The microG creator goes into more detail about signature spoofing at https://github.com/microg/GmsCore/issues/1467#issuecomment-8... The concerns usually raised against that are due to the "default" patch included in their repository, which has a specific purpose.
We don't use that, https://calyxos.org/about/tech/microg/ are the precautions we take to try and prevent "weakening overall package security"
In addition, microG is optional and can be disabled on first install, see https://calyxos.org/features/microg/#1-microg-disabled
As someone who also accidentally pastes my local dev URLs from time to time, I feel your pain ;)
For everyone else: that's https://calyxos.org/features/microg/#1-microg-disabled
I would like if there was stronger privacy laws or antitrust orders that force Google to open their service provider API's so people can choose alternative location/push providers, but this doesn't seem like it will exist soon.
For many users, it's going to be the best usability compromise to use minimal play services and use apps that don't send content over the push networks (signal is like this, element can be configured this way).
It does not, you can update system-apps out of band just fine.
Google does it with Play Services (and many other apps), and we have our microG builds in our F-Droid repos for out of band updates.
In fact, that is one of the big selling point of Play Services - the fact that it gets updated outside of OS updates, which means that you have a recent / the latest version on all devices regardless of their update record.
And therefore anything implemented in Play Services can be used even on older Android versions.
Everyone knows that.
I'd like to see people make their own apps that don't rely on Google services (or faked Google services) of course, like the Linux ecosystem.
Also, for this reason I shy away from alternatives to LineageOS which include microg by default. I don't want it.
It seems like what we really want here is for the app to implement its own notifications without going through Firebase. All you need for push rather than polling is an open socket...
Do push notifications require microg/google? A communications device (as opposed to a media player) that didn't have push notifications would be missing something required, in my use.
It's my understanding that alternatives to google's location services exist.
I'd just like a phone that allows me to chat/use apps/gps (let's put cell service to the side of a second) without being an OS-wide, logged-in, analytics tracker.
I've said it before and saying it again on here for those that don't know: microG breaks the security model on android and adds in package signature spoofing. It's the only way to add a fake Google Play Services without needing to pull Google blobs. This is why projects like LineageOS are against using this method, it weakens overall package security.
However, it is still possible for the tinfoil hat crew to not use Google play services with OS like LineageOS. This will of course break some functionality (apps will have to poll instead of relying on push) but it will not break the security model.
I'd like a different, better set of options to choose from but we don't have it at this time. Most users should probably choose a minimal Google Play distribution if they value things like battery life and working apps while still maintaining protections against spoofed apps.