid demogoguery.