I have no idea what my app is doing
summary
Claims that public Maven repos can inject malicious code into released apps and demonstrates detection and mitigation: network inspection with Charles or Wireshark and on-device capture using Chucker, lock versions via dependency locking, constrain transitive versions, and order/restrict repositories to prevent pulling spoofed artifacts. Shows a real cross-publish incident where packages like Android Audio Recorder and Timber get uploaded to JCenter (a cross build injection) and explains Gradle version-resolution quirks and enforced checks (static analysis, pre-commit hooks) that successfully catch many issues.
AI-written summary · about
chapters (13)
- 0:00Start
- 2:29How do you eat a Pizza?
- 3:37You can't eat everything
- 4:50Tech Debt
- 8:22Proxy
- 9:18Chucker
- 11:04Manifest
- 12:42Enforce conventions
- 18:18Give me the best sushi
- 22:21Favourite Restaurant
- 24:23Gluten Free
- 29:23Health Checks
- 31:42A Confusing Order
related talks
31mI have no idea what my app is doing ¯\_(ツ)_/¯ - Protecting your application from unintended side eff
36mHow to stop the ‘Gradle Snatchers’: Securing your builds from baddies
46mStrengthening Java Apps: Best Practices in Secure Coding for Java Developers
38mHow to stop the ‘Gradle Snatchers’: Securing your builds from baddies
37mHow to stop the ‘Gradle Snatchers’: Securing your builds from baddies
45mI just hacked your app!
01h 32mYour Applications are Under Attack: Protecting each step of the development lifecycle
45mI just hacked your app!