These are merge commits generated by merging a PR from a private security fork created for GitHub Security Advisories.
These commits match the advisories published 3 weeks ago:
https://github.com/microg/GmsCore/security
In MicroG: Free-libre re-implementation of Google's proprietary Android user spacemicrog
GmsCore
Java2015–2026
microg / GmsCore
GmsCore
Free implementation of Play Services
56Distinct people
71Mentions
0Explicit recommenders
15.3KGitHub stars
What to know before exploring
What it is
Free implementation of Play Services
GitHub
Where it is used
- CalyxOS — CalyxOS uses microG to provide a Google Play Services alternative for core services like notifications. This integrates microG into the OS as a built-in feature. Source
- /e/OS — /e/OS ships microG as part of the OS to run apps that require Google Play Services. The page explains microG provides these APIs through GmsCore, which /e/OS includes by default. Source
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 1:49:46 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year71 dated mentions
Observed mentions: 2015-11-03 13:17:03 UTC to 2026-10-21 00:13:13 UTC.
* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 5 | 0 | 5 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 7 | 0 | 7 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 9 | 1 | 8 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 9 | 1 | 8 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 7 | 1 | 6 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 5 | 0 | 5 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 4 | 1 | 3 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 6 | 1 | 5 |
| 2026 (partial) | 2026-01-01 00:00:00 UTC | 2027-01-01 00:00:00 UTC | 12 | 3 | 9 |
From the project README
An excerpt from the repository, fetched Nov 13, 2026.
Read the project’s introduction
microG Services
microG Services is a FLOSS (Free/Libre Open Source Software) framework to allow applications designed for Google Play Services to run on systems, where Play Services is not available.
Please refer to the wiki for downloads and instructions
Translations
If you'd like to help translate microG, take a look at TRANSLATION.
License
Copyright 2013-2025 microG Project Team
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
Read the full README on GitHubWhat Hacker News says
71 sources> It downloads and runs droidguard with the privileges it has, giving that full access to the privileged access granted to microG.
Wow, no kidding! I checked the source code and sure enough, it downloads the DroidGuard APK from Google[0], and loads a class from it[1], (seemingly?) without any kind of sandboxing or separation. I believe I'm safe because I don't have the Play Integrity API enabled, but I really wish the UI was more explicit about this, because the info text only says
> microG GmsCore contains a free implementation of SafetyNet, but the official server requires SafetyNet requests to be signed using the proprietary DroidGuard system.
[0]: https://github.com/microg/GmsCore/blob/32bc8954ff872d0e1a05d...
[1]: https://github.com/microg/GmsCore/blob/32bc8954ff872d0e1a05d...
In MicroG: Free-libre re-implementation of Google's proprietary Android user space"Sandboxed" Google Play still gets everything that the other apps in the same profile offer up to it / to Google. I don't understand how you're gaining any privacy as a practical matter. The issue isn't GApps' privileged access to the system, it's that other apps send your data to Google via Google Play Services.
To take some examples, MicroG stubs out the analytics and ads APIs. Your "sandboxed" Play would send that data to the mothership and return with ads.
https://github.com/microg/GmsCore/wiki/Implementation-Status
https://github.com/microg/GmsCore/blob/32bc8954ff872d0e1a05d...
In MicroG: Free-libre re-implementation of Google's proprietary Android user spaceMicroG: Free-libre re-implementation of Google's proprietary Android user space
431 points · Open discussionPeople are way ahead of you.
https://github.com/microg/GmsCore
In Android apps running native on macOSMicroG: [Bounty] RCS Support [$14999]
1 points · Open discussionI’m using microG without signing in. Could you tell me a bit about what apps you’re using that you’re having trouble with?
A good way to sidestep all those issues is getting your “everyday” apps from F-Droid :-) I’m only using Aurora Store for things like banking, taxi, or food delivery apps, and those are usually working great. Some banks are more trigger happy (shame on you, Revolut) while others seem to be okay. I really only miss Google Wallet.
microG folks are working on Play Integrity, but it’s an ongoing battle: https://github.com/microg/GmsCore/issues/2967
In AnkiDroid: Google Play no longer allowing Open Collective donation linkThere’s been some progress over at microG, however not fully reverse engineered obviously, and I wouldn’t hold my hopes up for now: https://github.com/microg/GmsCore/issues/361
In A big win for Android interoperabilityRCS is a "standard" in name only – $15k bounty trying to break Google's lock-in
2 points · Open discussion> open-source means auditable privacy
This is what that auditing actually reveals:
* /e/OS sends user speech data to OpenAI without consent [1], and thought this was ok until they got caught [2].
