标签：#android

It’s called the Edge Panel. Here’s how to make the most of it.

Android App Protection Shouldn't Come at the Cost of Performance: The Lightweight Approach of XopProtector Android application protection has always involved a difficult trade-off. Stronger protection often means: Larger APK size Longer protection/build time Higher runtime overhead Slower application startup For large Android applications, these costs can become especially noticeable. XopProtector takes a different approach: strong protection with a focus on build efficiency, small APK overhead, and fast runtime startup. 300MB APK Protection in Under 5 Minutes For large Android projects, protection time is an important part of the development workflow. If protecting a 300MB APK takes 10–20 minutes or longer, it can significantly slow down: CI/CD pipelines Regression testing Beta releases Production builds Daily development XopProtector is designed to minimize unnecessary processing and optimize the protection pipeline for DEX, native libraries, and protected runtime data. In our testing environment, a 300MB-class APK can be protected within 5 minutes . This makes APK protection much more practical for frequent builds and automated CI/CD workflows. Actual protection time depends on hardware, APK structure, number of DEX files, native libraries, and the selected protection configuration. Small APK Size Overhead Protection should not mean dramatically increasing the APK size. Some protection solutions introduce significant additional runtime components or duplicated protected data, which can result in noticeable APK growth. XopProtector focuses on keeping the protection runtime lightweight and minimizing unnecessary additional data. The goal is simple: Original APK ↓ XopProtector ↓ Protected APK Protection ↑ Security ↑ APK overhead ↓ Build time ↓ Runtime overhead ↓ For large applications, keeping the size overhead low can be just as important as the protection itself. Fast Startup After Protection Build time is only one part of the equation. What users ultimately exper

In December 2024, Google quietly updated its closed testing rules for personal developer Console accounts. For months, indie developers had to recruit at least 20 testers to keep their app opted in for 14 consecutive days before applying for production access. Under the revised guidelines, that threshold dropped from 20 to 12 testers. Understanding the nuances of the Google Play 20 testers vs 12 testers shift helps you plan your release schedule accurately without running into unexpected delays during Google Play Console verification. While lowering the number by eight testers sounds like a major relief, the core requirements behind closed testing have not changed. Google still enforces a strict 14 consecutive day duration, and the Play Console continues to monitor tester retention and engagement. A lower numerical requirement means less logistical hassle, but maintaining a stable group of committed testers remains the primary hurdle for independent developers. The Policy Shift: From 20 to 12 Testers Google originally introduced mandatory closed testing in November 2023 to improve app quality and curb low-effort submissions on the Play Store. Initially, all new personal accounts registered on or after November 13, 2023, were required to run a closed test with at least 20 opted-in testers for 14 days without interruption. After roughly a year of developer feedback regarding how difficult it was for solo creators to find 20 reliable participants, Google reduced the requirement to 12 testers in December 2024. It is crucial to understand who this rule applies to. The requirement exclusively targets personal developer accounts created on or after November 13, 2023. If you operate an organization or business developer account, or if your personal account was registered before November 13, 2023, you are currently exempt from this mandatory closed testing gate. However, if you fall under the new personal account category, reaching 12 continuous opt-ins is a strict prerequis

We shipped a filter that threw away bad GPS readings. Months later somebody asked whether it was working, and I could not answer. The evidence was gone. That question changed how I build anything that rejects data. The obvious version, and why it rots Mileage tracking depends on trustworthy distance, and GPS lies constantly. So the first version of our cleanup did what everyone's first version does: if (! fix . isPlausible ( previous )) return // drop it, move on accumulateDistance ( fix ) Clean data comes out the other end. It feels responsible. It is also a trap, because that return destroys the only record that could ever tell you whether the rejection was correct. Six months in, someone asked the reasonable question: is the filter right? I could not say how many readings we had dropped, on which journeys, or whether any of them had been a genuine drive through a tunnel rather than a glitch. We had built a thing that made a judgement call thousands of times a day and kept no record of any of it. Persist, then classify The rebuild flipped the default. Rejection stopped being a return and became a label. Only two cases are still deleted, because they cannot physically be real: // impossible coordinates if ( fix . lat ! in - 90.0 .. 90.0 || fix . lng ! in - 180.0 .. 180.0 ) return null // impossible accuracy: too precise to be true, or useless if ( fix . accuracyM <= 0.1f || fix . accuracyM >= 250f ) return null That is the entire delete list. Everything else is persisted and sorted into named accumulators: originalDistanceM += displacement // every metre we ever saw when { fix . isMock -> mockDistanceM += displacement abnormal -> { abnormalDistanceM += displacement if ( isHardSpike ) spikeDistanceM += displacement } accuracyGated -> { /* recorded, deliberately not counted */ } else -> cleanedDistanceM += displacement } Five numbers instead of one. The UI shows cleaned . The rest live beside it. And the row itself keeps its provenance: accuracy, provider, bearing, a

