yashsingh1/xdaforums huggingface dataset:
[Magisk] pndwal:
Quite.

And we should note that while John came up with an initial working solution for hiding Magisk root in MagiskHide (he nicked @Chainfire's supolicy and used @phhusson's open source SuperUser to get it working, then @Chainfire nicked the post-fs-data boot stage method John had utilised to do this (as well as to create Systemless XPosed 2 months earlier) to create SUHide for SuperSU...), his personal work on it of late has been very limited.

He has, however provided and maintained the MagiskHide framework that is relied on for current solutions from other Devs / modders to work, at least with Magisk. (Nb. some are integrated in custom ROMs, and work even without Magisk / MagiskHide.)

What we rely on now are modules and / or commits from Devs including @vvb2060, @kdrag0n, @canyie (& @Rikka) and @Didgeridoohan.

WIthout these, MagiskHide would still be broken for anything outside of userspace. PW
[Magisk] zgfg:
My few cents

Unlocking Bootloader is a prerequisite for any flashing (therfore any serious modding) be it rooting, installing a custom Recovery or custom ROM

One of the checks in SafetyNet is whether the Bootloader is unlocked or not - if unlocked, SN should fail (and all apps relying on SN would know that device is 'unsafe' and will refuse to run)

Moreover, all the newer devices must support TEE=Trusted Execution Environment. If that use of TEE would be properly enforced by Google, then no USNF module or similar could help anymore to spoof the unlocked Bootloaders

Google experimented with all that in the past but still turned it off, allowing to continue spoofing the SN. Probably because of:

- When Bootloader is unlocked, you don't distinguish was it for rooting or installing a custom ROM

- Google itself supports unlocking Bootloaders and the whole story about (AOSP, GSI, etc) custom ROMs

Hence I don't believe that Google will (any soon) enforce the TEE. It will probably stay as is, still allowing us to spoof the unlocking Bootloaders and therefore SN, and more generally to hide the root (with additional help of MagiskHide, USNF, MHPC, MomoHider, etc)

Instead, maybe Google is really looking now for an alternative solution, to detect and distnguish only the root - like some (banking) apps do when they look for su in the path, or better for modified init.rc or similar (looking for Magisk app or certain root apps, or for tge presence of certain folders are not professional guesses, they will not go for those checks)

Also, what for they employed John?

- Brilliant engineers are always welcome, and additionally the ones with already a deep knowledge into the matter

- Specially, if they really want to stop rooting (again, I'm not talking about detecting if Bootloader is unlocked)

- Or just to block him (as they did) to continue working on Magisk, and thus practically killing his project (as they also seem to succeed in)

- Or all together

Anyway, I believe that the mice and cat game (detecting and hiding the root) will still continue for quite some time, but I'm not sure when (or if ever) a new Magisk will be released through the John's established Update channels like Canary or specially the Stable channel - however, it does not exclude alternative forks like Magisk Alpha, Lite or so (although, maybe they will never have the polished Documentation, Release Notes, Issues tracker and alike as we were accustomed to with the offical Magisk)
[Magisk] timofonic:
I didn't know John from Magisk was hired by Google. That's extremely suspicious, IMHO.

What's the most active Magisk alternative out there?
[Magisk] zgfg:
There were many posts here about the whole story (more can be found on Internet), about his twits (he posted but removed later and even his previous Magisk v23 release twits also removed from his profile). His Twitter profile now just says that he works for G Security and that he WAS creator of Magisk:

https://mobile.twitter.com/topjohnwu

You can also find here posts about Magisk Alpha and Magisk Lite from wb2060
[Magisk] pndwal:
Some good points, but I've seen no indication G wants to distinguish between root and ROM customisations, or that they're abandoning Hardware based TEE attestation for any new method.

They both state they're not opposed to root, and they've been hardening Hardware tee since Android 6 (keymaster HAL existed before this).

Implementation has been progressing for a long while, and has involved cooperation with OEMs and SOC makers.

Certainly, 'final' deployment (ie, with no failsafe fallback to basic attestation either for under radar (recently applied) or overt types (that were bypassed by simple prop change)) seems to be delayed, and may be for some time (years?) yet while waiting for sufficient Android 8+ market saturation, or for OEMs to get their implementations right (we know OnePlus and likely others messed these up).

This has been a deployment years in the making / planning / testing, but wit an obvious objective: to secure infallible attestation for TEE. I don't think Google is changing or will suddenly change direction.

These indictions have been consistent and in line with their statements, whereas a sudden crackdown on root, or even a search for a way to distinguish root from other custom mods in order to thwart it's use, is pure speculation as I see it.

Hardware backed TEE attestation is built on a chain of trust starting with verified boot, and this model could (should) be sufficiently reliable for 3rd party security requirements.

No alternative is needed to distinguish between root and custom ROMs either as this works with unlocked bootloaders and doesn't preclude the use of such ROMs in any case.

However, the chain of trust having been broken at boot level (verity disabled), the attestation to non-Trusted Execution Environment (read modified / insecure environment for running code) will be accurate whether user flashes rootkit, custom ROM, other mods or all of these. PW
[Magisk] pndwal:
Likely most active:

https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-85098469 😜 PW
[Magisk] timofonic:
He's a "traitor", IMHO.

I hope better alternatives succeed. I don't trust Magisk, it may contain some pro-Google code.
[Magisk] pndwal:
Except that Google bought Android in 2005 and made Android their mobile OS!

Also, Rubin and other founding members agreed to stay on to continue developing the OS for Google.

The Android OS robot / green bug Logo was created by Google employee Irina Blok. And, like Android itself, Google decided to make 'Andy' an open-source project. So the Android robot has now been modified by 'tons' of people because Google allows such changes under the Creative Commons 3.0 Attribution License, and was overhauled alongside much of Android’s branding in 2019.

https://www.androidauthority.com/history-android-os-name-789433/

So what really is the difference between Android and Google? Simple! Google is the parent company, and Android is Google's OS.

Initially, Google worked on Android in secret, but from Nov 2007 they revealed plans to compete with Apple and other mobile platforms.

Next, Google acted on its decision / commitment to make Android an open-source operating system, and led the formation of the Open Handset Alliance (including HTC, Motorola, chip manufacturers Qualcomm and Texas Instruments, carriers including T-Mobile, etc). This consortium of developers is commercially sponsored by Google and is now changed with developing Android in partnership with (led by) Google. The parent organisation is still listed as Google.

https://en.m.wikipedia.org/wiki/Open_Handset_Alliance

With the OHA, the open source Android project was born. The official Android site and the Android Open Source Project (AOSP) Git repository (GoogleGit) are hosted by Google.

https://source.android.com/

Google also announces the developer previews, as well as new releases on an annual basis.

So, just in case of any confusion, Android is very much Google's OS, their baby, but is licensed as an open source project.

https://source.android.com/setup/start/licenses

Google's proprietary apps (GApps: Maps, GPay, YouTube...) are their baby too, but are also exclusive close source (intellectual) property, and licensed as such. Note that licence info is on developer.android.com:

https://developer.android.com/google/play/licensing

Sorry this particular post is pretty much OT, but may allay confusion. PW
[Magisk] timofonic:
I see too many Magisk forks, some of them with documents translated to other languages instead focusing an International approach.

Are there an unforking initiative? What about making Magisk alive without the need of a Google employee? Google isn't our friend and they hate all this stuff, please remember they hate us.
[Magisk] zgfg:
John developped Magisk over the years when he was a student and later employed by Apple. Move to Google happened a month or two ago

And what is better for him to work for living than what's his best expertise. Why should he work for a data mining company, or company developping games, or for Apple (as he did) or something else
[Magisk] timofonic:
I don't deny it. I understand we live in a capitalistic world, with all the consequences.

But he's now against us. That's what I mean.
[Magisk] dd805bb:
AOSP. Look it up. They bought it and open source AOSP(Android Open Source Project). And no one they didn't make it their OS. ChromeOS is their OS. Android is open source. I think you need to learn what is what. They own their apps. Android is forked and manipulated, overlayed on many other platforms like Roku tvs and it is not Google owned. I think you need to research the difference in proprietary and open source. Would really help your understanding of android as a whole. Here is a good read. Let me know when you get the owner part...

Android (operating system) - Wikipedia

en.wikipedia.org

And to add to that, if Google owned Android, everyone using Android would have to pay Google to use it. They funded and major development in Android as a whole, but the owner of Android the OS doesn't exist. They own apps, other OS's, browsers, hardware, software, but Android they opened up for anyone and everyone. Think if they owned Android there would not be official Custom ROMs, Android would not exist on any other manufacturer of anything without paying Google to use Android. No pays to fork Android just as no pays to fork Magisk. Both anyone can use freely and not pay to use it. That is open source. Apple, with their iOS they own. Mac is the same way. You agree to use their software. Google you agree to their terms to use their apps. If no Google proprietary apps are on the phone, basic GSI, there is no agreeing to Google's terms. If they owned it Android, you would agree to use Android under their authority like Apple does. Huge difference in the two. Google did buy Android but basically in a nutshell gave it away for everyone to use. Hence the AOSP. And read the agreement you linked to and contributor agreement. Read it. Once you submit to Android and have an agreement with them to add to Android, it is now open and free and you can not charge for it.