* /e/OS massively delays security patches, and calls this a "standard industry practice" [3]. Meanwhile, GrapheneOS' opt-in security preview releases provide early access to security updates prior to official disclosure [4]. Also see [0] (Security update speed) and [7] (WebView being 40 security updates behind).
* microG downloads and executes proprietary Google binaries in a privileged environment [5] [6]. You can obviously not audit these, nor should this count as "degoogled".
* microG still phones home to Google by default (android.clients.google.com for device registration check-in, mtalk.google.com for FCM push, firebaseinstallations.googlea
Read the rest
pis.com for SIM activations) [7].
[0] has a comparison of popular privacy and security-focused Android-based OS, which paints the whole picture. Privacy-friendly does not necessarily mean secure, but in this case "privacy-friendly" is quite a stretch already.
[0] https://eylenburg.github.io/android_comparison.htm
[1] https://grapheneos.social/@GrapheneOS/114880528716479708
[2] https://community.e.foundation/t/clarification-about-voice-t...
[3] https://community.e.foundation/t/e-os-and-security-updates/7...
[4] https://discuss.grapheneos.org/d/27068-grapheneos-security-p...
[5] https://github.com/microg/GmsCore/blob/e19a9985204ec8329c1d9...
[6] https://github.com/microg/GmsCore/blob/e19a9985204ec8329c1d9...
[7] https://www.kuketz-blog.de/e-datenschutzfreundlich-bedeutet-...
Wallet app is still impossible to get working, but there’s been some development recently: https://github.com/microg/GmsCore/issues/361
Some other apps are often willing to accept my current setup (Lineage for microG [0], plus Magisk, if you don’t need root – Magisk Hide does some magic I don’t really understand, but even without Play Integrity passing, apps just start working).
With more tweaks, you might be able to get Play Integrity to work to some extent, but it’s hit or miss. I’ve just stopped using apps that demand it.
[0]: https://lineage.microg.org/
In GrapheneOS – Break Free from Google and AppleIt's unfortunate that RCS is basically a de-facto Google walled garden in most countries. On android you can only use RCS in the Google Messages app and trying to build your own is explicitly blocked. [1] And of course the bonus that rooted devices are banned from RCS. All the propaganda Google spread to get Apple onboard (only with Google's blessing of course, Google could kick apple off if they wanted) was such a big win for them.
As a business I wanted RCS to be a simple upgrade to SMS, but instead they came up with this mess. Businesses using RCS for Business can send messages to anyone, but customers wanting to get in touch with your business can't. They can only reply to a message you sent first. And of course Google is the gatekeeper for anyone to be allowed to use it.
1. https://github.com/microg/GmsCore/issues/2994
In RCS for BusinessIf you need something permissively licensed, I believe microG also has implementation of the notification protocol: https://github.com/microg/GmsCore/blob/cb9be8f682d7649dae23b...
It's Apache 2.
In Molly: An Improved Signal AppI install MicroG (on my LineageOS on Pixel) which allows me to install my UK banking apps and Google Maps, etc. MicroG just reimplemented the Google APIs:
> microG GmsCore is a free software reimplementation of Google's Play Services. It allows applications calling proprietary Google APIs to run on AOSP-based ROMs like LineageOS, acting as a free replacement for the non-free, proprietary Google Play Services (sometimes referred to as the more generic term "GApps"). It is a powerful tool to reclaim your privacy and freedom while enjoying Android core features (although apps you use that take advantage of it may still be using proprietary libraries to communicate with microG, just as they do when communicating with the actual Google Play Services).
Source: https://github.com/microg/GmsCore/wiki
I add the official MicroG repo to my F-Droid u
Read the rest
sing this QR code: https://microg.org/fdroid/repo/
Also, I download apps (like my UK banks) from official Play store using Aurora Store, which connects to Google servers directly to download the APKs, keep them updated, etc. No need to use those dodgy APK websites. Aurora Store is itself also available on F-Droid too.
I guess in time Google will target these apps :(
There are a few more bounties like this out there.
1. Tenstorrent https://github.com/tenstorrent/tt-metal/issues?q=is%3Aissue%... $200 - $3,000 bounties
2. microG https://github.com/microg/GmsCore/issues/2994 $10,000 bounty
3. Li Haoyi https://github.com/orgs/com-lihaoyi/discussions/6 multiple bounties (already mentioned upthread)
4. Algora also hosts bounties for COSS (Commercial OSS) https://algora.io/bounties
In Notion API importer, with Databases to Bases conversion bountyShowing the 15 most recent of 71 sources. Enable JavaScript to search and browse every indexed mention.