

That’s a pretty good description of what GrapheneOS does with the sandboxed Google services.
I have found that the only apps that don’t work well with Samdboxed Google services are ones that work hard to invasively probe their runtime environment.
Thwy usually fall into these three categories:
- Bank apps that do it “for my safety”. Nevermind that a website version exists for attackers to target without the same (dubious, invasive) “protections”.
- Streaming apps that do it “because this paid subscriber might be some kind of dark web pirate and we need to protect our content from being uploaded to the dark web one more time.”
- Apps whose developers are shitty at writing code for memory management. But GrapheneOS has good options to allow these to run, anyway.
Linux Mint is so nice.
I would turn off “Secure Boot” in BIOS before doing the upgrade.
It officially works, but can throw in unnecessary challenges - and Mom probably isn’t traveling with national secrets next week anyway.