[Replicant] Android applications on ‘real’ GNU+Linux – Anbox freedom review

[dllud]

Hi James,

> I used to use Gajim as a desktop client but I had so many issues with it (poor image support; partial last-message-correction; incomplete scrollback in main chat; etc.)

You should really give another go to Gajim. Although it is still far
from Conversations, it has improved a lot in terms of reliability in the
last couple of years. As of version 1.2.1, with the latest Url image
preview and OMEMO plugins, those issues that you mention are no longer
there.
Since your goal is to use GNU/Linux in the long run, I guess it would be
best to invest your time into apps that can run natively.


> What happened to Replicant 9?

Development just migrated from Replicant 9 to Replicant 10 (based on
LineageOS 17). No work was lost. What had already been accomplished for
Replicant 9 works on Replicant 10, and many things improved.


> It's been at least a couple of years that the Replicant project has been focusing on Replicant 9 at the exclusion of everything else

Well, actually work has been going on many fronts at the same time, not
just Replicant 9/10. For instance, Replicant 6.0 0004 RC2 was released
just a few days ago[1].


> Sorry for being disheartened about Replicant itself

Ahaha no problem at all. Actually, many Replicant contributors
themselves would rather use GNU/Linux on their phones. We agree with you
on the fact that Android is built with things like time-to-market and
obsolescence in mind.
Actually, one of the ways through which Replicant is trying to extend
the lifetime of smartphones, is to re-use as many components from
GNU/Linux on Android as possible[2].

The reason we feel that Replicant is still important has mostly to do
with the lack of proper mobile apps for GNU/Linux. Mobile apps must take
into account several things that most desktop apps disregard, like:
- high density screens and big fingers;
- metered, laggy and intermitent internet connections;
- limited power supply (battery), with the accompanying aggressive
schedulers.

There is a really big portfolio of free software apps on F-Droid which
take all of these into account (because they're built with the Android
SDK). Unfortunately this is unmatched by anything we have so far on
GNU/Linux. But things are definitely improving and we do hope that
someday Replicant will become useless.


Now, onto the main thing here, the Anbox freedom review.

> It seems that the reason that it's in contrib rather than main is the dependency on some core Android components: “
>> This package needs Android kernel modules and rootfs image, see /usr/share/doc/anbox/README.Debian for information.
> ” – https://packages.Debian.org/stretch-backports/anbox
> Could these components be replaced with Replicant's freedom-reviewed versions?

The required kernel modules (binder and ashmem) are both available by
default on Debian and should be pretty safe freedom-wise. The only
missing component is the Android image.

A new target could indeed be added into Replicant in order to output an
image compatible with Anbox. However this would be a really hard work
and a cumbersome approach. It would imply merging, applying and
sometimes re-doing all Anbox work on top of Replicant, while making sure
it does not break the devices supported by Replicant.
This approach becomes even less desirable in light of the following:

Anbox is just a "minimal customized" version of AOSP[3]. They use most
AOSP components from upstream, and just add small modifications into
some of them.

As far as I know, the Replicant project did not found any freedom issues
in AOSP itself so far. The only exception being WebView which, due to
being built out of Chromium, *may* have some freedom issues[4].
Most freedom issues that Replicant found come from vendor code that is
added to the devices later[5][6].

As such, the Anbox Android image bypasses all these freedom issues. The
only thing left to do is to check the Anbox's modifications on top of
AOSP and verify they are indeed free.
As GNUtoo pointed out, the list of Anbox modified AOSP repos can be
looked-up through their manifest[7]. The repos with modifications are:
https://github.com/anbox/platform_art
https://github.com/anbox/platform_bionic
https://github.com/anbox/platform_frameworks_av
https://github.com/anbox/platform_frameworks_base
https://github.com/anbox/platform_frameworks_native
https://github.com/anbox/platform_frameworks_opt_net_wifi
https://github.com/anbox/platform_hardware_libhardware
https://github.com/anbox/platform_hardware_libhardware_legacy
https://github.com/anbox/platform_system_core
https://github.com/anbox/platform_system_netd
https://github.com/anbox/platform_system_vold
https://github.com/anbox/device_anbox

I took a quick look at these and found no red flags.

Regards,
dllud


References:
-----------
[1] https://lists.osuosl.org/pipermail/replicant/2020-July/002932.html
[2]
https://redmine.replicant.us/projects/replicant/wiki/Presentations#Extending-the-lifetime-of-smartphones-with-Replicant
[3] https://github.com/anbox/anbox/blob/master/docs/build-android.md
[4]
https://redmine.replicant.us/projects/replicant/wiki/Presentations#The-Chromium-mess-meets-Android
[5]
https://redmine.replicant.us/projects/replicant/wiki/GalaxySIIGTI9100#Freedom-and-privacysecurity-issues
[6]
https://redmine.replicant.us/projects/replicant/wiki/GalaxyS3I9300PrivacySecurityEvaluation
[7] https://github.com/anbox/platform_manifests/blob/anbox/default.xml

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://lists.osuosl.org/pipermail/replicant/attachments/20200804/674284cf/attachment.asc>