**** BEGIN LOGGING AT Thu Feb 11 02:59:58 2016 Feb 11 03:03:12 AS Beta 3 is out Feb 11 03:05:01 AS 2.0b3 * - release notes haven't even been published yet Feb 11 03:37:05 your library project should not have the same package name as your app project Feb 11 03:37:10 and yes, your library project must have a package name Feb 11 03:37:15 how else would it know where to generate R.java Feb 11 03:37:20 this is not android studio's fault Feb 11 03:37:22 user error Feb 11 03:39:42 s/should/must Feb 11 03:45:54 can you force the onResume() method to run if your activity is still focused? Feb 11 03:46:14 say, when a timer times out? Feb 11 03:49:36 no, why would you Feb 11 03:49:39 that's terrible Feb 11 03:50:13 onResume() { handleMyShit(); } whenTimerRunsOut() { handleMyShit(); } Feb 11 04:08:14 hi all, does it sound kind of reasonable to merge to .repo directories by just copying (cp -al for example) two into one unique destination ? the aim is to keep as many git objects as possible from both to avoid retransfering them, then do a new repo init on t he merged result Feb 11 04:08:36 merge two repo* Feb 11 04:08:50 That's probably a terrible idea Feb 11 04:09:03 to what end? why would have have two separate .repo for aosp Feb 11 04:09:25 let's say I have cm 11 on one side, and aosp 5.1 on the other Feb 11 04:09:42 neither is a subset of the other Feb 11 04:09:54 and I want to get cm 12.1 Feb 11 04:10:23 but that's a lot of download if I start from either one, whereas if I started from a merge of the 2 I would gain a lot of time Feb 11 04:10:32 yeah, no, you can't merge them Feb 11 04:10:49 You can try, but make sure you only copy the object files Feb 11 04:10:55 but cm should always be merging in upstream Feb 11 04:11:00 Either way you'll have a full copy of it in your working directory Feb 11 04:11:00 so what does it matter Feb 11 04:11:07 you can always repo init -b aosp-branch Feb 11 04:11:15 So you might just do a shallow clone Feb 11 04:11:15 you think they merge in upstream everything ? Feb 11 04:11:17 there's no reason to have 2 when cm is already based on aosp Feb 11 04:11:33 if cm doesn't merge in aosp directly, I would suspect ever using cm Feb 11 04:11:37 well they have their own specific repos I think, in addition to the standard aosp ones Feb 11 04:11:54 doesn't matter, the repo manifest should always be correct Feb 11 04:11:59 as long as they fork aosp properly Feb 11 04:12:14 cm has to be a superset of aosp Feb 11 04:12:46 yes, but they have some packages that aren't in aosp Feb 11 04:12:53 also some devices Feb 11 04:13:25 that's the whole point, cm is a superset of aosp Feb 11 04:13:27 so you get cm and you're done Feb 11 04:14:05 yeah , at the end that's what I want, the point is frmo what I'm starting from Feb 11 04:14:20 I don't want to get it from scratch because I have low bandwidth here :) Feb 11 04:14:41 no, you cannot merge .repo directories Feb 11 04:16:31 maybe what I can merge is project-objects directories ? Feb 11 04:28:59 hello guys, my android emulator whenever i start just gives black screen even after half an hour .. the details of my image is as here http://i.imgur.com/BSwFMZa.jpg Feb 11 04:33:30 the android emulator requires a quantum computer Feb 11 04:40:33 htop 2 is neat Feb 11 04:43:24 what? Feb 11 04:43:45 oh, a top Feb 11 04:43:56 http://hisham.hm/htop/ Feb 11 04:44:07 sorry unix only :D Feb 11 04:45:16 so i see Joe tweeted another article about loaders ... i'd think in 2016 maybe google would have come up with some better ideas ... Feb 11 04:45:29 loaders suck, don't use them Feb 11 04:47:16 the only passingly interesting thing about them is that they're detached from the activity so that lifecycle doesn't really disturb them Feb 11 04:47:37 but that also introduces a shitton of complexity into them because of it Feb 11 05:35:51 trying to add switchcompat in actionbar, added but not responding to On/Off, code : http://pastebin.com/ynTbPaS9 anyone please help? Feb 11 05:52:07 pfn, what'd you recommend using instead? Them being able to "understand" lifecycle is very nice Feb 11 05:53:29 using a service to detach from the activity doesnt really make things simpler Feb 11 05:57:25 I normally don't care about being detached from activity lifecycle, if I need them to exist outside of activity lifecycle, I use