Google IO Recap: Firebase, Jetpack, Kotlin, and R8

May 15, 2019 868 Views Matt Insko

PreEmptive had the opportunity to send a couple of representatives to Google IO this year. IO 2019 didn't tell us what dessert starts with a Q, but it did showcase some great tools and frameworks as well as provide insight into the direction of Android:

Firebase and Jetpack speed up development and allow better compatibility with older platforms. Google reinforced its commitment to Kotlin stating that most of their samples and frameworks will be available first in Kotlin and later to standard Java. R8 is now the default for minification. Android will do more on-device processing to ensure better privacy.

At PreEmptive, we have similar goals:

Staying up-to-date with the latest features of Android development while maintaining compatibility with older platforms.
Support for Kotlin since DashO v8.3 (2017).
Support for R8.
On-device Checks which help protect application data.

The highlight of the trip was the ability for face-to-face meetings with Google employees. We were able to discuss what we have done to incorporate R8 with DashO's Gradle Plugin for Android (available with the DashO 10 Beta) and found we were on the same page regarding the direction of R8. We actually had a chance encounter with a developer who needed a specific piece of advice which we had already listed on The Unofficial R8 Documentation.

Overall, it was a great experience. There was a lot of information to cover in such a limited time. As in prior years, sessions were recorded and are available on YouTube. We recommend the following sessions as they provide a general overview of Android developments:

Trusted Computing: Panacea or Magical Thinking?

Can you tell the difference? Exception or the norm?

Of course, everyone is “for security” in principle. The hard question that each organization has to answer for themselves is “how much is enough?” Over-engineering is (by definition) excessive, and over-engineering application security can, in fact, be devastating as overly-complex algorithms, architectures and processes can compromise user experience, degrade performance and slow development velocity. On the other hand, punishment is swift for organizations that cut corners and do not effectively secure their applications, their data and, most importantly their users and business stakeholders. Finding and maintaining that balance can be time consuming and, because you can never be sure you’ve gotten it exactly right, it can also be a thankless job.

JavaScript is everywhere. It’s currently the world’s most popular programming language; as noted by GitHub, JavaScript has the highest number of contributors and repositories, handily outpacing other alternatives such as Python, PHP and Ruby.

The problem with all this popularity? Massive amounts of great open-source code create opportunities for both in-house development teams and malicious actors. The sheer volume of JavaScript-based services means it’s not enough just design apps with security in mind — businesses must actively mitigate emerging threats by obfuscating critical code to frustrate hacker efforts.

Not sure where to start? Here’s what you need to know about the brewing storm of JavaScript attacks and the simplest ways to reduce your total risk.

Over a year ago we wrote instructions for migrating from ProGuard or DexGuard to DashO. Since that time, Google introduced R8, fundamentally changing the Android build process. Now, we have released PreEmptive Protection DashO for Android & Java, version 10.0 with a new Android Mode that is designed to work with R8. With this release, migrating from ProGuard or DexGuard to DashO is so simple that it almost doesn't need instructions - so we're posting new instructions to make that clear!

Welcome to our new instructions!

Before we begin, let's make sure we're all on the same page. We assume you are currently:

We are proud to announce the public release of PreEmptive Protection DashO for Android & Java v10.0, the next major version of DashO, our powerful Android & Java obfuscation and app protection product.

This release has major changes to our Android support. We've blogged about R8 and Google's build architecture changes before, and this new version of DashO works together with R8 to protect Android apps and libraries. R8 does what it is best at: minification (renaming & removal) and performance (build and runtime), while DashO provides strong protection: Control Flow, String Encryption, and runtime Checks for Tamper, Debug, Root, Emulators, and more. Together you get the best of both worlds.

To accomplish this new integration, we rethought DashO from the ground up, creating a brand new Android Mode with big changes to UI, build-time behaviors, and the way DashO integrates into a Gradle build. It's DashO unlike you've ever known it: even easier to integrate, easier to understand and configure, and easier to keep up to date as your code and Android evolve.

Organizations can’t afford to leave apps unprotected. Attackers are growing more sophisticated, leveraging targeted malware campaigns and advanced evasion tactics to compromise applications and cause long-term damage. And according to Forbes, even antivirus tools designed to protect devices and software can increase overall risk: recent research found that more than 28 million Android phones were subject to security vulnerabilities thanks to insecure virus protection apps.

As a result, many companies looking to boost application protection and security without breaking their budget or introducing unexpected risk are considering in-house builds of better defenses using a combination of IT talent and publicly available tools.

The challenge? Homegrown solutions introduce the potential for DIY disasters. Let’s dig in and discover why they can’t measure up.

Google IO Recap: Firebase, Jetpack, Kotlin, and R8

Trusted Computing: Panacea or Magical Thinking?

Can you tell the difference? Exception or the norm?

No Beans About It: Why You Need JavaScript Obfuscation

Migrating from ProGuard or DexGuard to DashO - Updated!

DashO 10: Android support, rebuilt from the ground up

Application Protection Rule #1: Why In-House App Obfuscation & Defense Doesn’t Measure Up

Latest Blog Posts

Trusted Computing: Panacea or Magical Thinking?

No Beans About It: Why You Need JavaScript Obfuscation

Migrating from ProGuard or DexGuard to DashO - Updated!

DashO 10: Android support, rebuilt from the ground up

Application Protection Rule #1: Why In-House App Obfuscation & Defense Doesn’t Measure Up

Twitter