Hi 👋, I wanted to clarify one point in case there was any confusion from the video. User profiles are isolated workspaces with their own instances of apps, app data and profile data (contacts, media store, home directory, etc.). I think showing that the app manager is at the system level might have caused some confusion. User profiles are isolated workspaces. This is a *loose* comparison, but if you've ever user a Windows computer and create additional users, Windows is not creating a unique Windows installation for each user. Certain things are shared at the system level, but the user data is kept isolated. The GrapheneOS docs (grapheneos.org/features#improved-user-profiles) and Android docs (source.android.com/docs/devices/admin/multi-user) have some more information on User profiles if you're looking for some reading material.
😮 This comment totally undid what the video showed. Comparing the OS (windows) installion to an app/program installation is not good. Either there are multiple copies if the app or not.. 😢 I get it that user data is separate but really if there is one install of the app what prevents the app from see all of its users? Now I feel dirty😂😂😂😂
Man, your video was absolutely PERFECT to help me fix the version issue. Your example was IDENTICAL to what I was experiencing. Thanks so much....latest SUGGESTED version from Search downloaded and installed successfully in my other User Profile. Thanks so MUCH!!!
Thanks for this! Just got the pixel 8 and put graphene and wanted to put maps into a separate user profile and this issue came up. Watched your video and got it working great!
Unfortunately, this lazy behaviour of hosting outdated versions of software is all too common. Literally 30 minutes ago, I downloaded Samsung Magician to see if there was an updated firmware for my SSD. After downloading, installing & launching the newest version available, I was immediately met with "There is a newer version available". What a waste of time, just present me with the latest version...
Doing gods work! This also explains why my Simplenotes got absolutely jacked up when i attempted to use 2 separate accounts on 2 different Android profiles a few years ago. It must store the notes in a system folder somewhere rather than in the work space. I dont know if this also happens with other apps but its probably worth watching out for.
I asked some questions in the GraphneOS Matrix Channel. If I had a second user on my phone, and if this space had Google Play Services installed, would there would be back-and-forth communication for apps with the first space and vice versa. At first, I got multiple responses saying that yes, in fact, this happened. I then kept asking and got this, whatever it means: ( If app A in the first profile has a server that can be accessed via localhost, then app B in the second profile can access that server, and vice versa (if they both have network permission). Does this mean that apps in the second user account not work profile can read the apps and other settings on the first user account that does not have gplay installed? I am confused. Can you help clear this up please.
Great video bud, is there a way grapheneos devs could seperate packege manager for each user profile. Do u have good contact with th devs, could u propose it to them!?
From what I understand, this is a fundamental to how Android is designed to work. Since apps are installed at the system level, this allows for the downgrade protection. Another protection I didn't mention is pinning the signing certificate of the app. Since this is done at the system level, another inferior/malicious version of an app with a different certificate could not be installed in another user profile. This page has some great information if you're interested - hub.libranet.de/wiki/and-priv-sec/wiki/apps As far as good contact with the devs, no. I intentionally keep my distance, so I don't come across as biased in my content.
Why don’t you volunteer to help them. I despise companies that claim they do not have enough help and yet will not accept and help. Too many out there like that. So FOSS should take a back seat if the developer gives up on the project. Thanks for the pointers.
This specific issue isn't something a volunteer contributor could assist with. It's a choice by the project to intentionally host an outdated version on the main page. In one of the forum posts, they mention the reason they do it is for "Stability reasons, eg. not push new users to use the latest versions".
I've tested shelter in the past for a video, so I'll use that as the example. Shelter installed & configured in your Owner user profile will only be able to apply the Work profile in the Owner use profile. So while the shelter app would be installed system-wide as I showed in the example, the actual work profile it creates/manages would only be in the User Profile it was configured in.
Do you know if the way that the package manager work's at System level, can it offer any vulnerability to different profiles? Because of that thing that if an app has google capabilities in it's code, so maybe some how it could communicate with different profiles since it's installed at the same place.... Or maybe not, since you can choose what specifically folders it has access... Too much to think about 😅
IIUC, there are limited ways how installed apps can interact with other profiles: a. A profile can update the app to a newer version (as long as it is signed by the same developer) b. A profile can block installing some app for other profiles by installing an app with the same package name and different signer. c. A profile can detect some app is installed in some other profile. (In this case, it can check the signer by trying to install APKs with the same package name and a different signer.)
