Best Practices for Using Mobile SDKs - Lilach Wagner, SafeDK (AppLovin)
0 likes108 views
This document discusses best practices for using mobile SDKs in applications. It notes that SDKs commonly used by apps include analytics, advertising, payments, social, and crash reporting SDKs. While SDKs are useful, developers are responsible for any SDKs included in their apps. The document outlines several security, privacy, and user experience best practices developers should follow when using SDKs, such as understanding what permissions and data SDKs access, being aware of SDK dependencies and update processes, asking SDK vendors questions about data collection practices, testing to avoid crashes and poor performance, and using brand safety solutions.
![if (context.checkCallingOrSelfPermission(
"android.permission.ACCESS_FINE_LOCATION")) {
Location userLocation =
locationManager.getLastKnownLocation("gps");
}
…
if (hasEmailPermission()) {
Pattern emailPattern = Patterns.EMAIL_ADDRESS;
Account[] accounts =
AccountManager.get(this.mContext).getAccounts();
…
}
The dark side of SDK permissions](https://image.slidesharecdn.com/lilachwagner-droidcon2019sdkbestpracticesrs1-191224162434/85/Best-Practices-for-Using-Mobile-SDKs-Lilach-Wagner-SafeDK-AppLovin-9-320.jpg)
![Best practice #3: be careful of updates
apply plugin: 'com.android.application’
android {
…
}
buildscript {
repositories {
jcenter()
}
}
dependencies {
compile fileTree(dir: 'libs', include: ['*.jar'])
compile 'com.android.support:appcompat-v7:25.2.0'
compile 'com.android.support:mediarouter-v7:25.2.0'
compile 'com.google.android.gms:play-services-ads:9.0.0'
compile 'com.google.ads.interactivemedia.v3:interactivemedia:3.6.0'
compile 'com.android.support.constraint:constraint-layout:1.0.2'
compile 'com.twitter.sdk.android:twitter:3.1.1'
compile 'com.somesdk:sdk:+'
testCompile 'junit:junit:4.12’
}
apply plugin: ‘com.android.application’
android {
...
}
buildscript {
repositories {
jcenter()
google()
}
}
dependencies {
implementation fileTree(dir: 'libs', include: ['*.aar’])
implementation 'com.android.support:appcompat-v7:28.0.0’
implementation 'com.android.support.constraint:constraint-layout:1.1.3’
implementation 'com.google.android.gms:play-services-ads:18.0.1’
implementation ‘com.twitter.sdk.android:twitter:3.3.0’
implementation ‘com.somesdk:sdk:+’
testImplementation ‘junit:junit:4.12’
}](https://image.slidesharecdn.com/lilachwagner-droidcon2019sdkbestpracticesrs1-191224162434/85/Best-Practices-for-Using-Mobile-SDKs-Lilach-Wagner-SafeDK-AppLovin-17-320.jpg)
Ad
More Related Content
Similar to Best Practices for Using Mobile SDKs - Lilach Wagner, SafeDK (AppLovin) (20)
More from DroidConTLV (20)
Ad
Recently uploaded (20)
Ad
Best Practices for Using Mobile SDKs - Lilach Wagner, SafeDK (AppLovin)
- 1. Presented by Lilach Wagner iOS Developer Best Practices for Using Mobile SDKs
- 3. 18 Average Of SDKS in Apps
- 4. Eurosport 59 SDKs Lucky Day 58 SDKs Perfect 365 77 SDKs
- 5. Most popular SDK categories with App publishers Analytics Advertising Payment Social Crash Reporting Location Marketing Automation Attribution 80.8% 77.5% 56.6% 48.4% 38.8% 29.3% 18.0% 15.5%
- 6. SDKs are Great! But there’s always a but…
- 7. It’s someone else’s code inside yours Yet you are responsible for it…
- 8. Security & Privacy User Experience
- 9. if (context.checkCallingOrSelfPermission( "android.permission.ACCESS_FINE_LOCATION")) { Location userLocation = locationManager.getLastKnownLocation("gps"); } … if (hasEmailPermission()) { Pattern emailPattern = Patterns.EMAIL_ADDRESS; Account[] accounts = AccountManager.get(this.mContext).getAccounts(); … } The dark side of SDK permissions
- 10. What SDKs aren’t telling you Location User Apps Accounts Contact Microphone Calendar 28.6% 14.2% 8.0% 5.5% 5.3% 3.0%
- 11. I know what your SDKs did last summer