some sort of singleton Feb 11 05:57:44 and I do a little bit of work to detect activity state before proceeding, if necessary Feb 11 06:05:55 Came across this question on /r/androiddev and was interested in the answer as well. Anyone have any ideas? https://www.reddit.com/r/androiddev/comments/4541kr/i_put_together_a_primer_on_using_rxjava_with/czvp1l3 Feb 11 06:06:27 put the observable somewhere outside of the activity Feb 11 06:06:28 of course Feb 11 06:09:25 pfn: So what just throw it in a separate class? When the activity is recreated wouldnt it get resubscribed therefore the request would fire off again? Feb 11 06:09:38 depends on hot/cold observable Feb 11 06:09:57 I don't use rx, so no idea what that does Feb 11 06:09:59 I normally use futures Feb 11 06:10:26 Alright thanks, i'll read up a bit on hot/cold observables Feb 11 06:10:55 orbyt_ its a topic covered quite often, surprised you haven't found it in your googles Feb 11 06:11:37 * pfn really doesn't like the concept of hot/cold observables Feb 11 06:12:03 I want my data to load independently of being subscribed to, and when I want it to (so either on observable creation, or at some other point) Feb 11 06:12:06 wc Feb 11 06:12:15 g00s_: Up until recently I was passively checking out Rx, but the past week or so have been getting into it a bit more. Have heard of hot/cold observables but didnt read into them, yet Feb 11 06:12:58 and for the most part, the most common uses of rx aren't even streaming data, observables are completely overkill Feb 11 06:13:06 I'm surprised people don't use something like jdeferred more Feb 11 06:14:12 they even have an android-specific build Feb 11 06:16:38 * pfn still uses his own futures library when possible Feb 11 06:16:41 https://github.com/pfn/android-futures Feb 11 06:17:39 I should write some rx adapters for it as well, to convert to/from Singles Feb 11 06:21:43 a coworker was showing me something cool he made with react native Feb 11 06:22:02 stopped being cool as soon as you said react native Feb 11 06:22:03 RustyShackleford how is the toe ?! Feb 11 06:22:22 I don't think its broken. It fucking kills man Feb 11 06:22:51 dude - telling you, could have torn ligaments / tendons - see pediatrist ! Feb 11 06:23:05 podiatrist Feb 11 06:23:06 fucking wind up with hammer toe or some shit Feb 11 06:23:18 it does feel much better, it can support some weight but I can't walk on it very far Feb 11 06:23:51 * g00s_ steps on RustyShackleford toe for test Feb 11 06:23:59 don't even joke Feb 11 06:24:53 hey Feb 11 06:25:00 anyone online :P Feb 11 06:28:30 Hi. Is there a lib which can help me setup Authenticatation with a backend server for Google Sign-In Feb 11 06:28:36 Don't know a lot of python Feb 11 06:32:21 Should be easily doable using play services ? Feb 11 06:32:56 Client side Sign-In is done. Wanted to authenticate with the backend. Feb 11 06:33:09 Check this out - > https://io2015codelabs.appspot.com/codelabs/sign-in#1 @WantToCode Feb 11 06:33:22 Oh Feb 11 06:34:13 I have completed this. I am look at this step - https://developers.google.com/identity/sign-in/android/backend-auth Feb 11 06:34:55 oh ok Feb 11 07:19:26 Is FLAG_ACTIVITY_NEW_TASK same as singleTask launchmode? Feb 11 07:22:56 Is it necessary to authenticate with backend server after google sign in? What are the advantages or should I say the security concerns if I don;t do authentication? Feb 11 07:36:49 https://publicobject.com/2016/02/08/linkedhashmap-is-always-better-than-hashmap/ Feb 11 07:37:18 is it also better for android? Feb 11 07:38:36 did you even read it? Feb 11 07:44:06 yeah i read it but never used it in vast Feb 11 07:45:09 hey all :) Feb 11 07:45:12 so do not have any idea about perfomance using LinkedHasmap in apps Feb 11 07:47:21 What's the equivalent intent flag for singleTask launchmode? Feb 11 07:48:02 I was experimenting and found that FLAG_ACTIVITY_NEW_TASK doesn't have similar behavior to singleTask Feb 11 08:13:41 I am formatting a response from server and was expecting DATE_FORMAT = "yyyy-MM-dd'T'HH:mm:ss.SSS'Z'", but for some reasons I sometimes get "yyyy-MM-dd'T'HH:mm:ss'Z'" Feb 11 08:13:46 How should I be handling this ? Feb 11 08:16:08 check the length of the string? Feb 11 08:16:11 efficient / elegant way to wrap string with symbol? i.e. something -> something Feb 11 08:16:23 "" + string + ""; looks ugly Feb 11 08:17:44 String.format(Locale.XX,"%s",string); Feb 11 08:18:48 its even uglier Feb 11 08:19:04 why the html? can use spannables Feb 11 08:20:23 well i get semi-html and just in some cases i want italize text Feb 11 08:20:35 i already just do setText(Html.fromHtml()) Feb 11 08:20:49 dont wanna mess with spannables Feb 11 08:21:40 i thought wrapping would be a common thing but apparently its not Feb 11 08:23:22 Ashiren: "" + s + "" Feb 11 08:23:43 mhm Feb 11 09:12:43 Morning all, beginner question - is it generally correct to do any UI updates (e.g updating some view with data) inside onResume rather than onCreate? Feb 11 09:16:55 depends Feb 11 09:17:03 normally i do updates in onResume Feb 11 09:17:35 onResume mostly will be called more frequent than onCreate Feb 11 09:18:37 in onCreate i update things only if i know they wont change Feb 11 09:25:32 Ashiren: okay, makes sense. thank you! Feb 11 09:43:01 hi Feb 11 09:43:04 do you have any clue what this error means? Feb 11 09:43:07 Error:com.android.dx.cf.iface.ParseException: class name (shared_presage/com/google/gson/internal/bind/A) does not match path (shared_presage/com/google/gson/internal/bind/a.class) Feb 11 09:43:27 A.class is not the same as a.class Feb 11 09:44:06 okay, but it's in shared_presage, right? So not one of my libraries Feb 11 09:44:38 i dont know what shared_presage is Feb 11 09:45:03 ah sorry danijoo! It's one of my classes x_x Feb 11 09:46:56 convention is to name classes upper case Feb 11 09:47:02 first char uppercase Feb 11 09:52:34 any thoughts on using wrap_content with buttons? to my eyes different sized buttons look really ugly Feb 11 09:53:27 wrap_content doesn't specify the size directly. Feb 11 09:54:24 yes Feb 11 09:59:30 murosai, depends on the surroundings, I'd say Feb 11 09:59:38 but it's a UI design decision Feb 11 10:00:47 murosai: use weight=1 and width=0px to get equal widths :) Feb 11 10:02:04 Don't use weight unless you have to. Feb 11 10:19:55 Hey guys one question, i received design suggestion and its simple png, now i need to code this http://imgur.com/U40KZab into code, any suggestions how should i accomplsh edittext style? Feb 11 10:21:07 you could use drawableLeft for icon and drawablePadding for spacing between icon and text Feb 11 10:22:42 Yeah but i will still get "material" stylish edittext Feb 11 10:37:11 If arcanewater had waited a few more minutes, I could have helped... Feb 11 10:54:30 Can i test in-app in the emulator or i need google play for this to work? Feb 11 10:56:42 Can this be done or i need a device for this to work and could this work in the new emulator in android studio 2.0? Feb 11 10:57:27 * Zharf never tried Feb 11 10:57:39 Hey Zharf:) Feb 11 10:58:14 hi? Feb 11 10:58:40 :) Feb 11 11:30:48 Hello guys, where should I look at to disable a view, so it looks like inactive as if a semitransparent layer covers the view. I tried it with view.setEnabled(false) but that didn't change the look of the view as inactive. Feb 11 11:33:34 Number5: something like state list drawable Feb 11 11:33:38 http://stackoverflow.com/questions/14042866/state-list-drawable-and-disabled-state Feb 11 11:34:45 Ashiren, thnx. No other easier solution than creating a style to modify states? Feb 11 11:35:52 well style or background drawable Feb 11 11:37:10 maybe a slight alpha view that covers it, and just change its shown state? Feb 11 11:42:41 Hey all, quick question. Anyone know why I would be getting an error such as: Task 'incrementalNormalDebugSupportDex' not found in project ':app'. Feb 11 11:44:01 It seems I only get it when Instant Run is enabled. and it's not consistent Feb 11 11:44:49 I'm assuming it's a bug with Instant Run? But I guess it could be a problem with my Gradle build as well Feb 11 11:48:48 android studio 2.0? its stil lbeta isnt it Feb 11 11:50:18 Is there a reason why my activity seems to remain on the navigation stack after I press back? suppose I go a -> b ->(back) -> a -> b ->(back) -> b. this increases each time i start b, with the back button just starting the same activity again. Feb 11 11:51:28 Are you overriding onBackPressed? Feb 11 11:51:45 I'm not - at least not in activity b Feb 11 11:52:15 How do you know it is on the stack? Feb 11 11:54:03 well, I don't but