Adobe AIR Development

[labwaste]

I'm not sure if this is legitimate or not, but if it is.. Basically it looks like someone found a way to pull apps off of the playbook, extract the .swf and load them via a website.

http://forums.crackberry.com/f222/apps-pb-without-appworld-not-so-much-but-getting-them-off-pb-61005...

edit - If the swf can be extracted, thats one steps closer to decompiling..

[peter9477]

I posted a reply there asking this:

Is there any evidence these were "taken off" a PlayBook?

Or were the downloads intercepted? Apparently the App World data downloads (as opposed to the metadata and other interactions with the server) are done over HTTP. This is an issue some of us have just been analyzing in the dev forums.

Would be nice to see confirmation that this was the approach used. Anyone know? I'd be surprised if this really came off the PlayBook after it was installed there.

[navikun]

If it is that is a kinda scary to think that someone could get a file that easy.

[TheMarco]

It is. He posted links to the actual swfs.

This is shocking, to say the least. These things should really be encrypted!!!

[Marc_Paradise]

Confirmed. It appears that performing a full backup using DM creates a ".bbb" file. The bbb file is a zip archive, and it contains not only app data, but also application binaries.

Reference:

[sergeh]

wow that's really not good news, I think we should tell RIM to urgently do something about that

[peter9477]

@sergeh, unfortunately it's unimaginable that RIM doesn't know about every aspect of such loopholes.

This means they've chosen to launch the product in this way, without informing the developers in advance of any aspect of it. They've also chosen not to support dynamic licensing properly for the PlayBook (apparently), to remove the Payment SDK for now with no warning, and not to release the Advertising SDK yet or in the near future.

Personally, I'm pretty much floored by all this, and have no idea what to do next, but it's pretty clear that the options for effectively and safely monetizing our apps are very limited at the moment. I would have been much happier to have known all these things four months ago...

[MauriceRice]

At very least the backups should be encripted!

The brings up another interesting problem. I wonder how many enterprising individualks got a free PlayBookl by simply re-packaging freely available swf's. I don't want to accuse anyone but there are various versions of the Doodle Blaster game in the wild. There is one here that looks identical to the app in AppWorld but with an introduction countdown sequence. 

 http://www.onlineflashgames.org/games/puzzle/doodle-blast.htm#

I worked damned hard on my app and I don't want some joker to repackage it as their own work.

[TheMarco]

My apps are WebWorks which means completely unprotected JS and CSS code. Nothing stands inbetween me and people stealing my stuff now. Great!

[Marc_Paradise]

You can run a minifier/obfuscator tool, though of course that's only of limited practical use... I'd been doing the same anyway, just in case it helped with performance.