Tweeted! https://twitter.com/apachecordova/status/588593365387644929
On Wed, Apr 15, 2015 at 6:52 PM, Andrew Grieve <agri...@chromium.org> wrote: > Posted! > > Steve - can tweet it from @ApacheCordova? > https://cordova.apache.org/announcements/2015/04/15/cordova-android-4.0.0.html > > On Wed, Apr 15, 2015 at 5:31 PM, Treggiari, Leo <leo.treggi...@intel.com> > wrote: > >> Thanks all for the information and suggestions on whitelisting. Very >> helpful! >> >> Leo >> >> -----Original Message----- >> From: agri...@google.com [mailto:agri...@google.com] On Behalf Of Andrew >> Grieve >> Sent: Wednesday, April 15, 2015 11:51 AM >> To: dev >> Subject: Re: Android 4.0 Blog Post >> >> You can customize the tags per-platform via <platform >> name="android>...</platform>. >> Although, the new tags will be ignored by other platforms anyways, and >> <access> remains the way to whitelist network URLs. >> So, in practice I think things should mostly just work out. >> >> On Wed, Apr 15, 2015 at 2:43 PM, Brian LeRoux <b...@brian.io> wrote: >> >> > from a fictional blog post I should write: "3 ways to bulletproof your >> > network" >> > >> > if you want to ensure your app only talks to domains you specify then: >> > >> > 1. do not include 3rd party scripts (or if you do make sure you trust >> them >> > and maybe keep an eye out for document.write!) >> > 2. use ssl for all your http traffic >> > 3. only talk to external services through a proxy you run (and auth) >> > >> > >> > >> > On Wed, Apr 15, 2015 at 1:14 PM, Ian Clelland <iclell...@chromium.org> >> > wrote: >> > >> > > On Wed, Apr 15, 2015 at 1:47 PM, Treggiari, Leo < >> leo.treggi...@intel.com >> > > >> > > wrote: >> > > >> > > > If anyone has the time to educate me, then please pardon my >> ignorance. >> > > > >> > > > Then you're suggesting that if I'm writing a cross-platform app, I >> > stick >> > > > with >> > > > the legacy whitelist plugin until all of the platforms I care about >> > > support >> > > > new whitelisting? Or they already do support the new whitelisting? >> > > > >> > > >> > > Most platforms *do not* support the new whitelisting. As of right now, >> > it's >> > > Android 4.0.0, and iOS (4.0.x development branch). >> > > >> > > If you're building a cross-platform app, there are a couple of >> options, >> > but >> > > they all come down to the fact that you need to use the old syntax for >> > any >> > > platforms other than Android. >> > > >> > > >> > > 1. Install the legacy plugin, and use the same syntax for everything >> > > (easiest) >> > > >> > > 2. Install the new whitelist plugin, and have separate config.xml >> files >> > for >> > > each platform. This may or may not be feasible, depending on your >> build >> > > system. You'll probably have to swap the config file out between >> builds >> > of >> > > different platforms (I can't remember off-hand if there's any syntax >> in >> > > config.xml to have platform-dependent sections, but that would make >> this >> > > easier.) >> > > >> > > 3. Install the new whitelist plugin, and use *both* syntaxes in >> > config.xml. >> > > The new plugin uses <access> tags for network requests, but not for >> > > navigation, so you'd have to include <allow-navigation> tags as well, >> if >> > > you have more than a single-page-app. You can include both kinds of >> tags, >> > > though, and the platforms will happily just pick out the ones they >> > > understand. >> > > >> > > >> > > > Thanks, >> > > > Leo >> > > > >> > > > -----Original Message----- >> > > > From: Joe Bowser [mailto:bows...@gmail.com] >> > > > Sent: Wednesday, April 15, 2015 10:42 AM >> > > > To: dev@cordova.apache.org >> > > > Subject: Re: Android 4.0 Blog Post >> > > > >> > > > Isn't this why the Legacy Whitelist plugin exists? >> > > > >> > > > On Wed, Apr 15, 2015 at 10:40 AM Treggiari, Leo < >> > leo.treggi...@intel.com >> > > > >> > > > wrote: >> > > > >> > > > > I have a question. With the new whitelist support in Android, >> does >> > > that >> > > > > mean if I'm writing a cross-platform app, do I need to deal with >> > > > > whitelisting differently in Android and other platforms (at least >> > until >> > > > the >> > > > > other platforms 'catch up')? If not, thanks. If so, what would >> be >> > the >> > > > > best way to handle the differences - perhaps using the merges >> > > > functionality? >> > > > > >> > > > > Thanks, >> > > > > Leo >> > > > > >> > > > > -----Original Message----- >> > > > > From: agri...@google.com [mailto:agri...@google.com] On Behalf Of >> > > Andrew >> > > > > Grieve >> > > > > Sent: Wednesday, April 15, 2015 10:18 AM >> > > > > To: dev >> > > > > Subject: Android 4.0 Blog Post >> > > > > >> > > > > The 4.0 release is posted to npm, and I've updated the blog post >> to >> > > work >> > > > > without the need for a tools release: >> > > > > >> > > > > I'd like to publish the blog post without waiting for a CLI >> release: >> > > > > - I've updated the post to use plugins-from-git so it works >> without >> > new >> > > > CLI >> > > > > - I've mentioned those can just wait for tools if they like >> > > > > - This should give us some early adopter feedback in case there's >> a >> > > need >> > > > > for a 4.0.1 >> > > > > >> > > > > >> > > > > >> > > > >> > > >> > >> https://github.com/cordova/apache-blog-posts/blob/master/2015-04-10-cordova-android-4.0.0.md >> > > > > >> > > > > Any objections? >> > > > > >> > > > > >> --------------------------------------------------------------------- >> > > > > To unsubscribe, e-mail: dev-unsubscr...@cordova.apache.org >> > > > > For additional commands, e-mail: dev-h...@cordova.apache.org >> > > > > >> > > > >> > > >> > >> > >