after i've 'visited' it once and then press the back button, when I return and go back again it redisplays the same activity. it's difficult to explain but it seems to be as though activity b is remaining on the stack after back is pressed. Feb 11 11:54:48 Paste your code of A starting B Feb 11 11:54:48 @Ashiren yeah, I think it's a new bug with beta 3 (since I just started seeing it today after upgrading) Feb 11 11:54:58 it's possible i'm missing something obvious, as it's only my second week doing android dev Feb 11 11:58:24 rmrrn: have you been playing with launchMode in AndroidManifest? Feb 11 11:58:29 barq: ultimately, it comes down to this https://gist.github.com/anonymous/dd4f7a38e96c6074d22c this is in c# (I am using xamarin) but hopefully should be straightforward enough Feb 11 11:59:07 Ashiren: no, I haven't touched launchMode! Feb 11 12:04:49 Where are you calling that method, which btw should not be capitalized or static Feb 11 12:07:25 :lib1 :lib2— both have dependency on :lib3. How do I set up the dependencies such that while development these point to project and while building releases they point to maven dependencies. Feb 11 12:08:21 debugCompile(project) and releaseCompile(maven/jcenter depency) would this be right approach ? Feb 11 12:11:51 barq: I'm calling it from within activity A. It's an extension method (C#) which is the reason for it being static. Feb 11 12:14:17 C#? Feb 11 12:16:02 why java programmers wear glasses? because they cant C#. bazinga Feb 11 12:16:25 Indeed, I am using Xamarin to build the app Feb 11 12:22:04 Should ask in #xamarin Feb 11 12:24:11 liuwenhao: I have tried :( Feb 11 12:25:42 I don't believe the issue is related to that. I'm likely doing something incorrect somewhere but have spent a number of hours on it now, and not getting anywhere Feb 11 12:36:03 interesting. could this be related to the fact i'm adding fragments to the back stack? does this change the behaviour of the back button? Feb 11 12:37:55 Can I draw stuff in a canvas and then transform the stuff I drew? Feb 11 12:38:18 For example, I draw a circle, then I get this circle and transform it, changing it's scale and opacity, color, stuff like that Feb 11 12:45:28 afaik whatever you draw in canvas is drawn Feb 11 12:45:43 what do you mean by circle? Feb 11 12:45:51 drawCircle takes position and radius Feb 11 12:46:03 do you want to transform already drawn circle Feb 11 12:53:34 Ashiren yes Feb 11 12:55:09 meh youd need to plan everything before actually drawing things ~ Feb 11 12:58:42 hm Feb 11 13:04:26 hithere Feb 11 13:10:16 I minified my library. It minified everything it seems. Not able to include even a single class :| Feb 11 13:10:27 where did I go wrong ? Feb 11 13:31:04 Well. Feb 11 13:31:14 Philosophical question that. Feb 11 13:40:42 Interesting. I have a fatal crash where the app keeps on running. Feb 11 13:44:22 If I have a memory leak in one app, can that affect another app or do they have completely separate heaps? Feb 11 13:44:46 they have their own heaps Feb 11 13:45:11 still system might be more eagier to kill some apps if it runs out of memory Feb 11 13:45:41 during startup (onCreate) of my main activity (which is only started after logging in), could it recover fast enough so that it's not even noticeable? Feb 11 13:46:58 I fixed some leaks in one app and now I can't reproduce the OOM in the other app, strange. Feb 11 13:48:36 :o Feb 11 14:03:36 any recommendation for articles that help me to make my android app less ugly? Feb 11 14:06:03 * loke`` suffers from the same Feb 11 14:07:09 adb uninstall your.app Feb 11 14:07:13 hallway test Feb 11 14:07:18 Hello guys, sounds this familiar to you? I designed a layout which looks good on Preview window of Android Studio, however, on a real device a view is positioned wrong. And I really know what I'm doing when it comes to layout design. This really weird. Feb 11 14:07:55 What exactly is positioned wrong? Feb 11 14:08:48 murosai https://www.google.com/design/spec/material-design/introduction.html Feb 11 14:09:02 murosai materialup.com for inspiration or whatever Feb 11 14:10:19 read everything in the material design guide Feb 11 14:14:46 barq, I found the problem. This is a nasty one Feb 11 14:16:17 There's also a Material course on udacity Feb 11 14:18:02 For one