Have I Compromised by GOS by Unwittingly Installing App with GSF from Aurora?

nosferatu

I have installed the Merlin Ornithology app by Cornell Lab from the Aurora store. The first and only app off there, and being still quite new to GOS, only after installing the app I noticed the little note that the app requires GSF (I presume it means it comes pre-bundled with it). Not knowing what it really is, I went to look it up and it would appear that I have unwittingly added Google crap onto my degoogled phone.

How badly did I mess up my phone's privacy and security by taking this step? Is there still anything I can do to rid myself off it, or is it too late now? Will uninstalling the pp remove the GSF as well, or does it embed itself so deeply it will spy on me until the phone is scrubbed and the entire OS reinstalled? Or am I maybe freaking out over a nothingburger here?

unwat

nosferatu

Nothing to worry about. That "gsf" label just means the app might use Google libraries, possibly relying on them to the extent that if GMS isn't available that the app might crash or misbehave.

Nothing to worry about. All apps are sandboxed and no apps that you install can get privileged access to your phone.

It's possible a Google library might have backup code in case GMS isn't working or present. If you don't like that, just don't use that app!

nosferatu

unwat Thank you for your reply. Do you know - is there a way to check whether any Google stuff was put on my phone or not? In other words - whether Merlin comes bundled with GSF, or will simply look for it and misbehave if cannot find it? If the latter, then I wouldn't worry one bit, as maybe only some services of the app will not work (like geo tagging, which I never use anyway). Still wandering if there is a way for me to verify my phone is still "degoogled"?

unwat

nosferatu comes bundled with GSF,

That's not possible. GSF is a standalone app.

There are Google Libraries that devs can add to their apps, like for A/B testing, analytics, etc. If the app is open source it's easy to check if that is the case. If it's not open source it's a lot harder to figure out what's included.

nosferatu Still wandering if there is a way for me to verify my phone is still "degoogled"?

I think only you can decide if your phone is degoogled enough for you. I'd say no closed source Google apps is "degoogled." If you agree, you're fine.

I'd say avoiding Google libraries is not really doable for most people, so I wouldn't suggest trying it unless you're crazy dedicated.