Tsuyoshi Chujo
Flutter App & Package Developer
Freelance
He is a freelance mobile app developer in Japan. He is also a developer of crop_your_image, the most popular Flutter package that provides a widget that enables Flutter developers to embed the cropping images feature in their apps, and also a developer of animated_to, a handy widget that enables you to animate whatever widgets when their position is updated.
He is very passionate about sharing insights and knowledge about the internal mechanisms of Flutter and packages by publishing articles or providing talks at conferences.
Security Risks of Packages in Mobile App Development
Session
Packages help us build Flutter apps with less code and in less time. However, relying on packages also introduces security risks that we need to address.
Do you check the entire source code of every package listed in your pubspec.lock? Are you sure that every updated version is safe?
In this talk, I’ll discuss what kinds of incidents can happen through package dependencies and how we can mitigate those risks. I’ll introduce OWASP Mobile Application Security as general background knowledge, as well as real-world incidents from other ecosystems such as npm and pip.
We shouldn’t underestimate security risks, but we don’t need to overreact to them either.
By clarifying possible attack scenarios and explaining how pub works, I’ll show how we can make practical decisions about security risks and address them in real-world Flutter app development.