Quantifying the adoption of Kotlin on Android stores: Insight from the bytecode

BackgroundMany smartphone apps designed to assist individuals in managing their weight are accessible, but the assessment of app quality and features has predominantly taken place in Western countries. Nevertheless, there is a scarcity of research evaluating weight management apps in China, which highlights the need for further investigation in this area.ObjectiveThis study aims to conduct a comprehensive search for the most popular commercial Chinese smartphone apps focused on weight management and assess their quality, behavior change techniques (BCTs), and content-related features using appropriate evaluation scales. Additionally, the study sought to investigate the associations between the quality of various domains within weight management apps and the number of incorporated BCTs and app features.MethodsIn April 2023, data on weight management apps from the iOS and Android app stores were downloaded from the Qimai Data platform. Subsequently, a total of 35 weight management apps were subjected to screening and analysis by 2 researchers. The features and quality of the apps were independently assessed by 6 professionals specializing in nutrition management and health behavioral change using the Mobile Application Rating Scale (MARS). Two registered dietitians, who had experience in app development and coding BCTs, applied the established 26-item BCT taxonomy to verify the presence of BCTs. Mean (SD) scores and their distributions were calculated for each section and item. Spearman correlations were used to assess the relationship between an app’s quality and its technical features, as well as the number of incorporated BCTs.ResultsThe data set included a total of 35 apps, with 8 available in the Android Store, 10 in the Apple Store, and 17 in both. The overall quality, with a mean MARS score of 3.44 (SD 0.44), showed that functionality was the highest scoring domain (mean 4.18, SD 0.37), followed by aesthetics (mean 3.43, SD 0.42), engagement (mean 3.26, SD 0.64), and information (mean 2.91, SD 0.52), which had the lowest score. The mean number of BCTs in the analyzed apps was 9.17 (range 2-18 BCTs/app). The most common BCTs were “prompt review of behavioral goals” and “provide instruction,” present in 31 apps (89%). This was followed by “prompt self-monitoring of behavior” in 30 apps (86%), “prompt specific goal setting” in 29 apps (83%), and “provide feedback on performance” in 27 apps (77%). The most prevalent features in the analyzed apps were the need for web access (35/35, 100%), monitoring/tracking (30/35, 86%), goal setting (29/35, 83%), and sending alerts (28/35, 80%). The study also revealed strong positive correlations among the number of BCTs incorporated, app quality, and app features. This suggests that apps with a higher number of BCTs tend to have better overall quality and more features.ConclusionsThe study found that the overall quality of weight management apps in China is moderate, with a particular weakness in the quality of information provided. The most prevalent BCTs in these apps were reviewing behavioral goals, providing guidance, self-monitoring of behavior, goal setting, and offering performance feedback. The most common features were the need for web access, monitoring and tracking, goal setting, and sending alerts. Notably, higher-quality weight management apps in China tended to incorporate more BCTs and features. These findings can be valuable for developers looking to improve weight management apps and enhance their potential to drive behavioral change in weight management.

BackgroundType 2 diabetes (T2DM) is highly prevalent in China, affecting over 114 million people. While mHealth interventions have shown promise, there is limited research on T2DM management apps in real-world app stores. ObjectiveThis study aimed to systematically search and analyze T2DM care mobile apps in the Chinese market, describing their features, and functions, and evaluating the quality of the most popular apps using validated tools. MethodsWe conducted a comprehensive search in Chinese Android and iOS app stores for T2DM management apps. We downloaded 138 eligible ones for a general review of their key features and function. We also assessed the quality of the top 20 apps from both platforms using the Mobile App Rating Scale (MARS) by both researcher and patient. ResultsA total of 3524 apps were searched. 138 eligible apps were downloaded for general review and 29 popular apps were included for quality assessment. Most apps were designed for patient users (87.0 %) and developed by commercial companies (85.5 %). Common functions included blood glucose monitoring, diabetes education, integration with measuring devices, medication adherence reminders, teleconsultation services, and diabetes risk factor tracking. The researcher's evaluation yielded an average MARS score of 4.0 out of 5 for popular apps, with subscale scores of functionalities (4.5), aesthetics (4.1), engagement (3.7), and information (3.6). However, patient ratings were lower in functionality (3.5), aesthetics (3.4), and engagement (2.6), and the patient faced difficulties with information-related items. Similar trends were observed in subject quality items. ConclusionApp developers should engage caregivers, and family members as target users, and involve government agencies as partners to improve T2DM management apps. Future apps should incorporate scientifically proven advanced functions to enhance their effectiveness. The quality assessment highlighted weaknesses in engagement and information and the importance of user-centric approaches in app development.