Here is it simply put and we can use Magisk as a model." John created Magisk. He owns the repo where magisk is but doesn't own Magisk because it is open source." Now change the names John to Google and Magisk to Android in above statement. That is Google and Android in a nutshell. The agreement you agree to with Google is you can't come back and claim ownership and charge for your contribution. GitHub works the same way. The contributors don't charge John and or us, they don't own their commit once it is out in. They also have agreements on GitHub about releasing it public and what it takes. Look it up, Google bought Android Inc. Took the top players, developed it and made it open source where they don't own it. They own the distribution for it. You agree to allow them to distribute it if you contribute, not allow them to own anything, you make it open source like Android. I read the links.
[Magisk] zgfg:
Ok, so I didn't fully understand two of your points (and/or want to be sure about)

- You think that G wants to go against all modding that requires the unlocked Bootloaders, not just root but also against custom (non-stock) ROMs

- You think they could or they couldn't properly distinguish custom ROMs (but with the spoofed fingerprints), or they actually don't care about (caring only about the fact that since Bootloader was unlocked, that pandora box was open by that user)
[Magisk] timofonic:
I believe they are against it too.

They need it for major content distributors.

Game publishers, Netflix, Disney, etc.

You'll see it, we're doomed. Alternative hardware is the only escape.
[Magisk] dd805bb:
No he actually isn't. He is thinking about his future and I think he is doing what is right for him. He is a smart guy with a bright future. If he was against us the repos would be gone. They are still there. He is proud of the work he has done on Magisk. But you can't make something that bypasses the very team you now work for, security. The conflict of interest at Google is huge. These few devs trying to get people to think it's not is a complete lie. The way it all broke down I think he thought for a day he could do both, went back to Google and they said nope, no more Magisk. If he really sold everyone out he would of ghosted his Twitter and all his SNs over different social media started new, he would have taken down the repos and also stop claiming he created Magisk. He did none of that. But please believe, he knows how Magisk works, and if he is working on security, only a matter of time till he wants brownie points and wants to move ahead. That may mean telling them how he did it. That may mean Magisk in any form will stop working someday. No matter who forks it. They know where the code is that we use and they pull it apart like we pull apart Android and find ways in. Cat and mouse game for sure is still on. But if you scroll back, I stated he was done and got fried by everyone on here including a dev who was still giving out false information about John and I know for fact he heard straight from John already what was going down. Really shady.
[Magisk] AndDiSa:
"They" are not against "us" ... Google provides by Android an environment where content providers (banks, shops, ...) can offer their products and where consumers (us) are able to use what the providers are offering. Some of the content providers have demand for higher security standards while others do not care so much about it. Google plays two roles here: as the provider of the platform and as a provider for content / services.

Just this situation shows that Google is not equal to Google but depends much on the point of view. As a platform provider they would like to be open but some of the services they are providing require a higher security standard (e.g. Google Pay). Nevertheless from my point of view there are possibilities to provide secure services even on a potentially unsecure environment (otherwise nobody should be allowed to use a PC to do home banking ...) but it's easier to implement secure services if you can move the security to a different layer / relay on a secure environment.

Here TEE / SafetyNet comes into play: for the service provider it's more easy to check whether the environment is secure. Principally SN is nothing else than an additional service Google is providing to content providers to ease the check of a secure environment and as long as TEE is not enforced this service is almost useless and content providers implement their own methods to check the secure environment ...
[Magisk] ipdev:
When you root an Android device, you are only gaining access to root.

Root exists in all unix/linux based builds.

When you build an Android system you choose a build target.

Choosing a target.android - source.android - Link

Buildtype	Use
user	Limited access; suited for production
userdebug	Like user but with root access and debug capability; preferred for debugging
eng	Development configuration with additional debugging tools

A userdebug build will include adbd that allows you to run adb as root.

If you look at Implementation of SELinux. source.android - Link

You will see commands run as root by using the su command.

adb shell su -c dmesg | grep 'avc: '

Consumer releases are user builds.

Restricted access.

This would be the same on BSD, Linux and MacOS.

A regular user account will not have access outside of the permissions or groups the account has been added to.​

Root is still there but, as a user you have no access to it.

System processes still run with heighten (root) permissions.

If you use a terminal app (or adb shell) and list the files in the system directory.

ls -la /system/

You will see the owner and group are root.

---

When you root your device, you are installing a daemon that allows root access.

Most think su is root but, it is just a command that allows you to run as a substitute user.

When called with no user specified, su defaults to running an interactive shell as root.

