// the take
A small Android library from 2011 (by Moxie Marlinspike of Signal fame) that adds certificate pinning to HttpsURLConnection and Apache HttpClient, so an app only trusts certs matching a hardcoded pin instead of any CA in the system trust store. It's for Android developers who want pinning without pulling in a bigger networking stack.
The core idea is sound and clearly explained — pinning against CA-chain compromise (the README cites the real Comodo/DigiNotar/TurkTrust breaches) rather than vague 'security' hand-waving. The API surface is tiny: PinningHelper gives drop-in pinned replacements for HttpsURLConnection and HttpClient, so adoption is a few lines. Pin generation is a one-line script (pin.py) rather than a manual OpenSSL incantation.
Dead since 2015 — no commits in over a decade, no response to the Apache HttpClient deprecation/removal in Android 6.0, so half the README's examples (DefaultHttpClient, ThreadSafeClientConnManager) won't even compile against a current Android SDK. OkHttp's built-in CertificatePinner and Android's own Network Security Config (API 24+) now do this natively and are actively maintained, making this library strictly redundant for any project targeting modern API levels. No backup-pin rotation story beyond manually listing multiple hashes in an array — ship a pin without a backup and a cert renewal bricks your app's networking. GPLv3 licensing is a real blocker for closed-source commercial apps that would otherwise want to use it.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →