Per one tech forum this week: “Google has quietly installed an app on all Android devices called ‘Android System SafetyCore’. It claims to be a ‘security’ application, but whilst running in the background, it collects call logs, contacts, location, your microphone, and much more making this application ‘spyware’ and a HUGE privacy concern. It is strongly advised to uninstall this program if you can. To do this, navigate to 'Settings’ > 'Apps’, then delete the application.”
What’s over engineered about it?
In my experience, the API has iteratively made it ever harder for applications to automatically perform previously easy jobs, and jobs which are trivial under ordinary Linux (e.g. become an access point, set the SSID, set the IP address, set the PSK, start a VPN connection, go into monitor / inject mode, access an USB device, write files to a directory of your choice, install an APK). Now there’s a literal thicket of API calls and declarations to make, before you can do some of these things (and some are forever gone).
The obvious reason is that Google tries to protect a billion inexperienced people from scammers and malware.
But it kills the ability to do non-standard things, and the concept of your device being your own.
And a big problem is that so many apps rely on advertising for its income stream. Spying a little has been legitimized and turned into a business under Android. To maintain control, the operating system then has to be restrictive of apps. Which pisses off developers who have a trusting relationship with their customer and want their apps to have freedom to operate.
I suppose that’s all true, I’d say more “following apples lead on locking things down” than over engineered, but 🍅🍅.
I find myself avoiding the whole root business, I do want my mobile device to be fairly locked down. But I also use alternative OSs and app stores to avoid 90% of the garbage (stuff I can’t avoid I put in work profile, like I still need google maps).
It works for me, but on the front of this complexity driving away devs I don’t really see a viable alternative. Base Linux isn’t secure enough for what we put on these little computers. I mean you’ve still got tons of influential people arguing you shouldn’t use secureboot or a tpm as if leaving your whole computer unsecured is better than the indignity of using a non-free bios.