While the app manager is at the system level, the app instances are run in the individual user profiles. The app instances are sandboxed in the singular user profile and the app instance, app data, and profile data (contacts, media store, home directory, etc.) is only accessible from that user profile. App instances in a user profile can only communicate with other apps (with mutual consent) in that singular user profile. Additionally, each user profile has its own set of encryption keys to encrypt the data. You can think of the app manager like a phone book that's referenced to verify the installation satisfies certain criteria that provide extra security and protection. Such as "a." that @vitsestak2562 mentioned above. Is this app the same version or newer, yes. The android docs (source.android.com/docs/devices/admin/multi-user) and GrapheneOS docs have some more detailed information on them (grapheneos.org/features#improved-user-profiles)
Excellent, concise, informative video! It seems the devs of F-Droid operate in somewhat of an echo chamber and don't accept suggestions or critique very readily.
Thanks! I try not to critique/complain about things that would take a huge amount of effort to change (even though I sometimes do) because I understand that even small changes can be extremely time-consuming. In this case, it would just be a simple change in their workflow to update the main page with the latest version instead of latest version - 1.
Yes, the same thing will happen on CalyxOS. I've never personally used user profiles on LineageOS, but I'm assuming they use the stock Android OS implementation. Therefore, the same behavior will occur.
Hi 👋, I wanted to clarify one point in case there was any confusion from the video. User profiles are isolated workspaces with their own instances of apps, app data and profile data (contacts, media store, home directory, etc.). I think showing that the app manager is at the system level might have caused some confusion. User profiles are isolated workspaces.
This is a *loose* comparison, but if you've ever user a Windows computer and create additional users, Windows is not creating a unique Windows installation for each user. Certain things are shared at the system level, but the user data is kept isolated.
The GrapheneOS docs (grapheneos.org/features#improved-user-profiles) and Android docs (source.android.com/docs/devices/admin/multi-user) have some more information on User profiles if you're looking for some reading material.
😮 This comment totally undid what the video showed.
Comparing the OS (windows) installion to an app/program installation is not good.
Either there are multiple copies if the app or not.. 😢
I get it that user data is separate but really if there is one install of the app what prevents the app from see all of its users? Now I feel dirty😂😂😂😂
Man, your video was absolutely PERFECT to help me fix the version issue. Your example was IDENTICAL to what I was experiencing. Thanks so much....latest SUGGESTED version from Search downloaded and installed successfully in my other User Profile. Thanks so MUCH!!!
Thanks for this! Just got the pixel 8 and put graphene and wanted to put maps into a separate user profile and this issue came up. Watched your video and got it working great!
Unfortunately, this lazy behaviour of hosting outdated versions of software is all too common. Literally 30 minutes ago, I downloaded Samsung Magician to see if there was an updated firmware for my SSD. After downloading, installing & launching the newest version available, I was immediately met with "There is a newer version available". What a waste of time, just present me with the latest version...
Doing gods work! This also explains why my Simplenotes got absolutely jacked up when i attempted to use 2 separate accounts on 2 different Android profiles a few years ago. It must store the notes in a system folder somewhere rather than in the work space. I dont know if this also happens with other apps but its probably worth watching out for.
VERY helpful. Thank you!
I asked some questions in the GraphneOS Matrix Channel. If I had a second user on my phone, and if this space had Google Play Services installed, would there would be back-and-forth communication for apps with the first space and vice versa.
At first, I got multiple responses saying that yes, in fact, this happened. I then kept asking and got this, whatever it means: ( If app A in the first profile has a server that can be accessed via localhost, then app B in the second profile can access that server, and vice versa (if they both have network permission).
Does this mean that apps in the second user account not work profile can read the apps and other settings on the first user account that does not have gplay installed?
I am confused. Can you help clear this up please.
Ha, you described well my path to watching this video, LOL :-) Thank you very much - you solved my/our problem
great explanation!
Legend. Thanks!
Perfect. Thanks for this!
Thank You! 💚
You're welcome!
Brilliant! thanks
Very interesting! Did not know this!
Thanks for advice!
Great video bud, is there a way grapheneos devs could seperate packege manager for each user profile. Do u have good contact with th devs, could u propose it to them!?
