cordova-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Andrew Grieve <agri...@chromium.org>
Subject Re: Android 4.0 Blog Post
Date Thu, 16 Apr 2015 01:52:42 GMT
Posted!

Steve - can tweet it from @ApacheCordova?
https://cordova.apache.org/announcements/2015/04/15/cordova-android-4.0.0.html

On Wed, Apr 15, 2015 at 5:31 PM, Treggiari, Leo <leo.treggiari@intel.com>
wrote:

> Thanks all for the information and suggestions on whitelisting.  Very
> helpful!
>
> Leo
>
> -----Original Message-----
> From: agrieve@google.com [mailto:agrieve@google.com] On Behalf Of Andrew
> Grieve
> Sent: Wednesday, April 15, 2015 11:51 AM
> To: dev
> Subject: Re: Android 4.0 Blog Post
>
> You can customize the tags per-platform via <platform
> name="android>...</platform>.
> Although, the new tags will be ignored by other platforms anyways, and
> <access> remains the way to whitelist network URLs.
> So, in practice I think things should mostly just work out.
>
> On Wed, Apr 15, 2015 at 2:43 PM, Brian LeRoux <b@brian.io> wrote:
>
> > from a fictional blog post I should write: "3 ways to bulletproof your
> > network"
> >
> > if you want to ensure your app only talks to domains you specify then:
> >
> > 1. do not include 3rd party scripts (or if you do make sure you trust
> them
> > and maybe keep an eye out for document.write!)
> > 2. use ssl for all your http traffic
> > 3. only talk to external services through a proxy you run (and auth)
> >
> >
> >
> > On Wed, Apr 15, 2015 at 1:14 PM, Ian Clelland <iclelland@chromium.org>
> > wrote:
> >
> > > On Wed, Apr 15, 2015 at 1:47 PM, Treggiari, Leo <
> leo.treggiari@intel.com
> > >
> > > wrote:
> > >
> > > > If anyone has the time to educate me, then please pardon my
> ignorance.
> > > >
> > > > Then you're suggesting that if I'm writing a cross-platform app, I
> > stick
> > > > with
> > > > the legacy whitelist plugin until all of the platforms I care about
> > > support
> > > > new whitelisting?  Or they already do support the new whitelisting?
> > > >
> > >
> > > Most platforms *do not* support the new whitelisting. As of right now,
> > it's
> > > Android 4.0.0, and iOS (4.0.x development branch).
> > >
> > > If you're building a cross-platform app, there are a couple of options,
> > but
> > > they all come down to the fact that you need to use the old syntax for
> > any
> > > platforms other than Android.
> > >
> > >
> > > 1. Install the legacy plugin, and use the same syntax for everything
> > > (easiest)
> > >
> > > 2. Install the new whitelist plugin, and have separate config.xml files
> > for
> > > each platform. This may or may not be feasible, depending on your build
> > > system. You'll probably have to swap the config file out between builds
> > of
> > > different platforms (I can't remember off-hand if there's any syntax in
> > > config.xml to have platform-dependent sections, but that would make
> this
> > > easier.)
> > >
> > > 3. Install the new whitelist plugin, and use *both* syntaxes in
> > config.xml.
> > > The new plugin uses <access> tags for network requests, but not for
> > > navigation, so you'd have to include <allow-navigation> tags as well,
> if
> > > you have more than a single-page-app. You can include both kinds of
> tags,
> > > though, and the platforms will happily just pick out the ones they
> > > understand.
> > >
> > >
> > > > Thanks,
> > > > Leo
> > > >
> > > > -----Original Message-----
> > > > From: Joe Bowser [mailto:bowserj@gmail.com]
> > > > Sent: Wednesday, April 15, 2015 10:42 AM
> > > > To: dev@cordova.apache.org
> > > > Subject: Re: Android 4.0 Blog Post
> > > >
> > > > Isn't this why the Legacy Whitelist plugin exists?
> > > >
> > > > On Wed, Apr 15, 2015 at 10:40 AM Treggiari, Leo <
> > leo.treggiari@intel.com
> > > >
> > > > wrote:
> > > >
> > > > > I have a question.  With the new whitelist support in Android, does
> > > that
> > > > > mean if I'm writing a cross-platform app, do I need to deal with
> > > > > whitelisting differently in Android and other platforms (at least
> > until
> > > > the
> > > > > other platforms 'catch up')?  If not, thanks.  If so, what would
be
> > the
> > > > > best way to handle the differences - perhaps using the merges
> > > > functionality?
> > > > >
> > > > > Thanks,
> > > > > Leo
> > > > >
> > > > > -----Original Message-----
> > > > > From: agrieve@google.com [mailto:agrieve@google.com] On Behalf Of
> > > Andrew
> > > > > Grieve
> > > > > Sent: Wednesday, April 15, 2015 10:18 AM
> > > > > To: dev
> > > > > Subject: Android 4.0 Blog Post
> > > > >
> > > > > The 4.0 release is posted to npm, and I've updated the blog post
to
> > > work
> > > > > without the need for a tools release:
> > > > >
> > > > > I'd like to publish the blog post without waiting for a CLI
> release:
> > > > > - I've updated the post to use plugins-from-git so it works without
> > new
> > > > CLI
> > > > > - I've mentioned those can just wait for tools if they like
> > > > > - This should give us some early adopter feedback in case there's
a
> > > need
> > > > > for a 4.0.1
> > > > >
> > > > >
> > > > >
> > > >
> > >
> >
> https://github.com/cordova/apache-blog-posts/blob/master/2015-04-10-cordova-android-4.0.0.md
> > > > >
> > > > > Any objections?
> > > > >
> > > > >
> ---------------------------------------------------------------------
> > > > > To unsubscribe, e-mail: dev-unsubscribe@cordova.apache.org
> > > > > For additional commands, e-mail: dev-help@cordova.apache.org
> > > > >
> > > >
> > >
> >
>

Mime
  • Unnamed multipart/alternative (inline, None, 0 bytes)
View raw message