Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

github.com

Post reply on HN
Print view View original

131–140 of 376 posts

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#131

Post by Nextgrid »

yllus wrote: post #128
Nextgrid wrote: post #120

Earlier quoted context omitted.

This is also not GDPR compliant, not that anyone actually bothers to enforce the law. If we respect the GDPR then data sharing for Facebook Login should only happen once the user presses the Facebook login button (as at that point the data sharing becomes essential to provide the functionality). As far as ad/marketing attribution it should be opt-in as that is not an essential requirement to provide the service (and…

Re: Ad/marketing attribution, that's not necessary correct. If the data point that gets sent back to Facebook is a GUID type string that matches the GUID that got generated when you first clicked the Facebook ad for the app and doesn't include data about you specifically, I believe that's fine. I don't myself have up-to-date information what data Facebook receives via its SDK but I suspect it is GPDR compliant throug…

> matches the GUID that got generated when you first clicked the Facebook ad

Knowing Facebook, that GUID would surely be bound to the user, still leaking to Facebook that the user is now using the app.

An ad campaign ID (same for all ads of this format in this campaign) sent to the app developer (which can then aggregate them on their side and send the daily aggregated data to Facebook) would be better.

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#132

Post by bitcrazy »

Waterluvian wrote: post #130
yllus wrote: post #36

For those wondering why the Facebook SDK is so widely used in popular mobile apps: Facebook Login is actually in the minority of reasons to add the Facebook SDK to your mobile app. The vast majority of apps will add the Facebook SDK because it contains Facebook App Ads; a library that "completes the circle" in terms of finding out how effectively the ads you ran on Facebook were at getting people to download, install…

Don't mind me. I'm just going to come into your house and record what commercials you are watching. I'm not spyware I'm just _merely_ wanting to know about my marketing budget. Analogy may not be perfect but it takes serious mental gymnastics to fail to see this as spyware, in my opinion.

It wouldn't be surprising if some Smart TVs are already doing this.

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#133

Post by tossmeout »

cjhopman wrote: post #68
Nicksil wrote: post #52

Earlier quoted context omitted.

>Is that "spyware"? Yes, absolutely. It uses energy and bandwidth I paid for to surreptitiously transmit my information for use which will solely benefit Facebook and the software developer.

That definition is rather too broad. It makes basically everything spyware which dilutes the word too much to be useful.

This is what happens to every charged label.

1. People realize the label is powerful.

2. They begin applying the label to as many things they don't like as they can get away with.

3. This changes the definition of the label, causing it to become some blanket umbrella term.

4. The label loses its power, because it now describes many lukewarm behaviors instead of just the worst offenses.

For example, it's popular nowadays to say "everyone is racist." Well, if everyone is racist, is being labeled a racist really that bad? Not compared to what it used to imply about you.

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#136

Post by opportune »

Nicksil wrote: post #52
yllus wrote: post #36

For those wondering why the Facebook SDK is so widely used in popular mobile apps: Facebook Login is actually in the minority of reasons to add the Facebook SDK to your mobile app. The vast majority of apps will add the Facebook SDK because it contains Facebook App Ads; a library that "completes the circle" in terms of finding out how effectively the ads you ran on Facebook were at getting people to download, install…

>Is that "spyware"? Yes, absolutely. It uses energy and bandwidth I paid for to surreptitiously transmit my information for use which will solely benefit Facebook and the software developer.

Devil's advocate: you could always not run those apps. Although for non-technical users it would be challenging to determine if the apps were transmitting that info, it's possible for technical users to detect it (assuming the info goes to an obviously-facebook url and isn't piped through e.g. spotify)

Additionally I don't think there is anything wrong with client-side analytics in general since it's basically the only way to monitor performance/usage in production. And this type of thing is hard to discern from the more benign case

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#137

Post by ethbro »

mynameisvlad wrote: post #127
ethanbond wrote: post #116

Earlier quoted context omitted.

Ah. I'm thankful for the opportunity, err... requirement to trade my privacy for others to have one fewer password to deal with. And of course for Facebook to have more personal data to munch on.

I'm not really sure what the problem is here. You are perfectly free to not use Spotify, or any other app that chooses to utilize Facebook login or other components of the Facebook SDK. Spotify made their choice to use the SDK for whatever gains they get out of it, and as a customer you can choose to not use their service or app if you disagree with that. There's even comments in this HN thread that point you on how…

As with all things Facebook, the truth is that they're opaque as mud about what they do with data.

I'd give more credence to "the market is making an informed choice" hypothesis if consumers were, in fact, informed.

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#138

Post by bryansum »

lucasar wrote: post #26
MCKapur wrote: post #17

Earlier quoted context omitted.

i'm by a longshot no facebook fan but... are you sure the SDK can actually siphon out what songs you listen or your location from the app it's sandboxed in (which, BTW, is in its own sandbox from an iOS system POV, and also has its own set of permissions)?

I am an iOS developer and most likely the problem is related to configuration and basic analytics, not "siphoning" app data. Offending code : if (restrictiveParams[eventName][@"is_deprecated_event"]) { [deprecatedEventSet addObject:eventName]; } So, the iOS library does not check for nil, and whatever the server is returning does not have the expected content. Lame.

Looks like that would've probably been caught if it were written in Swift.

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#139

Post by bitcrazy »

freeone3000 wrote: post #97
bzb3 wrote: post #75

Earlier quoted context omitted.

If the software developer didn't get anything off you they wouldn't make the software available to you in the first place.

Maybe they could try the novel method of charging money instead of buying ads to get users to show ads to.

For the average user out there, the fact is, most people only care about privacy when there's a breach/outage/scandal of some kind. Otherwise, the average person is not going to have "zomg fb is spyware" on their mind.

If apps start charging money, there would be a significant drop in the # of average user installs. Then the app would only make money off of privacy focused users, which is comparatively small.

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#140

Post by Nicksil »

baddox wrote: post #100
Nicksil wrote: post #52

Earlier quoted context omitted.

>Is that "spyware"? Yes, absolutely. It uses energy and bandwidth I paid for to surreptitiously transmit my information for use which will solely benefit Facebook and the software developer.

It's difficult to argue about whether it's "surreptitious." It's certainly no secret. I think this is why you need organizations (perhaps government or otherwise) to establish standards for what is and isn't acceptable, so we don't have to quibble over words like "surreptitiously."

>It's difficult to argue about whether it's "surreptitious." It's certainly no secret. I think this is why you need organizations (perhaps government or otherwise) to establish standards for what is and isn't acceptable, so we don't have to quibble over words like "surreptitiously."

It is a secret, though. Outside of you, me, and a few other folks like ourselves, users of this software have no idea what's going on behind the curtains. There is no overt disclosure to the user explaining the myriad communication exchange, occurring on a nearly constant basis, between their device and some remote server(s); much less giving the user a say in the matter.

Stating the use of the word "surreptitious" (to act in a clandestine manner; exactly how these communications are executed) amounts to a mere quibble is disingenuous.

Post reply on HN