From what I understand, this is a fundamental to how Android is designed to work. Since apps are installed at the system level, this allows for the downgrade protection. Another protection I didn't mention is pinning the signing certificate of the app. Since this is done at the system level, another inferior/malicious version of an app with a different certificate could not be installed in another user profile. This page has some great information if you're interested - hub.libranet.de/wiki/and-priv-sec/wiki/apps
As far as good contact with the devs, no. I intentionally keep my distance, so I don't come across as biased in my content.
@@sideofburritos Much appreciated, bud!
Why don’t you volunteer to help them. I despise companies that claim they do not have enough help and yet will not accept and help. Too many out there like that. So FOSS should take a back seat if the developer gives up on the project. Thanks for the pointers.
This specific issue isn't something a volunteer contributor could assist with. It's a choice by the project to intentionally host an outdated version on the main page. In one of the forum posts, they mention the reason they do it is for "Stability reasons, eg. not push new users to use the latest versions".
@@sideofburritos Thanks. So being aware about certain intricacies does not mean you can go into the source code and fix the problem?
Do you know if MDM software is sandboxed in by user profile or if the MDM profile is system wide?
Exactly
I've tested shelter in the past for a video, so I'll use that as the example. Shelter installed & configured in your Owner user profile will only be able to apply the Work profile in the Owner use profile. So while the shelter app would be installed system-wide as I showed in the example, the actual work profile it creates/manages would only be in the User Profile it was configured in.
Based, this took me a few days to figure it out myself
Nice! I'm hoping it can save some others time in the future when they search. I'm also glad you're not an FBI Honey pot.
@@sideofburritos yes of course, remember to trust everything you read on the Internet too
Do you know if the way that the package manager work's at System level, can it offer any vulnerability to different profiles? Because of that thing that if an app has google capabilities in it's code, so maybe some how it could communicate with different profiles since it's installed at the same place.... Or maybe not, since you can choose what specifically folders it has access... Too much to think about 😅
IIUC, there are limited ways how installed apps can interact with other profiles:
a. A profile can update the app to a newer version (as long as it is signed by the same developer)
b. A profile can block installing some app for other profiles by installing an app with the same package name and different signer.
c. A profile can detect some app is installed in some other profile. (In this case, it can check the signer by trying to install APKs with the same package name and a different signer.)
While the app manager is at the system level, the app instances are run in the individual user profiles. The app instances are sandboxed in the singular user profile and the app instance, app data, and profile data (contacts, media store, home directory, etc.) is only accessible from that user profile. App instances in a user profile can only communicate with other apps (with mutual consent) in that singular user profile. Additionally, each user profile has its own set of encryption keys to encrypt the data.
You can think of the app manager like a phone book that's referenced to verify the installation satisfies certain criteria that provide extra security and protection. Such as "a." that @vitsestak2562 mentioned above. Is this app the same version or newer, yes.
The android docs (source.android.com/docs/devices/admin/multi-user) and GrapheneOS docs have some more detailed information on them (grapheneos.org/features#improved-user-profiles)
@@sideofburritos Thank you for the detailed information. Once more.
Thanks!
Thank you! I really appreciate it!
Excellent, concise, informative video! It seems the devs of F-Droid operate in somewhat of an echo chamber and don't accept suggestions or critique very readily.
Thanks! I try not to critique/complain about things that would take a huge amount of effort to change (even though I sometimes do) because I understand that even small changes can be extremely time-consuming. In this case, it would just be a simple change in their workflow to update the main page with the latest version instead of latest version - 1.
Why are you using apple instead of a linux distribution?
For me, it's a good balance of privacy and security on the desktop. I also like Final Cut Pro.
In Samsung a12 android 13 it just won't install, I changed unknown sources but is says app is not installed
Hmm, can you install an apk of another app successfully?
@@sideofburritos I installed 3 versions older and now it is installed...
Where can I find some nice wallpapers for pixel 7 😊
Does this matter for Calyx or Lineage?
Yes, the same thing will happen on CalyxOS. I've never personally used user profiles on LineageOS, but I'm assuming they use the stock Android OS implementation. Therefore, the same behavior will occur.
Sir f droid safe use ? And blackhol and newpip safe to use ? No virus?
All of those are safe💀
bro, thank you. lol
First...
@Carahato yeah, are u?
If I pin a comment before publishing a video, does that count as First?
@@Carahato Now I wonder if that counts as cheating 😂