# Some questions about Custom ROMs **URL:** https://discuss.privacyguides.net/t/some-questions-about-custom-roms/27608 **Category:** Questions **Tags:** software **Created:** 2025-05-15T17:15:23Z **Posts:** 14 ## Post 1 by @Shade — 2025-05-15T17:15:23Z Hi, I want to ask about the custom ROMs to be specific GOS and CalyxOS. Which is better in your opinion and which one is trust worthy? I mean no offence to any of the two OS they both looks amazing, I just was thinking they are doing all this hard work and provide great services and apps, all for free, no buying, no subscriptions… I just got curious. my question also about Sandbox in GOS vs MicroG in CalyxOS. I heard Sandbox is better in both privacy and secure… why is it better? as I saw MicroG has Spoofing and you don’t have to log in to play store, As for me when I tried GOS, I had to download the sandbox then I had to log in to the snadboxed play store… so I thought What’s the point if I’m going to log in to google… what would I lost of privacy or gain if I loged into sandboxed play store? I didn’t understand why sandbox is better while in MicroG I don’t have to sing in… I thought of using GOS with MicroG but some people didn’t recommend MicroG… I feel lost again I mean no offence to any of the creators of these programmes I just feel lost and I don’t know who to trust and what’s better and why. If you have any answer, advice or anything will be appreciated. Thanks --- ## Post 2 by @jonah — 2025-05-15T17:23:12Z > [@Shade](#): > > Hi, I want to ask about the custom ROMs to be specific GOS and CalyxOS. Which is better in your opinion and which one is trust worthy? > **[The Best Android Operating Systems - Privacy Guides](https://www.privacyguides.org/en/android/distributions/)** > > You can replace the operating system on your Android phone with these secure and privacy-respecting alternatives. > [@Shade](#): > > As for me when I tried GOS, I had to download the sandbox then I had to log in to the snadboxed play store… so I thought What’s the point if I’m going to log in to google… Just don’t sign in then. If you install sandboxed Google Play you can benefit from some Google services without signing in, **just like with microG** , _and_ you can obtain apps from an alternative store like Aurora without signing in. **This is why we don’t list the Google Play app here** even if you’re using sandboxed Google Play on GrapheneOS: > **[Obtaining Applications - Privacy Guides](https://www.privacyguides.org/en/android/obtaining-apps/)** > > We recommend these methods for obtaining applications on Android without interacting with Google Play Services. There are still many benefits to this setup compared to system microG. The biggest benefit is that you can isolate Google-related services to specific profiles: > [@Common User Profile Setups for Android](https://discuss.privacyguides.net/t/common-user-profile-setups-for-android/27364/1): > > To preserve your privacy, the most commonly recommended “minimum” setup for multiple users on Android _with GrapheneOS_ is a two-user setup, where only one secondary user has Google Play Services installed. > > In this setup, the system user only contains apps that don’t require Google Play Services, like open source apps installed with [Obtainium](https://www.privacyguides.org/en/android/obtaining-apps/#obtainium) or [F-Droid](https://www.privacyguides.org/en/android/obtaining-apps/#f-droid). The secondary user would contain apps from [Aurora Store](https://www.privacyguides.org/en/android/obtaining-apps/#aurora-store) or the Google Play Store that rely on Google Play Services, such as some banking apps, social media apps, etc. > > This configuration is really only viable with GrapheneOS and sandboxed Google Play (or [another](https://pr3017.unreviewed.privacyguides.dev/articles/2022/04/21/grapheneos-or-calyxos/) custom ROM with non-system microG) because that setup doesn’t require Google Play Services be integrated with the system. On your typical stock Android device, Google Play Services will be installed with system-level permissions, meaning that it will be present in all user profiles on your phone. If you use microG on CalyxOS or other custom ROMs, microG is installed across the entire system and accessible to any app you install, even if you don’t want that app communicating with Google’s services. --- ## Post 3 by @anonfox — 2025-05-15T21:25:46Z