There is more that goes into it than just adding a su binary to gain root access.

The developers that create the root access methods for Android are in a class of their own. ;)

Hope that clarifies what I mentioned in prior posts.

Cheers. :cowboy:
[Magisk] dd805bb:
System has root. That isn't us having root. Root on a desktop,(different desktop OSs implement ways of gaining root through terminal), is open. Any user using the desktop machine can gain root. Yes Android has a root directory and apps can ask for elevated permission through system processes to access the root directory, but root in the sense of a desktop and us using root on android it is not there. Abd doesn't allow instant root access on an unmodified system. You are talking a userdebug which has root access given to it. That is basically modified to allow you that adb root access. That isn't a locked bootloader and running the OS factory. That is going in and getting a different build up and running with an unlocked bootloader. And that is then running into every problem that we have now with Magisk and root. And no mechanisms to hide basic integrity and cts profile or, like some pixels are doing on A11, going to hardware based checking. That is not factory Android, that is a special user build to allow that. If you didn't have a userdebug build, root on adb is blocked. Root is blocked until you unlock your bootloader and go down the same road as rooting your device.. "step 1 unlock your bootloader." Unless you know how to flash the bootloader and without unlocking it.... But the link you shared is about building your own system and custom kernel policies. Things that can not be done on a locked bootloader and I think you are missing my comparison between the two and keep trying to justify the misguided information about Android. You are going out I to left field with all these steps to do which mirror how to root. I am talking about factory user images, a phone clean just kicked on, you can not access root and or have root like a desktop unless you unlock it and lose the security to access things you can normally access on a desktop. That was my point. You keep bringing up these things that really don't even hit at a rebuttal to anything I said. You keep trying and trying to prove yourself. I am not talking about building your own kernel from source, modifying it to act a certain way, I am talking factory locked bootloader and a fresh factory phone you can not do what you can on desktop. So many things to access root directory on a Android. The simplicity of a desktop to Android is what I am getting at. And in a way actually proved my point by everything you have shared and said because none of it is just opening a fresh phone with factory image gaining root.
[Magisk] ipdev:
Just to note.

Netflix does not require Google Play Services or a certified device.

You can use Netflix on a device without GApps. ;)

Cheers. :cowboy:
[Magisk] dd805bb:
Yes you can, to a point. You have to get their app which is ancient, be regulated if I remember right to 720 and can not download anything. Also once you back out of the app it loses it place where you were and will redownload what was stored to play again. That is something to post about. Only if we were all born yesterday.. I believe their version if I remember correctly is a tablet version APK too. Not device specific which in turn gives many many issues. But hey it works.
[Magisk] ipdev:
Then I missed your original point.

Do you even use Netflix?

I run the current version on a Nexus 10.

LineageOS 16. No GApps. No Magisk.

I and others run Netflix on Google non certified devices.

By not limiting it to Google, Netflix can take money from more users. ;)

Cheers. :cowboy:

PS.

If you need a current version..

[SAI][TWRP][STABLE][BETA] Netflix - Latest Versions xda Thread - Link
[Magisk] dd805bb:
Yes it does use Gapps. Might want reread what you install. They have you install split apk installer to install multiple apks. Which one uses Gapps. Good try though. Reread what you are doing.
[Magisk] ipdev:
Installing split apk files has nothing to do with GApps.

I will not expand on it since it is OT and I do not want to come off as proving myself.

Cheers. :cowboy:
[Magisk] zgfg:
Do you know what the split or bundle apk means?!

If not, please google for and read the whole story behind the official Google SAI = Split Apk Installer

E.g., when you install YouTube, it actually consists of several apk pieces. Based on your chipset architecture, your language, etc, Google Play tailores you particular pieces (apk files) that fit your environment. Otherwise, if they would have to pack everything for everrybody into the single YT apk file, that would be a big apk file taking long download and consuming unnecessary space on Data for all users

Navigate to your /data/app folder with the YT application and count how many apks do you see there (assuming you have the YT app installed or updated from Google Play, not only the pre-installed stock YT version on System,Vendor or Product)

Or go to apkmirror, search for YouTube and find the split apk versions there (all are the official ones, as everything on apkmirror). Since apkmirror is not the official GooglePlay, they have their own split apk installer you have to download and install to your phone to be able to install a split/bundle apk package (e g. the YT) you downloaded from the apkmirror

Or google for (what is that and how to use it):

adb install-multiple <split apk files >

The screenshot shows the content of that split/bundle Netflix installation. It contains the main Netflix app (base.apk), arm64_v8a (architecture) part, parts for Deutsch and English languages, and dots-per-inch (resolution) part - where do you see the GApps squeezed into that bundle?