Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

github.com

Post reply on HN
Print view View original

21–30 of 376 posts

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#21

Post by aconley314 »

MCKapur wrote: post #12
surferbayarea wrote: post #11

Why is facebook spyware part of Spotify. I signed up to Spotify via email not facebook login.

i mean, they offer FB sign in in the app, so the FB SDK is bundled with the app binary. looks like the mere presence of the library is causing crashes. someone on a related GH thread noted they commented out the code invoking the FB SDK but the issue remained.

Then if this can be fixed by a server side change as suggested below, that's worrisome, since it suggests it is communicating with FB even if you don't invoke it.

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#23

Post by MCKapur »

aconley314 wrote: post #21
MCKapur wrote: post #12

Earlier quoted context omitted.

i mean, they offer FB sign in in the app, so the FB SDK is bundled with the app binary. looks like the mere presence of the library is causing crashes. someone on a related GH thread noted they commented out the code invoking the FB SDK but the issue remained.

Then if this can be fixed by a server side change as suggested below, that's worrisome, since it suggests it is communicating with FB even if you don't invoke it.

the real question though is if the library is not even imported into the main app and just left hanging around, linked, would it still crash? i'd be curious to know

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#26

Post by lucasar »

MCKapur wrote: post #17
surferbayarea wrote: post #13

Earlier quoted context omitted.

Yeah these SDKs are siphoning off data without authorization like your location, songs you listen to and who knows what else (eg other processes or apps running on your phone). Eg the latest iOS exploit allows any app to get access to all SMS data. Tech companies of today trample upon individual privacy openly. Amazing!

i'm by a longshot no facebook fan but... are you sure the SDK can actually siphon out what songs you listen or your location from the app it's sandboxed in (which, BTW, is in its own sandbox from an iOS system POV, and also has its own set of permissions)?

I am an iOS developer and most likely the problem is related to configuration and basic analytics, not "siphoning" app data.

Offending code :

if (restrictiveParams[eventName][@"is_deprecated_event"]) {

        [deprecatedEventSet addObject:eventName];
}

So, the iOS library does not check for nil, and whatever the server is returning does not have the expected content. Lame.

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#28

Post by surferbayarea »

MCKapur wrote: post #17
surferbayarea wrote: post #13

Earlier quoted context omitted.

Yeah these SDKs are siphoning off data without authorization like your location, songs you listen to and who knows what else (eg other processes or apps running on your phone). Eg the latest iOS exploit allows any app to get access to all SMS data. Tech companies of today trample upon individual privacy openly. Amazing!

i'm by a longshot no facebook fan but... are you sure the SDK can actually siphon out what songs you listen or your location from the app it's sandboxed in (which, BTW, is in its own sandbox from an iOS system POV, and also has its own set of permissions)?

Well the reason FB/Foursquare/Google etc add these to 3rd party apps is so they can get data. Example if you visit a website which has a Facebook like button, your browser fetches the js files/which maybe even makes an API call to let FB know your IP (and hence location). All this data is fed to the giant system that feeds you ads. Adding their SDK to other apps/sites (even if there is no user facing need) is a common strategy used by most big companies to get data. In return the app that puts in the SDK gets $ from the company.

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#30

Post by bvandewalle »

MCKapur wrote: post #17
surferbayarea wrote: post #13

Earlier quoted context omitted.

Yeah these SDKs are siphoning off data without authorization like your location, songs you listen to and who knows what else (eg other processes or apps running on your phone). Eg the latest iOS exploit allows any app to get access to all SMS data. Tech companies of today trample upon individual privacy openly. Amazing!

i'm by a longshot no facebook fan but... are you sure the SDK can actually siphon out what songs you listen or your location from the app it's sandboxed in (which, BTW, is in its own sandbox from an iOS system POV, and also has its own set of permissions)?

you are assuming that the Spotify app is not simply handing that data over. I would not be surprised if there is a financial agreement in place.
Post reply on HN