It’s disappointing CalyxOS still doesn’t use the sandboxed MicroG DivestOS made --- ## Post 4 by @Shade — 2025-05-16T04:19:28Z I don’t know about this. Can you install this Sandbox MicroG and What’s different between it and the normal one? --- ## Post 5 by @anonfox — 2025-05-16T08:14:40Z No, you can’t install it. It’s something you could previously use in DivestOS. The difference between it and the normal MicroG is that it’s sandboxed with no extra privileges, just like the GrapheneOS sandboxed google play implementation, but using MicroG. --- ## Post 6 by @anon54690201 — 2025-05-16T12:27:30Z Hey Jonah, There are many people in the GOS community (not judging) who disagree with anything but sandboxed google play store. Meaning very against the aurora store. Is there any validity that it should be avoided because the sandboxed google play is more secure? --- ## Post 7 by @anon42475305 — 2025-05-16T12:53:44Z Yes it has poor security and little if any privacy benefit. Because they reverse engineer the play store + use anonymous accounts there is a real risk it breaks and you will no longer be able to receive app updates. This is a major security issue since keeping your devices and apps up to date is the bare minimum for a reasonably secure system. They also don’t verify security metadata which they consider low priority and fail to mention in their list of shortcomings… > **[Issues · Aurora OSS / AuroraStore · GitLab](https://gitlab.com/AuroraOSS/AuroraStore/-/issues/?sort=created_date&state=opened&search=verify&first_page_size=100&show=eyJpaWQiOiIxMTc3IiwiZnVsbF9wYXRoIjoiQXVyb3JhT1NTL0F1cm9yYVN0b3JlIiwiaWQiOjE1MzE1MDE5OH0%3D)** > > An unofficial FOSS client to Google Play. You are way better off just using a purpose made Google account with sandboxed Google Play for obtaining any apps which you can’t get from Accrescent. --- ## Post 8 by @jonah — 2025-05-16T13:11:03Z I would say the Aurora Store should be avoided for a variety of reasons, but this is a very minor one. The biggest problem is that Google Play is a dangerous source of applications in the first place, because most apps are now built and signed by Google instead of the developer (meaning Google holds the app’s private keys via Play App Signing and can distribute any version they’d like to any user). --- ## Post 9 by @any1 — 2025-05-16T13:32:04Z When did the switch happen to google signing it themselves? --- ## Post 10 by @anon54690201 — 2025-05-16T13:34:53Z well that doesn’t sound good! --- ## Post 11 by @jonah — 2025-05-16T13:50:13Z It’s required for new apps since mid 2021, and “encouraged” for all apps otherwise. Last year there was an issue where Google attempted to strong-arm VLC into uploading their private signing keys to Play, giving them the “choice” between doing that or cutting off security updates to some of their users. Obviously both present big security problems, but Google doesn’t care about security. --- ## Post 12 by @sha123 — 2025-05-17T11:37:12Z > [@jonah](#): > > Google doesn’t care about security. That’s ridiculous. They provide provide excellent security with AOSP, Chromium, gVisor, Project Zero and other projects, which shows that they actually care. --- ## Post 13 by @Regime6045 — 2025-05-21T09:59:34Z > [@anon42475305](#): > > [Aurora Store has] little if any privacy benefit. Not needing a Google account is an important privacy benefit for me, personally. Usually Google also requires a phone number for creating an account, although some people got lucky creating an account through the Play Store app and on a “clean” IP. > [@anon42475305](#): > > there is a real risk it breaks and you will no longer be able to receive app updates Sure, but the risk of Aurora breaking without you noticing and you not getting app updates for a while without noticing and then someone hacking you because one of your apps hasn’t been updated in a few days/weeks… idk but for me that’s a risk I’m willing to take. --- ## Post 14 by @anonfox — 2025-05-21T13:50:58Z > [@Regime6045](#): > > Sure, but the risk of Aurora breaking without you noticing and you not getting app updates for a while without noticing and then someone hacking you because one of your apps hasn’t been updated in a few days/weeks… idk but for me that’s a risk I’m willing to take. They can probably eliminate this risk by subscribing to their [atom feed](https://gitlab.com/AuroraOSS/AuroraStore/-/releases.atom).