Escaping the Dependency Hell on Android
summary
A code-structure detection method uses Merkle tree profiling and fuzzy method descriptors to resist obfuscation and pinpoint exact library versions; applied to Google Play it scans 1.26M apps and identifies ~2M library instances. Findings: over 70% of libraries are severely outdated, 86% of included libraries can be upgraded by at least one version without source changes, and 97.8% drop-in fixable apps using a vulnerable library can be fixed by replacing the version. An open-source LibScout plus an Android Studio extension provides offline, per-API compatibility and update-effort reports.
AI-written summary · about
chapters (7)
- 0:00Introduction to dependency risks
- 10:58Measuring outdated Facebook SDK
- 14:33Why developers avoid updates
- 22:43API compatibility mismatches
- 26:35Root causes and ecosystem gaps
- 28:22Introducing UpToDate extension
- 33:20Key takeaways and resources
related talks
47mThe definitive guide to Android library development
37mAndroid Librarian's Guide: Building Robust Libraries a…
32mWriting Android Libraries
36mAdvanced Android app shrinking techniques
40mModularizing Android Applications
29m10 Ways To Improve Your Android App Performance
47mDefending Your Users
03mInterview