When adb devices does not show the result you expect, reinstalling random drivers is rarely the best first move. The output already tells you which layer is failing. This checklist separates the most common states: device unauthorized offline An empty device list ADB not recognized by the terminal The goal is to diagnose the connection in a logical order: tool, cable, USB mode, authorization, and finally drivers. Before troubleshooting Make sure the basic setup is correct: Install the latest Android SDK Platform-Tools from Google. Use a USB cable that supports data, not only charging. Unlock the Android phone. Enable Developer options and USB debugging. Connect directly to the computer when possible instead of using an unpowered hub. The location of Developer options differs between Samsung, Xiaomi, Pixel, Huawei, OnePlus, and other interfaces. If you need the device-specific menu paths, this guide to enabling USB debugging on Android phones covers the common manufacturers and the RSA authorization step. Start with one command Open Terminal, PowerShell, or Command Prompt inside the Platform-Tools folder and run: adb devices For extra information, use: adb devices -l A normal result looks similar to this: List of devices attached R58M123ABCD device product:example model:Example device:example The word after the serial number is the important part. What each ADB state means Result Meaning Where to look first device ADB can communicate with the phone The connection is ready unauthorized The phone has not authorized this computer Phone screen and RSA prompt offline ADB sees the device but cannot communicate reliably ADB server, cable, port, or device Empty list The computer is not exposing the phone to ADB Cable, USB mode, driver, or debugging setting adb not recognized The shell cannot find the ADB executable Platform-Tools folder or PATH Case 1: The result is device This is the success state. ADB can send commands to the phone. You can test the connection with a harml

Our app ships long video lessons. Twenty to forty minutes each, watched mostly on hostel wifi and mobile data with two bars. Streaming video looks like a solved problem when you build the happy path. You wire up ExoPlayer, point it at a stream, it plays. Then real students open it on devices you have never held, and your bug tracker starts filling up with one line: "video not playing." That line turned out to be four unrelated problems. Here's what I actually learned. ## Buffering is the bug you feel before you see an error Nobody waits out a bad connection during a 35-minute lecture. On a 15-second reel a stall is annoying. In a lecture, a stall every two minutes means the student closes the app and studies from a PDF instead. So the real question was never "does it play." It was "what happens when the network stops cooperating for four seconds." Three situations broke us repeatedly: Wifi to mobile data handover mid-lesson Bandwidth that is technically connected but useless Short total drops, three to ten seconds, that should not end playback ExoPlayer gives you everything you need here. Adaptive bitrate, a configurable LoadControl , player listeners. The catch is that the defaults are tuned for general media, not for a 40-minute lecture on a bad link. What moved the numbers for us: Bigger buffers, deliberately. DefaultLoadControl.Builder().setBufferDurationsMs(...) takes a min buffer, a max buffer, the buffer needed to start playback, and the buffer needed to resume after a rebuffer. That last parameter is the interesting one. Raising it costs you a little extra time on resume and buys you far fewer repeat stalls, because the player stops trying to restart on a nearly empty buffer. Telling the user the truth. Our first version showed a spinner and nothing else. A spinner with no context reads as "the app is frozen," so students force-closed and reopened, which threw away the buffer and made everything worse. Saying "reconnecting" instead of spinning silently cut t

Right now the developer community seems fascinated (if not outright obsessed) with agentic coding. That wave is real, and it will heavily impact how we build software. But let's not forget there are other topics worth attention. Here, the focus is something less fashionable: sensitive permissions on Android. After shipping TKWeek updates outside Google Play and answering the inevitable Why isn't this on the Play Store? with a blunt Sensitive permissions , it is fair to ask whether that topic still matters in 2026. I can answer that from shipping one app for a long time. I started working on TKWeek back in 2010. Some time later I added a module called My day that shows important information for a particular day, including missed phone calls. READ_CALL_LOG is a dangerous permission since API level 23, so users who do not want to allow the app to read those details have a secure, reliable safety hatch. Still, after a late-2018 announcement, by 2019 Google Play was enforcing READ_CALL_LOG under its high-risk / sensitive rules. Now, what does that store layer mean anyway? Dangerous on the device, sensitive in the store On the platform side, Android already classifies quite a few permissions as dangerous : they guard private user data, and starting with API 23 the user must grant them at runtime. READ_CALL_LOG is in that bucket ( Manifest.permission.READ_CALL_LOG ). Google Play's extra layer sits on top of that. In Play docs the umbrella is high-risk or sensitive permissions; Call Log and SMS are restricted permission groups. Either way, it is store policy, not just OS protection. For Call Log and SMS, only narrow use cases are allowed (typically default Phone, SMS, or Assistant handlers, plus a short list of exceptions), and you must declare them in Play Console or remove them from the manifest. See Google's Permissions and APIs that Access Sensitive Information and Use of SMS or Call Log permission groups . Back in 2021 that policy stopped being theoretical. Showing mis