fragment, I hide the Toolbar, which is the home fragment. In onStop I set the Toolbar to VISIBLE. When switching to another fragment, the new layout seems to calculate the position based on dimensions WITHOUT the Toolbar. This way the View on the bottom is moved below the bottom of the screen. Feb 11 14:19:33 If I go to another fragment with Toolbar and go back to the fragment where the layout wasn't correct, the fragment than shows the layout correctly. Feb 11 14:39:35 Hello, anyone knows why I can't change the color of my ProgressBar ? http://pastebin.com/raw/dhvQtR8a Feb 11 14:40:34 Ok guys, does anyone has a good solution for changing fragment to fullscreen without AppBar or normal screen with AppBar for API versions from 15 to 23? It doesn't work smooth in my situation. What I did for fullscreen is hiding the AppBar by setting its visibility to GONE and when closing the fragment put the AppBar back to VISIBLE. Feb 11 14:40:48 I'm also compiling the appcompat v7 Feb 11 14:42:00 Number5, use DialogFragment instead of Fragment. This will show out of Layout bonds and fill the full screen Feb 11 14:42:20 Is there a simple way to center the items in a recyclerview if they’re less than required to fill the screen? Feb 11 14:43:16 danijoo_, I'm afraid that if I want to use the menu drawer, it will show below the dialog fragment. Feb 11 14:43:47 whats not working on your approach? Feb 11 14:44:04 danijoo_, I don't use the fragment as a splash screen, but as a main page with a full screen minus status bar. Feb 11 14:44:45 you said setting it to GONE does not work. why? Feb 11 14:48:09 danijoo_, when the app start with the Main fragment, it hides the toolbar which is working good. But than I switch to another fragment and the onStop of the current fragment is called where I set the Toolbar to VISIBLE. What happens is the next fragment calculates the view positions based on screen dimensions WITHOUT Toolbar. As a result, my listview at the bottom is a bit moved below the screen. Feb 11 14:49:23 If I switch to another normal fragment (with the toolbar) and than go back to the fragment with the wrong layout position, than the layout is displayed correctly. Feb 11 14:49:46 I'm testing it on an old HTC Sensation with Android 4.0.3. Feb 11 14:51:09 Is it possible to update Android Studio without downloading the whole package? Feb 11 14:51:19 Also will that affect my projects? Feb 11 14:52:31 Number5, try to move it from onStop of a fragment to the function of the activity where you create the fragment transaction and call it before the transaction itself Feb 11 14:53:21 fragment lifecycles are asynchron, meaning that the onCreate and onCreateView of your second fragment might already be called before onStop from the other one is called Feb 11 14:53:33 danijoo_, aaah that's a good one, thnx I'll try it out. Feb 11 14:53:46 OverCoder, no & maybe Feb 11 14:53:46 Anyone knows why http://pastebin.com/raw/XDHYCdtV doesn't apply the colors? I have a progressBar and it keeps showing the freaking blue color Feb 11 14:54:12 Twirl, I think you use the wrong attribute to change the color. Feb 11 14:54:25 danijoo_, hmm, looks like 2.0 is released (even if it was in beta), and I think I am going to get it Feb 11 14:54:25 Twirl, ^ and also the wrong parent Feb 11 14:54:26 Number5: alright, which one is it then Feb 11 14:54:29 <3 betas Feb 11 14:54:38 danijoo_: i want to change the accent color globally Feb 11 14:54:45 danijoo_: which should i use? Feb 11 14:55:25 Twirl, I'm working on another problem, but you can Google, it's not something difficult. Google for 'Android Progressbar change color' Feb 11 14:55:26 OverCoder, if you switch to beta, it will automatically change the gradle plugin version in your build.gradle. Feb 11 14:55:35 thats what I meant with affecting your project Feb 11 14:55:38 Number5: you joking buddy? Feb 11 14:55:49 danijoo_, ah, who cares about Gradle? I mean I don't do :P Feb 11 14:55:50 Number5: google your problem then come here to ask Feb 11 14:55:55 Twirl, no I'm for real man Feb 11 14:56:03 Number5: then go back to google Feb 11 14:56:20 Twirl, don't misunderstand me please. Feb 11 14:56:24 Twirl, if you want to change the color globally, dont apply the change to the progess bar but to the app theme Feb 11 14:56:33 Number5: don't talk to