MicroG: Free-libre re-implementation of Google's proprietary Android user space
An open-source reimplementation of Google’s Android Play Services, microG, is praised by some users for enabling app compatibility on de-Googled ROMs like LineageOS and /e/OS, but criticized by others for relying on signature spoofing and granting privileged access that can weaken security. Several commenters contrast microG’s approach with GrapheneOS’s “sandboxed Google Play,” arguing over which model better balances privacy, security, and real-world app support, especially given that many apps still embed proprietary Google libraries. The thread also highlights ecosystem risks such as fake microG and MindTheGapps websites that could one day distribute malware, underscoring broader concerns around trust and software supply chains on Android.
Project and ecosystem context
- MicroG is described as a free re‑implementation of Google Play Services used on custom ROMs like LineageOS and /e/OS to keep many apps working without installing the full proprietary Google stack.
- Several commenters report good day‑to‑day experience (e.g., on LineageOS, /e/OS, Murena phones), including apps like Telegram and SNCF‑Connect, though others see specific app breakage (payments, logins, language issues).
Play Services vs app compatibility
- Clarification that this is about Play Services APIs, not the Play Store itself.
- Some apps hard‑depend on Play Services; others have fallbacks or work with direct APK installs or alternative stores.
- MicroG sometimes stubs APIs as no‑ops, sometimes reimplements them, and sometimes calls Google endpoints (e.g., Firebase).
Security, signature spoofing, and DroidGuard
- Signature spoofing is highlighted as fundamentally violating Android’s security model by granting privileged access to MicroG, which then also benefits Google code it loads.
- Critics argue MicroG has a poor track record: long‑standing privacy leaks (notably around location), incomplete permission enforcement, and execution of Google’s DroidGuard binary with MicroG’s elevated privileges.
- Supporters counter that MicroG is open source and a reasonable compromise for usability on de‑Googled systems.
GrapheneOS “sandboxed Google Play” vs MicroG
- One camp argues running official Google Play Services unprivileged in an app sandbox is more secure and often more private than a privileged MicroG that still talks to Google and runs Google code.
- Others contend that sandboxed Play still enables extensive data sharing via app libraries and criticize this model as insufficient “de‑Googling.”
- There is disagreement over whether GrapheneOS genuinely prioritizes privacy or leans mainly into security; its defenders claim both, citing additional privacy features and faster upstream patching.
/e/OS, Murena, and project politics
- Strong criticism of /e/OS and Murena: alleged outdated security patches, misleading patch levels, extra tracking/telemetry, historic use of OpenAI for speech, and privileged Google components via MicroG.
- Separate thread on hostile rhetoric between projects and their communities; some see GrapheneOS communication as toxic, others point to sustained attacks and misinformation against it.
Other notes
- Warning about fake MicroG/MindTheGapps sites that could eventually distribute malware.
- A side discussion critiques poor merge‑commit practices in the MicroG repository.
- One commenter notes that even with MicroG, all current Android devices still rely on substantial proprietary, often privileged, components.