cordova-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Steven Gill <stevengil...@gmail.com>
Subject Re: Android 4.0 Blog Post
Date Thu, 16 Apr 2015 06:48:16 GMT
Tweeted! https://twitter.com/apachecordova/status/588593365387644929

On Wed, Apr 15, 2015 at 6:52 PM, Andrew Grieve <agrieve@chromium.org> wrote:

> Posted!
>
> Steve - can tweet it from @ApacheCordova?
> https://cordova.apache.org/announcements/2015/04/15/cordova-android-4.0.0.html
>
> On Wed, Apr 15, 2015 at 5:31 PM, Treggiari, Leo <leo.treggiari@intel.com>
> wrote:
>
>> Thanks all for the information and suggestions on whitelisting.  Very
>> helpful!
>>
>> Leo
>>
>> -----Original Message-----
>> From: agrieve@google.com [mailto:agrieve@google.com] On Behalf Of Andrew
>> Grieve
>> Sent: Wednesday, April 15, 2015 11:51 AM
>> To: dev
>> Subject: Re: Android 4.0 Blog Post
>>
>> You can customize the tags per-platform via <platform
>> name="android>...</platform>.
>> Although, the new tags will be ignored by other platforms anyways, and
>> <access> remains the way to whitelist network URLs.
>> So, in practice I think things should mostly just work out.
>>
>> On Wed, Apr 15, 2015 at 2:43 PM, Brian LeRoux <b@brian.io> wrote:
>>
>> > from a fictional blog post I should write: "3 ways to bulletproof your
>> > network"
>> >
>> > if you want to ensure your app only talks to domains you specify then:
>> >
>> > 1. do not include 3rd party scripts (or if you do make sure you trust
>> them
>> > and maybe keep an eye out for document.write!)
>> > 2. use ssl for all your http traffic
>> > 3. only talk to external services through a proxy you run (and auth)
>> >
>> >
>> >
>> > On Wed, Apr 15, 2015 at 1:14 PM, Ian Clelland <iclelland@chromium.org>
>> > wrote:
>> >
>> > > On Wed, Apr 15, 2015 at 1:47 PM, Treggiari, Leo <
>> leo.treggiari@intel.com
>> > >
>> > > wrote:
>> > >
>> > > > If anyone has the time to educate me, then please pardon my
>> ignorance.
>> > > >
>> > > > Then you're suggesting that if I'm writing a cross-platform app, I
>> > stick
>> > > > with
>> > > > the legacy whitelist plugin until all of the platforms I care about
>> > > support
>> > > > new whitelisting?  Or they already do support the new whitelisting?
>> > > >
>> > >
>> > > Most platforms *do not* support the new whitelisting. As of right now,
>> > it's
>> > > Android 4.0.0, and iOS (4.0.x development branch).
>> > >
>> > > If you're building a cross-platform app, there are a couple of
>> options,
>> > but
>> > > they all come down to the fact that you need to use the old syntax for
>> > any
>> > > platforms other than Android.
>> > >
>> > >
>> > > 1. Install the legacy plugin, and use the same syntax for everything
>> > > (easiest)
>> > >
>> > > 2. Install the new whitelist plugin, and have separate config.xml
>> files
>> > for
>> > > each platform. This may or may not be feasible, depending on your
>> build
>> > > system. You'll probably have to swap the config file out between
>> builds
>> > of
>> > > different platforms (I can't remember off-hand if there's any syntax
>> in
>> > > config.xml to have platform-dependent sections, but that would make
>> this
>> > > easier.)
>> > >
>> > > 3. Install the new whitelist plugin, and use *both* syntaxes in
>> > config.xml.
>> > > The new plugin uses <access> tags for network requests, but not for
>> > > navigation, so you'd have to include <allow-navigation> tags as well,
>> if
>> > > you have more than a single-page-app. You can include both kinds of
>> tags,
>> > > though, and the platforms will happily just pick out the ones they
>> > > understand.
>> > >
>> > >
>> > > > Thanks,
>> > > > Leo
>> > > >
>> > > > -----Original Message-----
>> > > > From: Joe Bowser [mailto:bowserj@gmail.com]
>> > > > Sent: Wednesday, April 15, 2015 10:42 AM
>> > > > To: dev@cordova.apache.org
>> > > > Subject: Re: Android 4.0 Blog Post
>> > > >
>> > > > Isn't this why the Legacy Whitelist plugin exists?
>> > > >
>> > > > On Wed, Apr 15, 2015 at 10:40 AM Treggiari, Leo <
>> > leo.treggiari@intel.com
>> > > >
>> > > > wrote:
>> > > >
>> > > > > I have a question.  With the new whitelist support in Android,
>> does
>> > > that
>> > > > > mean if I'm writing a cross-platform app, do I need to deal with
>> > > > > whitelisting differently in Android and other platforms (at least
>> > until
>> > > > the
>> > > > > other platforms 'catch up')?  If not, thanks.  If so, what would
>> be
>> > the
>> > > > > best way to handle the differences - perhaps using the merges
>> > > > functionality?
>> > > > >
>> > > > > Thanks,
>> > > > > Leo
>> > > > >
>> > > > > -----Original Message-----
>> > > > > From: agrieve@google.com [mailto:agrieve@google.com] On Behalf
Of
>> > > Andrew
>> > > > > Grieve
>> > > > > Sent: Wednesday, April 15, 2015 10:18 AM
>> > > > > To: dev
>> > > > > Subject: Android 4.0 Blog Post
>> > > > >
>> > > > > The 4.0 release is posted to npm, and I've updated the blog post
>> to
>> > > work
>> > > > > without the need for a tools release:
>> > > > >
>> > > > > I'd like to publish the blog post without waiting for a CLI
>> release:
>> > > > > - I've updated the post to use plugins-from-git so it works
>> without
>> > new
>> > > > CLI
>> > > > > - I've mentioned those can just wait for tools if they like
>> > > > > - This should give us some early adopter feedback in case there's
>> a
>> > > need
>> > > > > for a 4.0.1
>> > > > >
>> > > > >
>> > > > >
>> > > >
>> > >
>> >
>> https://github.com/cordova/apache-blog-posts/blob/master/2015-04-10-cordova-android-4.0.0.md
>> > > > >
>> > > > > Any objections?
>> > > > >
>> > > > >
>> ---------------------------------------------------------------------
>> > > > > To unsubscribe, e-mail: dev-unsubscribe@cordova.apache.org
>> > > > > For additional commands, e-mail: dev-help@cordova.apache.org
>> > > > >
>> > > >
>> > >
>> >
>>
>
>

Mime
  • Unnamed multipart/alternative (inline, None, 0 bytes)
View raw message