me buddy, you are /ignored Feb 11 14:56:46 and stop being rude if you want help Twirl lol Feb 11 14:56:49 You see Twirl, you change the wrong attribute, I already said it to you. Feb 11 14:57:09 lol danijoo_ Feb 11 14:57:33 danijoo_: he is the one being rude imho Feb 11 14:57:57 anyways i ignored him so, nothing to worry about Feb 11 14:58:30 Twirl, http://stackoverflow.com/questions/5745814/android-change-horizonal-progress-bar-color?rq=1 Feb 11 14:58:47 too bad, because he just posted a link to the solution Twirl :D Feb 11 14:59:06 danijoo_: did you read the paste? http://pastebin.com/raw/XDHYCdtV Feb 11 15:00:10 danijoo_: you said to apply the color to the AppTheme, it's what i'm doing Feb 11 15:00:17 OverCoder, I think you only have to load the full package when going from stable to beta though. Once you are in beta, beta updates are shipped incremental Feb 11 15:00:30 Ooh, nice Feb 11 15:00:47 Because it'll take me 6 hours to download Android Studio on my 128Kbps :| Feb 11 15:00:48 at least that has been the case while they updated 2.0 in canary channel. Feb 11 15:01:03 Hm Feb 11 15:01:05 OverCoder, wow.. where do you live? Feb 11 15:01:08 2.0 is in Beta too Feb 11 15:01:29 danijoo_, I always say, 'the worst yet most interesting place, Syria' Feb 11 15:01:33 (arguably I mean) Feb 11 15:02:34 I see. I was wondering because your whois says you are connected through texas. And I thought they would have a better download rate there ;) Feb 11 15:02:36 I am confused on what's the difference between Canary and Beta Feb 11 15:02:43 But for syria it makes sense, i guess Feb 11 15:02:47 haha yeah because it's an EliteBNC Feb 11 15:02:52 (#EliteBNC) Feb 11 15:02:53 Canary is like one stage before beta Feb 11 15:03:00 alpha or worse :p Feb 11 15:03:04 Ah, which one you recommend me? Feb 11 15:03:25 right now, canary is the same as beta Feb 11 15:03:34 I mean I don't mind getting weird crashes sometimes, but I don't like having impossible to solve problems lol Feb 11 15:03:42 last week, there was no 2.0 beta but only canary Feb 11 15:03:55 I cant recommend anything beside stable. Some builds are good, some suck Feb 11 15:04:09 Ah, so I guess it was stable enough, I gotta lookup the changelog, seems quite interesting Feb 11 15:04:15 I always keep a stable version installed to be able to go back if I have to work but theres problems with the IDE Feb 11 15:04:35 Meh I don't :P Feb 11 15:04:38 danijoo_, YOU'RE THE MAN! Thank you buddy, now it works as expected :) Feb 11 15:04:47 Number5, yw Feb 11 15:04:50 My Firefox is dev build, Chrome's beta, Opera beta on my phone too, haha Feb 11 15:04:56 I always get the very very latest Feb 11 15:05:02 OverCoder, until you need to hotfix something and your ide keeps crashing :p Feb 11 15:05:24 I never had that lol Feb 11 15:05:30 yet Feb 11 15:05:37 Yeah, yet :P Feb 11 15:06:00 Hello Feb 11 15:06:24 How do you keep a twitter oauth secret secure in an android app? Feb 11 15:07:32 Is it opensource? Feb 11 15:07:54 nope Feb 11 15:07:58 Because if so, you should omit the key when pushing the source code somewhere, and you can just store the key anywhere in any variable in your app Feb 11 15:08:19 yeah but you can just decompile the app and get it Feb 11 15:08:37 minifyEnabled true in your gradle Feb 11 15:08:51 obfuscates all your code, though there could be some chance to get that, idk Feb 11 15:09:22 it obfuscates the variable names, not the literals Feb 11 15:09:49 wat Feb 11 15:09:56 raycar5: afaik there is no 100% safe way. Feb 11 15:10:00 ^ Feb 11 15:10:13 ._. Feb 11 15:10:18 I have seen Google recommend constructing the key at runtime Feb 11 15:10:41 the only way to keep it save is to use a middleman-server Feb 11 15:10:41 so people just integrate twitter login insecurely Feb 11 15:10:49 You can decompile and get the parameters and do the exact same thing to get the ouath again Feb 11 15:10:57 danijoo_++ Feb 11 15:10:59 store the key on your server, make requests to the server and let the server append the oath key Feb 11 15:11:37 and watch the server logs for someone using it against your will + ssl Feb 11 15:12:06 You gotta do some work to best secure your API Feb 11 15:12:15 the thing is how do i know it's my app and not another one the one trying to get the key from the server? Feb 11 15:12:28 raycar5, theres