In the hands of the other developers

Why do we need to trust so bad the other developers to have a working connection through the proxy on own Android phone (starting from 3.0 we'll have to make a different discourse)?

It's a long story... Let's start from the beginning...

Take one simple application like HTTP Proxy Settings: it basically lets the user to setup the system proxy setting opening a handy dialog that let the user to insert Hostname and Port (so no authentication) of the proxy server that he wants to use.

This dialog is an hidden activity called ProxySelector (shipped into the stock version since the 1.5 version).
HTTP Proxy Settings does in specific what Any Cut let to do more in general with all the available activities in the system, but the result is the same, setting the system setting of http proxy. What does this activity do?
Maybe it's better if you see with your own eyes (you can find the complete code here):

183  boolean saveToDb() {
185      String hostname = mHostnameField.getText().toString().trim();
186      String portStr = mPortField.getText().toString().trim();

[...]

213      ContentResolver res = getContentResolver();

[...]

225      Settings.Secure.putString(res, Settings.Secure.HTTP_PROXY, hostname);
226      sendBroadcast(new Intent(Proxy.PROXY_CHANGE_ACTION));
228      return true;
229  }

It's easy to understand how this activity works. The most important thing is the call to the method putString that put the proxy configuration into the Settings.Secure database.

But why these applications needs to open a system activity? Can't they simply set the proxy setting with their own interface?

The answer is a little twisted: if an application wants to write to this database it needs to request for the following permission in its manifest:

"android.permission.WRITE_SECURE_SETTINGS"

Nice, isn't it? Ok, the applications can ask for this permission but only applications that are part of the firmware will get that (this is hard coded in the system architecture, because secure settings are designed to be secured against modification by third party apps). This means that only system application signed with the OS can have the write access to the database. So everyone that wants to set this setting needs to pass through the ProxySelector activity. 

So are we done? End of the problems?

Unfortunately not. You can set the global setting for the entire system, but you can't force the applications to use this setting. Also the default apps like the Browser, Market, Maps and so on don't read (or they read it and don't use it, or in some cases they read it and they use it in the wrong way!!) this information. But as we cannot force the behaviour of hack the applications we use everyday in our Android phone, we can simply ask the developer that wrote them to update them in order to check and use this setting.



So, please, to all the developers, listen to this call. It's a work of 5 minutes, and YOU CAN really make a big difference in how your application is used in the enterprise world (or wherever it's used a proxy).

And specularly to all the users, ASK to your favourite apps developers to implement this feature if you need it! You just have to put a comment and maybe a link to this post. Sometimes the developers ignore this issue and the needs of a professional user.

It's a little step for an application, but a big step for humanity.. 
(Do you think it's a little too much maybe? ;-) )