- 12. COPPA, CCPA and GDPR compliance You are responsible for the information SDKs are collecting in your app
- 13. Security & Privacy Best Practices
- 14. <manifest xmlns:android="http://schemas.android.com/apk/res/android" package="com.google.android.gms.measurement"> <uses-sdk android:minSdkVersion="14"/> <!-- Required permission for App measurement to run. --> <uses-permission android:name="android.permission.INTERNET"/> <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE"/> <uses-permission android:name="android.permission.WAKE_LOCK"/> <application> <receiver android:name="com.google.android.gms.measurement.AppMeasurementReceiver“ android:enabled="true" android:exported="false"> </receiver> <receiver android:name=“.AppMeasurementInstallReferrerReceiver" android:permission="android.permission.INSTALL_PACKAGES" android:enabled="true"> <intent-filter> <action android:name="com.android.vending.INSTALL_REFERRER"/> </intent-filter> </receiver> <service android:name="com.google.android.gms.measurement.AppMeasurementService" android:enabled="true" android:exported="false"/> </application> </manifest> Best practice #1: know the basic changes
- 15. Best practice #1: know the basic changes
- 16. Best practice #2: know the dependencies <dependencies> <dependency> <groupId>com.squareup.retrofit2</groupId> <artifactId>retrofit</artifactId> <version>2.1.0</version> </dependency> <dependency> <groupId>com.squareup.retrofit2</groupId> <artifactId>converter-gson</artifactId> <version>2.1.0</version> </dependency> <dependency> <groupId>com.google.code.gson</groupId> <artifactId>gson</artifactId> <version>2.7</version> </dependency> <dependency> <groupId>com.squareup.okhttp3</groupId> <artifactId>okhttp</artifactId> <version>3.4.2</version> </dependency> </dependencies> ~/.gradle/caches/modules-2/files-2.1/
- 17. Best practice #3: be careful of updates apply plugin: 'com.android.application’ android { … } buildscript { repositories { jcenter() } } dependencies { compile fileTree(dir: 'libs', include: ['*.jar']) compile 'com.android.support:appcompat-v7:25.2.0' compile 'com.android.support:mediarouter-v7:25.2.0' compile 'com.google.android.gms:play-services-ads:9.0.0' compile 'com.google.ads.interactivemedia.v3:interactivemedia:3.6.0' compile 'com.android.support.constraint:constraint-layout:1.0.2' compile 'com.twitter.sdk.android:twitter:3.1.1' compile 'com.somesdk:sdk:+' testCompile 'junit:junit:4.12’ } apply plugin: ‘com.android.application’ android { ... } buildscript { repositories { jcenter() google() } } dependencies { implementation fileTree(dir: 'libs', include: ['*.aar’]) implementation 'com.android.support:appcompat-v7:28.0.0’ implementation 'com.android.support.constraint:constraint-layout:1.1.3’ implementation 'com.google.android.gms:play-services-ads:18.0.1’ implementation ‘com.twitter.sdk.android:twitter:3.3.0’ implementation ‘com.somesdk:sdk:+’ testImplementation ‘junit:junit:4.12’ }
- 18. Best practice #4: ask the questions What information are you collecting? What information are you trying to collect? What are you storing on your servers and for how long? Can user opt-out? How?
- 19. Security & Privacy User Experience
- 20. Who’s crashing the party? SDK 1 SDK 2 SDK 3 SDK 4 SDK 1 SDK 2
- 21. Main reasons for SDKs crashes & ANRs Out of Memory Null Pointers & Derefrenced Pointers Concurrency & Threads Reliance on OS Resources Views & Layouts Javascript crashes (ads)
- 22. When ads go bad
- 23. When ads go worse
- 25. Best practice #5: don’t go breaking my app
- 26. Best practice #6: release to a small % first
- 27. Best practice #7: brand safety solutions
- 28. SDKs are Great! But they can access private user information, impact user experience and put your app at risk
- 29. Whenever throwing a kick-ass party, be careful of any guests that might spike the punch