no 100% security ;) Feb 11 15:12:35 oh man Feb 11 15:12:40 I hate that Feb 11 15:12:46 you can make it hard, you cant make it impossiblwe Feb 11 15:12:53 is there a way for your server to check an app's release signature Feb 11 15:13:01 use ssl, client side certificates, watch for strange useragents and ips.. stuff like that Feb 11 15:13:14 missingno, yes Feb 11 15:13:15 like, google seems to do that somehow for google api keys Feb 11 15:13:44 how does it work without an external party verifying the app Feb 11 15:13:45 what hinders me to fake the signature? Feb 11 15:13:49 missingno: not practically, no. Someone can always override the code that transmits the signature – your server has to trust something on the device. Feb 11 15:14:01 missingno, You really don't need to do that much of work regarding your APi Feb 11 15:14:05 API oauth* Feb 11 15:14:05 You have to trust something, which is why a third party is necessary that both sides trust. Feb 11 15:14:12 and even that can be manipulated. Feb 11 15:14:16 missingno, http://android-developers.blogspot.si/2013/01/verifying-back-end-calls-from-android.html Feb 11 15:14:20 This is the best you can do. Feb 11 15:14:34 sweet thank you for this link Feb 11 15:14:51 Mavrik that seems like a good solution Feb 11 15:15:24 Thanks! Feb 11 15:16:22 huh Snapchat uses this doesn't it Feb 11 15:26:47 There are days where I wished I could mandate that people learn why allowing users to modify the software that’s running on their systems is important. Today is one of those days. Feb 11 15:29:23 missingno, ultimately you're trusting a computer you can't control to not be completely messing with you Feb 11 15:29:46 missingno, if you're really really interested you can do something w/ the keystore to generate a client-side cert and store it in there, but you're still trusting the generation process Feb 11 15:30:55 justjanne, so you can access services without authorization, ok Feb 11 15:32:19 pfn: Rule #1: DRM does not work. Never did, never will. If your "authorization" is checking that the client app is okay, then you have no authorization. Feb 11 15:32:41 the google play thing looks interesting Feb 11 15:32:43 Second thing: if a user wants to modify that stuff, they always find a way Feb 11 15:32:53 and if they end up loading systemless Xposed onto their system, Feb 11 15:32:55 really all that stuff is there to try to ensure the client isn't modified w/out the users knowledge Feb 11 15:32:58 Steam DRM always worked. has never been broken :p Feb 11 15:32:59 modfiy the bytecodeloader for your app, Feb 11 15:33:07 once the user is trying to modify stuff, you're going to lose Feb 11 15:33:10 and load a different app instead of yours Feb 11 15:33:35 Steam DRM has been broken before, danijoo_, I’ve used one of the cracks to use a legitimately owned version of Anno 2070 in WINE Feb 11 15:33:38 dragorn: exactly. Feb 11 15:34:11 All you guys are advising is creating a badly working, maybe 90% successful "authorization" scheme that only stops users who want to modify some parts, Feb 11 15:34:16 but doesn’t stop anyone with evil intent. Feb 11 15:34:33 It purely annoys end users, and doesn’t provide any benefit for you. Feb 11 15:34:41 says you Feb 11 15:35:14 I'm writing a simple app that sends a couple of GET?POST requests to a rails app and displays the results. I want to to have all URLs in my app point to "test.mydomain.com" while developing, but to "mydomain.com" in release Feb 11 15:35:15 pfn: What are you gonna do when the end user modifies the Android Framework in RAM after your authorization signature already has been generated? Feb 11 15:35:16 justjanne has it right though - security against people in the middle is very different than security againt someone who has (essentially) infinite time to attack the device. Of course that said if I've got something handling anything sensitive i'd sure like any extra protection on it to make sure I'm running what I think I'm running. Feb 11 15:35:19 ^ Feb 11 15:35:21 what's the correct way to accomplish this Feb 11 15:35:36 wasnt anno 2070 Uplay DRM ? Feb 11 15:35:43 Rhainur, one way would be gradle flavors and putting the host as a string in xml Feb 11 15:35:50 danijoo_: it had both in the steam version, that was the issue. Feb 11 15:36:03 Rhainur, then you