Migrating to Android for iOS Developers gives youas an experienced native iOS app developerthe skills to learn native Android apps development from scratch. Starting with preparing your Android integrated development environment and introducing just enough Android application framework fundamentals, youll understand how to create a simple but meaningful HelloAndroid project immediately. This book provides the guidelines and tutorial projects to show you how to translate your existing iOS app to the Android platform. Youll use your mobile app knowledge to structure your Android apps in a similar way to how you would structure your iOS apps. To implement use cases with detailed screens, the most common mobile topics are discussed, including user interfaces, managing data, and networking with remote services. As you move through the book, youll create Android apps with rich UI components to handle common CRUD operations locally and remotely. There are many Android goodies described in the book. Instead of relying on routine text descriptions, youll discover the uniqueness of Android and appreciate the many features that are unique to the platform. This book also explores more powerful mobile UX patterns that are commonly used on the iOS and Android platforms. When you finish reading Migrating to Android for iOS Developers, youll be an Android developer as well as an iOS developer. And, you will be fully convinced you can do everything in Android that you can do in iOS. What youll learn How to maximize your existing iOS mobile knowledge to learn Android programming skills How to use the Android integrated development environment with the Eclipse ADT plugin How to translate your existing iOS code to Android with the following common mobile topics: Common mobile screen navigation patterns User interface components and UI animations Storing data Networking and using remote services Using system apps Maps and location awareness Mobile search frameworks Mobile analyticsWho this book is for This book is for iOS app developerslike youwho want to port their native iOS app to become an Android app. Also, if you are not an iOS developer, but already familiar with mobile apps, then this book can also help you understand Android development with step-by-step instructions and tutorial projects.

Android apps include third-party native libraries to increase performance and to reuse functionality. Native code is directly executed from apps through the Java Native Interface or the Android Native Development Kit. Android developers add precompiled native libraries to their projects, enabling their use. Unfortunately, developers often struggle or simply neglect to update these libraries in a timely manner. This results in the continuous use of outdated native libraries with unpatched security vulnerabilities years after patches became available. To further understand such phenomena, we study the security updates in native libraries in the most popular 200 free apps on Google Play from Sept. 2013 to May 2020. A core difficulty we face in this study is the identification of libraries and their versions. Developers often rename or modify libraries, making their identification challenging. We create an approach called LibRARIAN (LibRAry veRsion IdentificAtioN) that accurately identifies native libraries and their versions as found in Android apps based on our novel similarity metric bin2sim. LibRARIAN leverages different features extracted from libraries based on their metadata and identifying strings in read-only sections. We discovered 53/200 popular apps (26.5%) with vulnerable versions with known CVEs between Sept. 2013 and May 2020, with 14 of those apps remaining vulnerable. We find that app developers took, on average, 528.71 ±40.20 days to apply security patches, while library developers release a security patch after 54.59 ± 8.12 days---a 10 times slower rate of update.

