Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Updates and Obfuscation #28

Closed
wants to merge 7 commits into from
Closed

Conversation

ThexXTURBOXx
Copy link

@ThexXTURBOXx ThexXTURBOXx commented Jun 14, 2022

This PR is based off on @techouse's updates which

  • updates Flutter to 3.x
  • updates dependencies

Additionally to these changes, I added an option to further obfuscate values from the env file.
Documentation is missing, but it should be kind of self-explanatory.
When inspecting the final .so-library (tested on Android), I noticed that Strings can be found very easily using, e.g., the strings command.
My approach uses separate randomly generated keys that are used in an XOR operation with the corresponding values in order to obfuscate them and circumvent finding the values using strings.

NO! I am not saying, this can be used to make every value undetectable in your final distributable binary... But if you want a adversary to have a bad time reading out your values, here you go :o)

Edit:
You can use this fork using

dependencies:
  envify:
      git:
        url: https://github.com/ThexXTURBOXx/envify.git
        ref: dev
        path: envify

dev_dependencies:
  envify_generator:
      git:
        url: https://github.com/ThexXTURBOXx/envify.git
        ref: dev
        path: envify_generator

Closes #27
Closes #24
Closes #22

@dbgarcia
Copy link

dbgarcia commented Jun 27, 2022

Hello guys, any update on this topic?

@ThexXTURBOXx
Copy link
Author

@dbgarcia I am almost positive this will never get merged since envify seems to be abandonware. If you want to use the obfuscation option, follow my instructions in this PR.
If you don't need the obfuscation option, but rather just want to use envify in Flutter 3, you can also use @techouse's fork (instructions can be found in #27).
I will try to keep my fork updated as long as possible. If something breaks, kindly let me know and I will fix it asap :)

@techouse
Copy link

techouse commented Aug 5, 2022

@dbgarcia @ThexXTURBOXx You could use https://github.com/petercinibulk/envied as it's essentially the same. I've recently contributed some code to it as well.

P.S. @ThexXTURBOXx you could try and contrbute your obfuscation patch to that repo 😊

@ThexXTURBOXx
Copy link
Author

Thank you very much @techouse! I have also added the obfuscation option there :)

@frencojobs
Copy link
Owner

Hey guys, Frenco here. Sorry for the trouble. I couldn't really work on my projects due to certain things regarding my country and life but now I'm back working on them.

I came here to update stuff but I just found https://github.com/petercinibulk/envied and it looks amazing. I'm so happy envify could inspire it and it seems to have more people actively taking care of it. So I thought instead of updating envify and stealing these features back from envied, I'll just deprecate envify. I haven't fully decided it but I just wanted to maybe discuss with you guys.

I also saw people using their own versions of envify forks, and I'm not sure if envied was meant as a temporary fork. It seems not but I don't know so please let me know. If that's the case or maybe if you guys wanted the name "envify" I'll be happy to transfer it to you guys so that you guys can use it.

Otherwise, I'll just post a final update to envify so that it's not broken at least and I'll update README and documentation to recommend envied instead of envify. Going forward when download counts hit near zero, I'll just discontinue/unlist it entirely from pub.dev.

Pinging people of interest, sorry.

@ThexXTURBOXx @techouse and also @petercinibulk

@ThexXTURBOXx
Copy link
Author

@frencojobs I have indeed been concerned about the current developments in Myanmar and hope that you will all be able to resolve the current problems there. So, good luck and best wishes from Germany!

Moreover, your decision to (maybe) deprecate envify in favor of envied shows great maturity, compassion and passion for open-source development. I have seen many other developers throw a tantrum because people have resurrected their "dead" (or rather inactive) projects. Thank you very much for your positive words!

As far as I can tell, envied started out as a temporary fork, but rapidly grew in terms of new features and bugfixes such that it might have become a good overall replacement for envify. About the name "envify": I liked it! Ultimately, though, it's up to @petercinibulk to decide whether to continue using "envied" or switch to "envify".

Thank you very much for letting us know about your current situation and best of luck!

@techouse
Copy link

techouse commented Feb 6, 2023

@frencojobs thanks for all the hard work! This package was a life saver 🙏

Good luck and all the best from London.

@petercinibulk
Copy link

@frencojobs I want to second everything @ThexXTURBOXx has said. We wish you all the best!

Ultimately, I'd like to do what is easiest and best for users. The reason I started it envied was that I saw there were others who wanted some of the same features I did. The envied package has some great new features and it would probably be easiest to just keep it as a replacement as @ThexXTURBOXx mentioned. I think it would also create the least amount of confusion to just keep the envied name to prevent users from having to make that breaking change. I'd love to get you involved in the package if you have any desire. I also think it is very mature to consider deprecating envify. If you do go that route, please don't delete your repository because I still want to link back to the work that inspired envied.

In the end, I'll support whatever decision you make about envify because it helped us all out so much!

@frencojobs
Copy link
Owner

Understood. I'll go ahead and release a final update for envify then. It'll only feature sdk and dependency updates, and as said, a big deprecation notice and a link to envied in README. I'll close all PRs and issues as to notify people about the deprecation.

please don't delete your repository

No need to worry, I won't be deleting the repository. I'll just discontinue the package once its popularity score starts to decrease. But I'll archive the repo after a while to prevent new issues though.

Thanks everyone for the kind words! I really appreciate it. Wishing you all the best!

@frencojobs frencojobs closed this Feb 6, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
6 participants