[OnePlus 3 & 3T Cross Device Development] MSe1969:
Yes - eventually, my 16.0 builds will be deprecated. See my comments below...

Lost features in LineageOS 17.1

As mentioned in my previous post about the LineageOS 17.1 Test build, a couple of features are lost, and I would like to share some comments about them. Android 10 in fact does have some security improvements under the hood, so if there aren't any hardware restrictions of the device hindering you from moving on, there is always a time to consider moving on. I am definitely not within the early adopters, but I have now worked on it.

LockClock:

The Chronus app (play store) comes from the same authors and is the "by far better" LockClock app, if somebody (like me) likes it - with enabled Google blocker, it only nags sometimes with an "update playservices" notification.

Privacy Guard:

I have tried to port Privacy Guard to my 17.1 build and thus learned the "hard way", why it hasn't been ported to LineageOS 17.1 by the LineageOS devs. I "somehow" consider this also as a loss (if you scroll back a while, you will find also a statement from me), but to be honest, in the last 1-2 years, I hadn't actually really used it, except for the Sensor restrictions, for which I ship a replacement feature.

I meanwhile simply don't want to use "hostile" apps - in fact, there are for almost every purpose FOSS apps or at least apps with decent behavior; and I don't know, whether you can truly control a privacy-hostile app with PG, there are still too many possibilities for such apps. I could also observe that PG had some "glitches" (try e.g. disabling the coarse location AppOp while still granting location permission or watch apps definitely not using location appearing in the coarse location stats) and a knowledgeable person also explained me, that certain AppOps aren't fully implemented in all code places and partly (e.g. background) could be misunderstood.

In fact, the ApOps API is still there, PG was only a GUI frontend and the really nice feature was the "ask mode".

Nevertheless, for certain "lab" conditions, where you would have to e.g. block access, while still granting the permissions, you can still use the 'appops' shell commands via adb - e.g. I remember having read somewhere, that the Instagram app (*yikes* such crap will never find its way to my phone!) insists on first stealing your contacts to initialize (i.e. does not initially launch until you grant contacts permission), before it allows you to revoke that permission again.

As you can see for the Sensor restrictions, I can still make use of the AppOps API for special cases (unfortunately, only without "ask mode"), so if you give me a solid reason, why certain AppOps should be user-switchable, I can for sure implement further such AppOp functionality - similar to the Sensor restrictions.

Root AddOn:

During my attempt to port PG, I found one big show stopper being the inability to re-implement the ask mode (without going in too much details, but two protected methods of formerly the same class belong now to two different classes in Android 10). As the LineageOS Root AddOn was based on Privacy Guard's "ask mode", I gues that was the main reason for LineageOS to drop this (there have always been rumors anyhow, that this was exploitable). So - following LineageOS's official guidance - if you want root, flash Magisk.

My own philosophy was in my builds to deliver useful features requiring root as part of the system with customized SEPolicy rules (e.g. adblock, blocking scripts, firewall), so I also did not really use root on my device recently, except for analyses/debugs via adb, which still is supported.

Native WireGuard support in Kernel:

I have learned recently (scroll back a bit), that you need to grant root access to the WireGuard app, to allow making use of the native WireGuard kernel support. (I originally thought it was the other way round). Hence shipping a feature, for which you would need to first flash a root solution in order to be able to use it, does not really make sense to me! You can still use WireGuard w/o root via the WG app as an ordinary VPN.

Unless you show me an easy way, how to make use of native WG kernel support w/o needing to flash a root solution, I will be glad to reconsider my decision.