China is one of the largest Android markets in the world. As Chinese users cannot access Google Play to buy and install Android apps, a number of independent app stores have emerged and compete in the Chinese app market. Some of the Chinese app stores are pre-installed vendor-specific app markets (e.g., Huawei, Xiaomi and OPPO), whereas others are maintained by large tech companies (e.g., Baidu, Qihoo 360 and Tencent). The nature of these app stores and the content available through them vary greatly, including their trustworthiness and security guarantees. As of today, the research community has not studied the Chinese Android ecosystem in depth. To fill this gap, we present the first large-scale comparative study that covers more than 6 million Android apps downloaded from 16 Chinese app markets and Google Play. We focus our study on catalog similarity across app stores, their features, publishing dynamics, and the prevalence of various forms of misbehavior (including the presence of fake, cloned and malicious apps). Our findings also suggest heterogeneous developer behavior across app stores, in terms of code maintenance, use of third-party services, and so forth. Overall, Chinese app markets perform substantially worse when taking active measures to protect mobile users and legit developers from deceptive and abusive actors, showing a significantly higher prevalence of malware, fake, and cloned apps than Google Play.

Context. Android is the largest mobile platform today, with thousands of apps published and updated in the Google Play store everyday. Maintenance is an important factor in Android apps lifecycle, as it allows developers to constantly improve their apps and better tailor them to their user base. Goal. In this paper we investigate the evolution of various maintainability issues along the lifetime of Android apps. Method. We designed and conducted an empirical study on 434 GitHub repositories containing open, real (i.e., published in the Google Play store), and actively maintained Android apps. We statically analyzed 9,945 weekly snapshots of all apps for identifying their maintainability issues over time. We also identified maintainability hotspots along the lifetime of Android apps according to how their density of maintainability issues evolves over time. More than 2,000 GitHub commits belonging to identified hotspots have been manually categorized to understand the context in which maintainability hotspots occur. Results. Our results shed light on (i) how often various types of maintainability issues occur over the lifetime of Android apps, (ii) the evolution trends of the density of maintainability issues in Android apps, and (iii) an in-depth characterization of development activities related to maintainability hotspots. Together, these results can help Android developers in (i) better planning code refactoring sessions, (ii) better planning their code review sessions (e.g., steering the assignment of code reviews), and (iii) taking special care of their code quality when performing tasks belonging to activities highly correlated with maintainability issues. We also support researchers by objectively characterizing the state of the practice about maintainability of Android apps. Conclusions. Independently from the type of development activity, maintainability issues grow until they stabilize, but are never fully resolved.

This paper presents the GreenSource infrastructure: a large body of open source code, executable Android applications, and curated dataset containing energy code metrics. The dataset contains energy metrics obtained by both static analysing the applications' source code and by executing them with available test inputs. To automate the execution of the applications we developed the AnaDroid tool which instruments its code, compiles and executes it with test inputs in any Android device, while collecting energy metrics. GreenSource includes all Android applications included in the MUSE Java source code repository, while AnaDroid implements all Android's energy greedy features described in the literature, GreenSource aims at characterizing energy consumption in the Android ecosystem, providing both Android developers and researchers a setting to reason about energy efficient Android software development. © 2019 IEEE.

Android introduces a new permission model that allows apps to request permissions at runtime rather than at the installation time since 6.0 (Marshmallow, API level 23). While this runtime permission model provides users with greater flexibility in controlling an app's access to sensitive data and system features, it brings new challenges to app development. First, as users may grant or revoke permissions at any time while they are using an app, developers need to ensure that the app properly checks and requests required permissions before invoking any permission-protected APIs. Second, Android's permission mechanism keeps evolving and getting customized by device manufacturers. Developers are expected to comprehensively test their apps on different Android versions and device models to make sure permissions are properly requested in all situations. Unfortunately, these requirements are often impractical for developers. In practice, many Android apps suffer from various runtime permission issues (ARP issues). While existing studies have explored ARP issues, the understanding of such issues is still preliminary. To better characterize ARP issues, we performed an empirical study using 135 Stack Overflow posts that discuss ARP issues and 199 real ARP issues archived in popular open-source Android projects on GitHub. Via analyzing the data, we observed 11 types of ARP issues that commonly occur in Android apps. For each type of issues, we systematically studied: (1) how they can be manifested, (2) how pervasive and serious they are in real-world apps, and (3) how they can be fixed. We also analyzed the evolution trend of different types of issues from 2015 to 2020 to understand their impact on the Android ecosystem. Furthermore, we conducted a field survey and in-depth interviews among the practitioners from open-source community and industry, to gain insights from practitioners’ practices and learn their requirements of tools that can help combat ARP issues. Finally, to understand the strengths and weaknesses of the existing tools that can detect ARP issues, we built <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">ARPBench</small> , an open benchmark consisting of 94 real ARP issues, and evaluated the performance of three available tools. The experimental results indicate that the existing tools have very limited supports for detecting our observed issue types and report a large number of false alarms. We further analyzed the tools’ limitations and summarized the challenges of designing an effective ARP issue detection technique. We hope that our findings can shed light on future research and provide useful guidance to practitioners.