just drop two different strings.xml in the different flavors and pick which one you build Feb 11 15:36:05 are there any limitations I should be aware of? Feb 11 15:36:06 the UPlay DRM worked fine in WINE, Steam on its own, too, but not the combination of both DRMs Feb 11 15:36:19 Rhainur, if you don't want to go to that level, you can just put the host in strings.xml and change it yourself before release Feb 11 15:37:06 dragorn: well, even that barely works. In the end, as long as the user can open up the device, freeze it, and read RAM manually, they can completely break your authorization. Any DRM attempt where the user has control over the device is useless. Feb 11 15:37:24 Rhainur, if you dont want to use flavors, you can also put them both in your app and check at runtime Feb 11 15:37:29 seems a bit overkill to do it for one string Feb 11 15:37:32 if(BuildConfig.DEBUG) ..... else .... Feb 11 15:37:39 a whole different flavor I mean Feb 11 15:37:51 but I'll definitely keep it in mind if I have more things I need to swap between dev/prod Feb 11 15:39:13 justjanne, that said, that attack is (currently) more or less state level (or at least, extremely extremely targetted). Plus use of the TE environments and hardened physical key storage can significantly improve it - witness the debates about how to unlock encrypted devices under legal order. It's possible to make good decisions even while, in theory, anything can be broken given time. Feb 11 15:40:30 dragorn: yes, surely. But on Android only Google really has the capability to do Trusted Computing anyway, the best you can do is use the Google tools to check the signature of your app and the system at app start. Feb 11 15:40:42 After that, anyone can on Android always modify your in-RAM structure Feb 11 15:41:17 that's not really true, manufacturers can expose TE elements to apps. Feb 11 15:41:34 dragorn: but then you have to rely on your own apps code being okay. Feb 11 15:41:52 Which we already defined as not a given, considering that that’s what we want to check Feb 11 15:41:57 and "anyone" can't unless the device is entirely compromised Feb 11 15:42:35 well, dragorn, as I said, we assume a device with a compromised bootloader and TrustZone Feb 11 15:42:47 which is a given on all Android devices 5.1 or lower. Feb 11 15:43:09 if you've compromised the bootloader the game is completely over; it's also targetted, no-one is doing drive-by bootloader mods Feb 11 15:43:26 Although on devices after KitKat you have to blow a qFuse for that, which means your app can recognize if the bootloader is compromised – Feb 11 15:43:40 except, you have already compromised the code that reads the qFuses for userland Feb 11 15:44:22 dragorn: no one is yet. Currently 4 different "App with no permissions" to "Full SBL TrustZone" exploit chains are out there, unpatched before M. Feb 11 15:44:45 Sure, you won’t find them in the play store, but the user can always exploit their own system willingly. Feb 11 15:45:31 anything before M is a joke for security unless the vendor went out of their way to implement proper protections. You CAN do dm-verity and validated /boot and /system on L. Most manufacturers did not. Feb 11 15:45:31 DRM was never effective, and will never be. Anyone advising people to use App Signatures to check access to their backend is advising the dev to do Security by Obscurity, and misleading the dev into believing that would actually work. Feb 11 15:45:41 that said, nobody cares about single users exploiting something Feb 11 15:45:51 the problem is in scale Feb 11 15:45:56 danijoo_: well, missingno seemed to care about that. Feb 11 15:45:58 You're falling into the trap that the perfect is the enemy of the good. Nothing stops everything, but advocating "don't even try" solves nothing. Feb 11 15:46:09 > is there a way for your server to check an app's release signature Feb 11 15:46:39 That only stops the people who try to modify the app to patch a dark theme into it, for example. Feb 11 15:46:41 Stopping, for instance, attacks except targetted device compromise or users compromising themselves can have tremendous value Feb 11 15:46:50 Doesn’t stop anyone trying to abuse your backend Feb 11 15:56:31 what a fun debate Feb 11 15:56:45 justjanne what is your opinion of Google Wallet Feb 11 15:57:01