This document discusses several lessons about Android development that are not typically covered in school. It covers architectural changes in Android over time, security best practices, techniques for logging user activity and crash reports, strategies for building hybrid mobile-web applications, considerations for creating mobile SDKs, and approaches for testing Android apps on multiple device configurations.

1. Android Lessons You
Won’t Learn in School
Michael Galpin, Bump Technologies

2. About Me
• Apps
• Bump, eBay Mobile
• Android in Practice
• Social
• @michaelg
• +Michael Galpin

3. Agenda
• Architecture, now and
then
• Security
• Misc
• Logging
• Hybrids
• SDKs
• Testing

4. Architecture?
You have it
... even if you’ve never
thought about it
So maybe you should think
about it.

6. The
Cloud

7. The
Cloud

8. The
Cloud
•Transport

9. The
Cloud
•Transport
•Format

10. HTTP
• Apache HTTP Client
• DefaultHttpClient
• AndroidHttpClient
• HttpURLConnection
• java.net.URL

11. HTTP
• Apache HTTP Client
• DefaultHttpClient
• AndroidHttpClient
• HttpURLConnection
• java.net.URL

12. HTTP
• Apache HTTP Client
• DefaultHttpClient
• AndroidHttpClient
• HttpURLConnection
• java.net.URL

13. Format
XML JSON

14. XML
• SAX
• android.sax
• DOM
• XmlPullParser

15. JS
O
N
!

16. Don’t forget to zip

17. New World Architecture

19. Sockets
• TCP
• WebSockets
• UDP

20. No blocking allowed
• Netty, Mina (Java)
• Twisted, Diesel (Python)
• EventMachine (Ruby)
• Node.js (JavaScript)
• Nitrogen (Erlang)

21. Harder, Better, Faster, Stronger

22. Optimized Formats
• Protocol Buffers
• Thrift
• MessagePack
• Fast Infoset
• BSON

24. The Web Model
• Login page (HTTPS)
• HTTP Cookie
• Expiry

25. Mobile Logins

26. Logging In
• Full Native
• Requires “Login API”
User Experience
• Embedded Web Browser
Security
• “OAuth”
• External Web Browser

27. Tokens
• Obtained from API or OAuth flow
• Equivalent to username + password
• Storage
• Expiry

28. Defending Your Servers
• Need per-user throttles
• Can’t count on IP addresses
• Expect many legit login failures
• Anything your client can do, evil clients can
do too

29. Logging

30. What to log
• User Actions
• Key to A/B Testing
• Crashes & Exceptions

31. Logging User Actions
• Log a lot ... but don’t saturate your
network connection
• Batch logs together
• But don’t block UI thread
• Send when the user’s not busy

32. Crash Logs
• Create your own UncaughtExceptionHandler
• Thread.setDefaultUncaughtExceptionHandler
• Log crash on...
• next app launch
• from background Service

33. Even More Crash Logs
Process process =
Runtime.getRuntime().exec(String.format("logcat -t %d", 100));
InputStream stream = process.getInputStream();
<uses-permission android:name="android.permission.READ_LOGS" />

36. Android Hybrids
App
Web Page
Interface
Easy to expose “native” features to JS
Calling JS from native code, more hacky

37. WebView webView = (WebView) findViewById(R.id.web_view);
WebSettings settings = webView.getSettings();
settings.setJavaScriptEnabled(true);
settings.setDomStorageEnabled(true);
settings.setDatabasePath("/data/data/my.package/folder");
webView.setWebChromeClient(new WebChromeClient(){
@Override
public boolean onConsoleMessage(ConsoleMessage msg){
// pipe this to LogCat
}
});
webView.addJavascriptInterface(new MyInterface(), "zorro");
webView.loadUrl("javascript:tarzan.start()");

39. Why hybrid
• Specialized scenarios (OAuth)
• Server driven UI
• Testing, experimentation
• Leverage web development skills
• Cross platforms?
• UX <===> $$$

40. Mobile SDK
If you build it, they will come?

41. Public Web Services
(APIs)
• Derive value from 3rd party access
• Legacy services
• Designed for servers and PCs
• Lower barrier of use
• Enforce usage patterns / security

42. An SDK should...
• Provide local APIs to:
• Handle network communication
• Handle serialization of requests
• Handle deserialization of responses
• Deal with security
• Provide useful errors

43. The Java™ Way
• Generate code (bindings) for requests,
responses, error objects
• Provide runtime library for serialization/
deserialization
• Lots of code and lots of methods!
• Larger APKs
• 65536 methods allowed / dex file

44. Testing

45. FAQs
• Which devices?
• How many devices?
• How do you get access to devices?

46. I tested the app on my phone
...while eating a pound of bacon.

47. Numbers Game
*Maybe consider: Carriers (CDMA/GSM)

48. How to get devices
• Buy!
• Don’t forget international
• Device labs
• “Mechanical turk” services

49. Questions?