At least it is more common for gradle configs to use HTTPS, but it is still quite easy mess up a config and force users to use HTTP instead. This is especially concerning considering that developers are more and more being directly targeted. It inherits this terrible practice from maven, which has been shown to be an easy path to exploit anyone using it. It will happily download and execute code without any kind of verification whatsoever. The most glaring issue from my point of view is the security issues in gradle.
automatic trustworthy downloads, no need to verify hash sums or think about HTTPS.The first question a lot of Android developers are probably asking is: why would we want to put the Android tools into Debian when there is already an official distribution from Google with it’s own update tools? It turns out there are many reasons, mostly centered around making things much easier to use, as well as addressing some key security concerns. That includes: Ubuntu, Mint, Elementary, and many more. Since this work is in Debian, all of the Debian-derivatives will automatically inherit this work. This project is in conjunction with the Java team since there is overlap between Android and Java tools, like gradle, maven, etc. We are going to be working on getting the Android SDK and tools into Debian, as part of the Debian Android Tools team, building upon the existing work already included from the Java and Android Tools teams.
As part of Debian’s project in Google Summer of Code, I’ll be working with two students, Kai-Chung Yan and Komal Sukhani, and another mentor from the Debian Java Team team, Markus Koschany.
0 kommentar(er)