The rapid growth in development and using mobile health applications had significant potential in the field of health. The study objective was to describe apps in the most popular Iranian Android and iOS app stores. Detail information of apps was extracted, categorised by subject and descriptive analyses were done. 3,331 Android and 277 iOS apps were remained for study. 88% of popular Android mHealth apps were free on the other hand, 70% of popular iOS apps were paid. The average price of Android and iOS paid apps were $0.37 and $6.55. The average of rating value for all Android subcategories (total average 4.33) is higher than iOS subcategories (total average 3.58). Our study confirmed fitness was the most popular topic. The average of rating value for all Android subcategories was higher than iOS subcategories. It seems large number of mHealth app users preferred using applications which can update their content continuously.

Systematic exploration of Android apps is an enabler for a variety of app analysis and testing tasks. Performing the exploration while apps run on actual phones is essential for exploring the full range of app capabilities. However, exploring real-world apps on real phones is challenging due to non-determinism, non-standard control flow, scalability and overhead constraints. Relying on end-users to conduct the exploration might not be very effective: we performed a 7-use study on popular Android apps, and found that the combined 7-use coverage was 30.08% of the app screens and 6.46% of the app methods. Prior approaches for automated exploration of Android apps have run apps in an emulator or focused on small apps whose source code was available. To address these problems, we present A3E, an approach and tool that allows substantial Android apps to be explored systematically while running on actual phones, yet without requiring access to the app's source code. The key insight of our approach is to use a static, taint-style, dataflow analysis on the app bytecode in a novel way, to construct a high-level control flow graph that captures legal transitions among activities (app screens). We then use this graph to develop an exploration strategy named Targeted Exploration that permits fast, direct exploration of activities, including activities that would be difficult to reach during normal use. We also developed a strategy named Depth-first Exploration that mimics user actions for exploring activities and their constituents in a slower, but more systematic way. To measure the effectiveness of our techniques, we use two metrics: activity coverage (number of screens explored) and method coverage. Experiments with using our approach on 25 popular Android apps including BBC News, Gas Buddy, Amazon Mobile, YouTube, Shazam Encore, and CNN, show that our exploration techniques achieve 59.39--64.11% activity coverage and 29.53--36.46% method coverage.

Fragmentation is a serious problem in the Android ecosystem. This problem is mainly caused by the fast evolution of the system itself and the various customizations independently maintained by different smartphone manufacturers. Many efforts have attempted to mitigate its impact via approaches to automatically pinpoint compatibility issues in Android apps. Unfortunately, at this stage, it is still unknown if this objective has been fulfilled, and the existing approaches can indeed be replicated and reliably leveraged to pinpoint compatibility issues in the wild. We, therefore, propose to fill this gap by first conducting a literature review within this topic to identify all the available approaches. Among the nine identified approaches, we then try our best to reproduce them based on their original datasets. After that, we go one step further to empirically compare those approaches against common datasets with real-world apps containing compatibility issues. Experimental results show that existing tools can indeed be reproduced, but their capabilities are quite distinct, as confirmed by the fact that there is only a small overlap of the results reported by the selected tools. This evidence suggests that more efforts should be spent by our community to achieve sound compatibility issues detection.

