[OnePlus 3T ROMs, Kernels, Recoveries, & Other Deve] anupritaisno1:
There's a blank reserve partition on the device. This partition is used for storing dm-verity metadata and the crypto footer but

Op3 doesn't use this partition to store the metadata

The crypto footer is the last 16 kib of the userdata partition

By spec the FRP bit is the last byte on the config partition on the op3. You can take that code as an example and use it to write a value out the the reserve partition which can then be read by the ROM installer

Backuptool is actually disabled by default. It is only shipped if the --backup=true argument is supplied to ota_from_target_files.py

Look for a commit "releasetools: squash backuptool support" in build/make or grep for "backup=true" in build

Webview discussion will be added in the next post I write

Actually that's quite a bad idea. Let us say you do define a DNS. A DNS server is as secure as your entropy source can be but if you're running on a vhost or some VPS you're not going to really have great entropy. The only way to make it secure would be to run a private DNS server yourself

True, you could buy a dedicated server, use Intel's probably backdoored entropy generator and mix it with haveged to get an almost random source but I'd leave that up to you

For DNS i just have a general rule:

"Any public-facing DNS server is inherently insecure"

I don't really care what you think about this. It's just my opinion and that's it

While I'm at it here's my DNS server configuration

server:
use-syslog: yes
do-daemonize: no
username: "unbound"
directory: "/etc/unbound"
trust-anchor-file: trusted-key.key

num-threads: 4

#list of Root DNS Server
root-hints: root.hints

#Respond to DNS requests on all interfaces
interface: 0.0.0.0
interface: ::0
do-ip4: yes
do-ip6: yes
do-udp: yes
do-tcp: yes
max-udp-size: 3072

#Authorized IPs to access the DNS Server
access-control: 0.0.0.0/0 allow
access-control: 127.0.0.1 allow
access-control: ::/0 allow
# Hide DNS Server info
harden-short-bufsize: yes
harden-large-queries: yes
harden-below-nxdomain: yes
harden-referral-path: yes
harden-algo-downgrade: yes
use-caps-for-id: yes
val-clean-additional: yes
hide-identity: yes
qname-minimisation: yes
hide-trustanchor: yes
hide-version: yes

#Limit DNS Fraud and use DNSSEC
harden-glue: yes
harden-dnssec-stripped: yes
harden-referral-path: yes
aggressive-nsec: yes

#Add an unwanted reply threshold to clean the cache and avoid when possible a DNS Poisoning
unwanted-reply-threshold: 10000000

#Minimum lifetime of cache entries in seconds
msg-cache-size: 128k
msg-cache-slabs: 2
rrset-cache-size: 8m
rrset-cache-slabs: 2
key-cache-size: 32m
key-cache-slabs: 2
cache-min-ttl: 3600

#Maximum lifetime of cached entries
cache-max-ttl: 14400

This is a configuration file for unbound

This was taken from an archlinux machine. You'll have to read your distribution's docs before you use it

It enables all the security features cloudflare and Google employ and enables a few more

A good entropy source is a must for running a DNS server

---------- Post added at 23:12 ---------- Previous post was at 23:04 ----------

Actually glassrom has a very liberal stance on this and doesn't force the user to stay with any single configuration. You can boot without gapps, use microg and still use chrome's proprietary webview as a user app or you can just install the bromite webview to the system yourself

You can flash whatever gapps and so on

In other words there's no single "correct" way to use glassrom. Users often decide what they want and surprisingly few users actually use microg

I have these users:

Users who flash gapps (that includes me)

Users who don't flash gapps at all

However I don't know of anyone who's using microg on glassrom. Yes there is streetwalrus who added the microg support commits to glassrom but he does his own private builds and uses an op2 so I only know that the feature itself works but nobody really has used it on the op3, at least on glassrom that is

So I'm sorry about that. I cannot answer this question

In my testing GPS was fine but that was with the opengapps stock package

---------- Post added at 23:16 ---------- Previous post was at 23:12 ----------

After the bootloop immediately go to TWRP and copy all files in /sys/fs/pstore

Note that during bootloops there's often a fair bit of memory corruption going on too so you might have to reproduce the bootloop at least 3 times and collect 3 unique logs

While these logs usually do not contain any personally identifiable information it is best to submit these in private

---------- Post added at 23:32 ---------- Previous post was at 23:16 ----------

Another addition: do not edit the global updater-script unless you have a proper reason to do so

Example commit: https://github.com/GlassROM/android_build/commit/d335bccd682a4db8732f53a48078d4fd1e71cc09

You should instead edit releasetools.py in your device tree and only make changes to this file if absolutely required