So, my fiance wanted a health and fitness app, to track meals, exercise routines, manage upcoming...

While some of the features see Google playing catch-up to Apple, which already offers similar features for iPhone users, others specifically leverage Gemini to provide various improvements.

New features are rolling out across the Android ecosystem starting today.

Google announced new features coming to Android devices as part of this month's feature drop update. Among the highlights are the introduction of Motion Assist - Android's version of Apple's Motion Cues feature, which tries to reduce motion sickness by overlaying dots on your screen that move in response to a vehicle's movements - as […]

The password is in your password manager, exactly where it should be. The login prompt is on a different device. Perhaps you are preparing an Android device for a maintenance task. It needs one service password. You do not want to sign it into your email account or give it access to the rest of your password vault just to fill in that field. Typing the password manually is an option. Sending it to yourself is another. Neither is particularly appealing when the value is long, the task is temporary, and you are trying to avoid creating unnecessary copies. We build WithinCells at schukai for this kind of handoff. The question behind it is deliberately narrow: how do you get one secret onto the device that needs it, without setting up more access than the task requires? Transfer is a different job from storage I do not see a handoff tool as a replacement for a password manager. Your vault should remain the place where you organise and retrieve credentials. A transfer tool has a smaller job: help you deliver a selected value to a selected destination. Where your existing password manager already handles that well, use it. There is no benefit in adding another application just to repeat a working process. The interesting case is the exception: a temporary device, a one-off setup, or a login where the usual workflow is unavailable. That is also where I would draw the line. Manually moving a credential for one maintenance task is different from distributing secrets across a fleet. For the latter, use managed provisioning and automated secrets management rather than scaling up manual transfers. OWASP recommends reducing human handling of secrets where possible. ¹ The QR code is the package, not a download link WithinCells uses QR-based device pairing. Transfers are encrypted for the chosen recipient and signed by the sender. In QR mode, the code holds the encrypted transfer itself, rather than a URL for retrieving it. The handoff needs neither a shared network nor a cloud ac

I created this article for the purposes of entering the All Things Agentic Hackathon. Shoots is an Android and web photography Companion. A photographer takes ordinary Shots. Shoots reviews them in the background, preserves the Evidence behind its reading, and can offer one optional Experiment when the record supports it. This is the technical version of the project. It is about how a file becomes a durable learning record, how the agents communicate, and where I deliberately refused to let a model make the decision. The design in one sentence The model panel reads a single Shot. The system around it does the work: it creates a durable Run, moves tiny events through independently retryable stages, re-reads state at every boundary, records every outcome, and only settles a Shoot after every member Run is accounted for. That distinction matters. I did not want a chain of agents passing prose to one another until it sounded convincing. I wanted constrained model calls inside a workflow whose state, retries, and outputs could be inspected later. Repository structure The codebase is deliberately split by responsibility rather than by screen or agent name: android/ phone/ # approved Camera media work/ # background upload and retry data/ # cache, API, identity ui/ # Android screens backend/app/ api/ # FastAPI ingress and push endpoints domain/ # pure rules and state transitions imaging/ # EXIF, pixels, visual artifacts agents/ # ADK agents and prompts services/ # workflow orchestration infra/ # storage, Pub/Sub, Drive, secrets frontend/src/ stores/ # API and SSE state pages/ # web audit desk components/ # receipts and visual Evidence infra/ # Google Cloud deployment and Scheduler The important boundary is domain/ . It has no I/O. It owns the rules that must be reproducible: grid-cell conversion, taxonomy validation, panel consensus, Criteria checks, Technique Map projections, and Run state transitions. services/ can call models and storage. domain/ cannot. Two kinds of orc

