cordova-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Joe Bowser <>
Subject Re: [DISCUSS] Core Plugins and Android API 23
Date Thu, 07 Jan 2016 23:08:05 GMT
On Thu, Jan 7, 2016 at 2:42 PM, Jason Ginchereau <>

> Hi Joe,
> Can you provide more specific reasons why you think using reflection is
> problematic in this case? This seems to me like exactly the sort of
> situation where reflection is an appropriate solution.

I can provide two good reasons, and one personal reason:

1. Since the helper class lives in the plugin, we have to have the same
code in numerous plugins.
2. This doesn't help the people using the apps, it only helps the
developers writing them, and it only helps the developers not upgrade.  I
don't want to help people to avoid upgrading to a later version of Cordova.
3. I've been burned by reflection too many times to want it anywhere.

> There are valid reasons why many app developers might not be ready to move
> to API level 23:
>   1) They have an app which is stabilizing or in maintenance mode and they
> don't want to risk destabilization by moving to a new major Cordova
> version, Cordova Android platform, and Android API level.

Sure, not moving to a new version of Cordova right away may be valid
because our upgrade process feels broken and untested, but when it's paired
with an Android API level, you either move up or you get left behind and
that should include plugins.  We can't guarantee that the latest plugins
will work with all versions of Cordova, and I don't think anyone wants to
do the testing for the plugins.  I sure don't want to open that pandora's
box, which is why I oppoose this change so strongly.

>   2) They are using a 3rd-party plugin which has not yet been updated to
> request Android permissions as required by API level 23. There are probably
> a lot of plugins affected, since access to any of the following things on
> Android M requires runtime permission requests: calendar, contacts, phone,
> camera, microphone, location, beacons, sensors, SMS, storage.

Marshmallow is rolling out to real devices now and these third party
plugins are going to have to get updated sooner or later.  My two year old
Moto X (2nd gen) just got an update to Marshmallow.  We can't constantly
fight the future every time the Android project changes something just
because we don't have a very healthy plugin ecosystem (I consider the mass
abandonment of third-party plugins by their developers unhealthy).  This
project already has a bad habit of doing that.

>   3) They might not have the capacity or ability to test their app on
> devices running Android M. Because API 23 enables the new permissions model
> only on Android M, it requires testing on that platform.

I don't agree with this argument, because you can run apps compiled against
API 23 on older devices, and if you have to, you can still spot check the
permissions on the emulator.  As much as I hate the emulator, the new
changes Google made to it are good, and it's probably worth using.  I still
think that apps need to be tested on a real device, but spot checking
certain things on an emulator is fine if you don't have the latest and

> In any of the above cases, developers might still like to benefit from
> some of the major bug fixes in those 5 popular core plugins mentioned
> below. Or even if they weren't specifically looking for bug fixes, it would
> be a much better experience if adding or updating one of those plugins
> would just work, rather than failing on Android. The explanation for the
> failure will not be obvious to many users, if they overlooked the warning
> when installing the plugin or if they were using another tool to add the
> plugin where the warning wasn't surfaced.
> Of course developers should be encouraged to upgrade to the latest most
> secure highest-quality version of Cordova. But the encouragement does not
> need to be so forceful. This proposed change gives developers more time to
> upgrade, and allows for more choice about when to upgrade individual parts
> (plugins) rather than limiting them to all-or-nothing.
I completely disagree and I think it does need to be forceful, because
otherwise developers will NEVER upgrade.  The only time developers who use
Cordova upgrade is when we force them to, and even then there's still tons
of old versions of Cordova out there that people are using despite the
Google Security issues.  We can't test these new plugins against every old
version of Cordova, and this change goes against what we talked about

> Jason
> -----Original Message-----
> From: Joe Bowser []
> Sent: Wednesday, January 6, 2016 4:45 PM
> To: dev <>
> Subject: Re: [DISCUSS] Core Plugins and Android API 23
> I'm very against this idea because we've been burned by using reflection
> in the past.  I also feel that this allows developers be terrible and to
> stick with older, more insecure versions of Cordova, which is the main
> reason I'm against it.  I don't think that requiring API level 23 is a
> problem.
> There's nothing saying that they can't use prior versions of plugins with
> their applications, but we shouldn't be using reflection because these
> users are too lazy to update their Android environment or get their plugins
> to work.  I'm almost certain that this will burn us in the future when some
> users wants some API that we removed for a good reason.
> Seriously, if we allow this to happen, what was the point of even
> incrementing the version to Android 5.0? Also, do we have to basically
> write the apps for our users as well at this point, because they're unable
> to deal with change?
> On Wed, Jan 6, 2016 at 4:08 PM, Richard Knoll <>
> wrote:
> > Hey all,
> >
> > As has been very thoroughly discussed at this point, the
> > cordova-android
> > 5.0.0 update included breaking changes for plugins in response to the
> > new permission model that Android Marshmallow introduced.
> > Unfortunately, this means that our plugins that took advantage of the
> > new permission APIs are no longer able to build on Cordova platforms
> before cordova-android 5.0.0.
> > Really, this update only came down to two new methods in
> CordovaInterface:
> > one for requesting permissions and one for checking them. Since this
> > is such a minor API change, it is trivial for us to modify the core
> > plugins that require permissions to use reflection and allow projects
> > that are still using the earlier Android APIs to keep using them. I
> > have done so for the camera plugin as an example [1]. All it took was
> > writing a helper class for permissions that I made general enough to
> > be easily included in the other core plugins.
> >
> > This change gives users who are not ready to embrace Android API 23
> > some more time before they are forced to update (e.g. if they are
> > still using some other plugins that have yet to be updated). It also
> > helps us reduce some of the current plugin versioning woes we're
> > having. Anyone using Cordova 5.x stands to benefit, since this can
> > prevent some confusion and frustration caused by broken builds when
> > their cli fetches the latest plugins. In my opinion, the cost of
> > copying a helper class is worth that potential payoff. What do others
> think?
> >
> > I did a little testing with my modified camera plugin and
> > cordova-android
> > 3.7.1 (which I arbitrarily chose) and it built/seemed to work fine. If
> > people support this idea, I can do a bit more testing and make PRs for
> > the other plugins.
> >
> > For the record, the affected plugins are as follows:
> >     cordova-plugin-camera
> >     cordova-plugin-contacts
> >     cordova-plugin-file
> >     cordova-plugin-geolocation
> >     cordova-plugin-media
> >
> > Thanks,
> > Richard
> > [1]
> >
> > ll:reflection?expand=1
> >

  • Unnamed multipart/alternative (inline, None, 0 bytes)
View raw message