SSL/TLS (Secure Socket Layer/Transport Layer Security) has been used as a de facto security protocol to protect users' sensitive information in Android apps, which often need to communicate with servers online to provide users with some of their functionalities and services. Since most Android users tend to be either unaware of or unable to understand the security protocol well, it is critically important to investigate if SSL/TLS is used properly and implemented correctly to protect users' sensitive information such as credentials. In this paper, we seek to shine some light into this important issue by studying the usage of the security protocol in 200 most popular Android apps downloaded from Google Play. We found out that only 4% of these apps are vulnerable to two well-known attacks against the protocol, and this shows huge improvement of SSL/TLS usage in Android apps when compared to the results from a study conducted in 2012, where 100% of Android apps under the study were vulnerable.

Android developers are known to frequently update their apps for fixing bugs and addressing vulnerabilities, but more commonly for introducing new features. This process leads a trail in the ecosystem with multiple successive app versions which record historical evolutions of a variety of apps. While the literature includes various works related to such evolutions, little attention has been paid to the research question on how quality evolves, in particular with regards to maintainability and code complexity. In this work, we fill this gap by presenting a large-scale empirical study: we leverage the AndroZoo dataset to obtain a significant number of app lineages (i.e., successive releases of the same Android apps), and rely on six well-established, maintainability-related complexity metrics commonly accepted in the literature on app quality, maintainability etc. Our empirical investigation eventually reveals that, overall, while Android apps become bigger in terms of code size as time goes by, the apps themselves appear to be increasingly maintainable and thus decreasingly complex.

Third-party libraries, especially outdated versions, can introduce and multiply security & privacy related issues to Android applications. While prior work has shown the need for tool support for developers to avoid libraries with security problems, no such a solution has yet been brought forward to Android. It is unclear how such a solution would work and which challenges need to be solved in realizing it. In this work, we want to make a step forward in this direction. We propose Up2Dep, an Android Studio extension that supports Android developers in keeping project dependencies up-to-date and in avoiding insecure libraries. To evaluate the technical feasibility of Up2Dep, we publicly released Up2Dep and tested it with Android developers (N=56) in their daily tasks. Up2Dep has delivered quick-fixes that mitigate 108 outdated dependencies and 8 outdated dependencies with security problems in 34 real projects. It was perceived by those developers as being helpful. Our results also highlight technical challenges in realizing such support, for which we provide solutions and new insights. Our results emphasize the urgent need for designated tool support to detect and update insecure outdated third-party libraries in Android apps. We believe that Up2Dep has provided a valuable step forward to improving the security of the Android ecosystem and encouraging results for tool support with a tangible impact as app developers have an easy means to fix their outdated and insecure dependencies.

Currently, many people use the smart phone throughout the world, and the government and enterprise also use it to improve business efficiency. However, there is a risk that the confidential information of the government or enterprise can be disclosed, if the malicious or forged/altered App is installed and executed in the smart phone used for work. Apps distributed by the domestic App Store are verified in advance, using the independent verification system of each App Store. However, those App Stores don’t use the common verification system, and their verification system is lacking security features. Besides, the Android Apps can be installed and used, using the alternative method (Android black market and APK file), instead of the official App Store. As a result, the use of the non-verified App is rarely controlled. To prevent the alternative method, mobile device management (MDM) and other methods are employed but are not quite effective. To supplement these shortcomings, this paper proposes a method of providing a reliable smart phone environment to users, by verifying the safety of the App using the common verification method for Android phones, and managing the verified App with a whitelist technology, and testing the installed App periodically.KeywordsProxy signature schemeID-based partially blind signatureProxy partially blind signatureGap Diffie-Hellman problemBilinear-pairing