Text-to-Speech Is Not a speak() Call The challenge 🧪 If you have ever assumed Text-to-Speech on Android is straightforward, this article is for you. But first, let us test your skills. Think you can make this speak on Android? 🙏 अव्यक्तोऽयमचिन्त्योऽयमविकार्योऽयमुच्यते । "Invisible, beyond thought, unchanging." — Krishna describing the nature of the self. Today is World Sanskrit Day, so the timing is fitting. 🕉️ Try playing it on the plain TextToSpeech API that Google provides — but specifically with a Sanskrit voice. Build a minimal Android app, initialize the TTS engine, set the language to Sanskrit, and call speak() on this string. Chances are it will not speak anything. Not even a single letter would be uttered. 🔇 That is the moment when a developer realizes that TTS is not a simple API call. The twist 🔄 Use a Marathi or Hindi voice instead. Same engine. Same text. Same API call. It plays perfectly. 🗣️ Same engine. Same verse. Different voice. Completely different result. The boundary between "speakable" and "not speakable" is not at the engine level. It is at the voice level within the engine. The Sanskrit voice within Google's TTS engine cannot handle this verse. But the Marathi voice — which shares much of the same Devanagari character set — handles it without issue. This changes how you think about TTS integration. What happened in production 🏭 This is not a theoretical exercise. This is what we actually hit. In Bhagavad Gita, the player screen uses TTS to read verses aloud. The experience is designed to feel like playing a media file: continuous, flowing, uninterrupted. But certain words — especially compound words and special conjunct characters — were being silently skipped. Not errored. Not logged. Just... silent. The engine would skip the entire word if it couldn't speak something in it. So a verse that should take 15 seconds to read would finish in 8. The user would hear a flowing recitation with missing pieces and never know what was lost. 😶 The worst

Google's developer verification requirement starts enforcing in about a month, and Brazil is one of the four countries it lands in first. If you work here, this is not a 2027 problem you get to read about later. Most of the coverage I've seen frames this as a sideloading story, or an F-Droid story, or an "Android is losing its freedom" story. Those are real arguments, but they're not the thing that's going to interrupt my week. The thing that's going to interrupt my week is much smaller and much more annoying: how a build gets onto a QA engineer's physical phone. The rule, in one paragraph From September 30, 2026, apps installed on certified Android devices in Brazil, Indonesia, Singapore and Thailand must be registered to a verified developer. Certified devices are roughly 95% of Android outside China. The requirement applies whether the app came from Play, from an alternative store, or from an APK you downloaded off a link. Verification means an identity check plus registering each package name against the SHA-256 fingerprint of its signing key. Global rollout follows in 2027. Two things matter for how you read that. It's the package name that gets registered, not the app in some abstract sense. And it's tied to a specific signing key. What does not break Before the panic, the exemptions are wide, and if you only skim one section, skim this one. ADB installs are unaffected. Local development and testing over adb install keep working exactly as they do today. Google has been explicit about this. Enterprise deployment is exempt. Apps installed through an EMM Device Policy Controller, or published as private apps in Managed Google Play, are exempt indefinitely. If your organization ships to managed clinic devices through an MDM, that path is fine. If you're already on Play, you're probably already done. In March 2026, Google auto-registered package names and signing keys for the large majority of existing Play apps under the accounts that own them. Worth confirming i

A Technical PM's journey from frustration to shipping a solo Android app As a Technical Project Manager, I track time constantly. Client hours, project phases, billable work. It's part of the job. But every time tracker I tried left me frustrated. Toggl is powerful — too powerful. Every time I opened it, I had to navigate through workspaces, projects, tags, and integrations I'd never use. Clockify felt the same. Harvest was built for teams, not for someone who just wants to know where their day went. And don't get me started on the design. Most of these apps look like they were built in 2012 and never updated. So I did what any slightly obsessive PM would do: I built my own. The Problem I Was Actually Solving It wasn't that existing trackers lacked features. It was that they had too many. Every morning I'd open an app, get overwhelmed by options, and either spend 2 minutes setting up a timer correctly or just give up and track nothing. By the end of the week, I had no idea where my billable hours went — which meant I was probably undercharging clients. I wanted one thing: tap a button, start tracking. That's it. Building Tempo as a Non-Developer Here's the part that still surprises me: I built Tempo without writing a single line of code. As a Technical PM, I understand systems, workflows, and user experience — but I'm not a developer. I used AI tools to go from idea to a fully functional Android app in 2–3 months. The process wasn't always smooth. There were bugs, confusing UX decisions, and moments where I questioned whether I was building something anyone else would actually use. But I kept coming back to the same question: would I use this every day? And the answer was always yes. What Tempo Does (and Doesn't Do) Tempo is deliberately minimal: One tap to start tracking **— no setup, no forms, no friction **Billable vs non-billable toggle — know exactly what to invoice Daily & weekly reports — see where your time actually goes Custom projects with icons and colors

The atmosphere in the room was dense, the kind where every whisper echoes. I was sitting in the third row of a local community center during a Friday prayer session, my head bowed in reflection. Suddenly, a high-pitched, synthetic ringtone shattered the silence. My pocket vibrated violently, sending a jolt of anxiety through my chest. I scrambled to silence it, but the damage was done; a dozen heads turned in my direction. I wasn't just embarrassed; I was frustrated with myself for the thousandth time for forgetting the simple task of toggling a silent switch. This wasn't an isolated incident. I found myself constantly caught in a cycle of human error. I would arrive at the office, launch into a deep-work sprint, and realize two hours later that my phone had been chirping with notifications through three separate meetings. Then, I would leave the office and forget to turn the ringer back on, missing urgent calls from family throughout the evening. The friction wasn't in the hardware; it was in the expectation that a human should perfectly manage a state machine that they interact with hundreds of times a day. I realized that my phone was intelligent enough to track my location, calculate prayer times, and sync my schedule, yet it remained stubbornly passive regarding its own audio profile. Most existing automation tools were either too heavy, draining the battery within hours, or relied on cloud-based triggers that failed the moment I lost signal. I wanted something that lived on the device, respected the user's privacy, and handled the transition between 'Silent', 'Vibrate', and 'Normal' states without me ever needing to touch the screen. The goal was simple: build a background service that watches the world and adjusts the phone's volume automatically. I needed an architecture that could handle geofencing, calendar events, and time-based triggers without turning the device into a space heater. When I started building the geofencing engine for Muffle, the immediate

Transferring files and data across platforms is more straightforward than ever.

An AI agent phone is a real, or cloud-hosted, smartphone that an LLM-powered agent can operate on its own. It sees the screen, taps, swipes, types, opens apps, and completes multi-step tasks the same way a person would. Instead of calling an API, the agent uses the phone directly, the same Instagram, banking, or delivery app you'd use, driven by a model instead of a thumb. The phrase gets used two ways in 2026. Some products sell phone numbers for AI agents, voice and SMS. That's not this. Here, an AI agent phone means the device itself as something an agent controls, a full Android or iOS handset that becomes an autonomous actor. If you've heard the pitch give your AI agent a phone, this is it. Why a phone, not a browser? Most agent tooling lives in the browser, or in desktop computer use. That misses where people actually are. The world is mobile-first, and a huge share of real workflows are app-only, ride-hailing, food delivery, mobile banking, two-factor prompts, creator tools, regional super-apps. A browser agent can't install an APK, respond to a push notification, read an SMS one-time code, use the camera, or drive a native app that never ships a web build. A phone can. And there's a second reason: fidelity. When an agent operates the same app a customer uses, you're automating the real thing, not a mock, not some undocumented internal endpoint that breaks next release. How it works A mobile AI agent runs a perception-decision-action (PDA) loop against the device. The agent builds its understanding from two sources. First, the accessibility tree, the structured hierarchy of on-screen elements the OS exposes for screen readers, which gives precise, machine-readable targets. Second, vision, a screenshot passed to a multimodal model for anything the tree misses, canvas UIs, games, custom widgets. Together, the tree gives coordinates and vision gives context. The agent gets a goal in natural language, reasons about the current screen, picks the next action, and e

What is ZeroDroid? ZeroDroid is an open-source Android toolkit that exposes the radios, sensors and connected-device capabilities already present in a phone. GitHub: https://github.com/theabhishekchandra/ZeroDroid What problems does it address? The app contains 29 tools across five areas: Wireless: Wi-Fi, BLE, NFC, Bluetooth Classic and peer-to-peer connections RF and signals: IR, UWB, SDR-device detection and ultrasonic analysis Sensors: GPS/GNSS, QR analysis, device sensors and magnetic anomalies Network: USB inspection, cell-tower information and wardriving Security: tracker scanning, hidden-camera indicators, rogue-AP detection, network scanning and deauthentication indicators Architecture ZeroDroid uses Kotlin, Jetpack Compose, Material 3, MVVM, StateFlow, Hilt and Room. Services are lazy-loaded, and scanning begins only when the user starts a tool. Important limitations A smartphone cannot guarantee that it has found every camera, tracker, bug or network threat. Several detections are heuristic and may produce false positives or miss threats. Hardware availability also differs between Android devices. The project is intended only for education, defensive security and testing devices or networks you own or are authorized to assess. Feedback wanted I am looking for: Compatibility reports from different Android phones Feedback about permission handling False-positive reports Contributions, tests and documentation improvements Repository: https://github.com/theabhishekchandra/ZeroDroid