Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

github.com

Post reply on HN
Print view View original

181–190 of 376 posts

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#181

Post by munsters »

jeffbee wrote: post #171
whatthesmack wrote: post #166

We have a few thousand apps on the App Store and got bit by this today. The SDK is very useful for a smooth login experience if the user has the Facebook app installed, because your app can offer Facebook as a login option, then just pop the user over to the Facebook app, they can tap “okay” (or whatever), and jump back to your app. That said, we’re going to rip this thing out of our apps ASAP. No framework should be…

How can one developer have thousands of apps? It sounds just like a giant scattergun for malware. There are not 1000 distinct useful ways to use an iPhone.

They probably do contract app development, with 1000s of clients

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#182

Post by saagarjha »

Apocryphon wrote: post #121
pb7 wrote: post #105

Earlier quoted context omitted.

So what? They're an enormous engineering company with many millions of lines of code. Bugs are expected.

Those criticisms aren't about mere bugs, but a bloated over-engineered iOS apps with far too many classes (18k back in 2015) [0]. The Android app was also previously notorious for patching Dalvik at runtime to deal with the huge number of Java methods [1]. Granted, perhaps things have gotten better in the last five years. It's certainly possible for an enormous engineering company to have poor code quality or poor en…

I think I’ve done things like what Facebook did, when I was writing one-off security exploit scripts. Someone needs to stop that team.

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#183

Post by _jal »

johnymontana wrote: post #80
_jal wrote: post #77

Earlier quoted context omitted.

I'm not interested in arguing definitions. I look at what apps on my phone do, and delete anything that wants to talk to the surveillance shops. It is that simple - I don't trust or use FB, and of course that includes third party FB feeders.

How do you monitor this?

There are several ways to do it. At home I run mitm-proxy and sometimes squid.

For on-phone use, so you can grab cellular data, Charles:

https://www.charlesproxy.com/documentation/ios/

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#184

Post by floatingatoll »

surferbayarea wrote: post #11

Why is facebook spyware part of Spotify. I signed up to Spotify via email not facebook login.

Facebook chose to make Facebook Login spyware, and Spotify didn't think anyone would mind when they did, because who cares about tracking? and/or wasn't aware, because who could realize this from the unclear Facebook docs? (Either is possible!)

That was a very pre-2019 decision, and now that Facebook just set the world on fire, we're probably going to see a lot fewer Login with Facebook.

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#186

Post by rdgthree »

mynameisvlad wrote: post #118
stefan_ wrote: post #59

Earlier quoted context omitted.

Lets skip the hyperbole, appeals to authority and platitudes. This crash is from handwritten API response wrapping code that lacks checks. This is string-based programming. This is utter shit.

Ok, I'm sure you've written perfect code your entire career and have never made a single mistake, however simple, and however early in your career. Right? If you want to criticize something, criticize the testing that let this change through, not the developer who made it. We were all young and inexperienced once, we've all had bad days, and we've all written crap code. This is only unique because it affected a lot o…

Without staking my flag on either side of this argument, it's a bit silly to say "the only reason this stands out is because it affected so many people" as if that's a reasonable counter-argument.

The large amount of people affected reinforces your parent comment's argument. Something that has the potential to affect an immense amount of people should be treated with a relative amount of care. Writing crap code and pushing carelessly would be a far more significant failure of judgement if that code were in the Facebook SDK than if it were in Johnny's Hello World App.

It's also worth noting the difference between writing code with a minor change in behavior that when pushed to production causes an unexpected domino-effect of obfuscated cascading failures across multiple different services that eventually impacts an immense amount of people, vs. directly writing code that crashes on the client side and impacts an immense amount of people. This is the latter.

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#187

Post by m463 »

mayank wrote: post #172
Nicksil wrote: post #52

Earlier quoted context omitted.

>Is that "spyware"? Yes, absolutely. It uses energy and bandwidth I paid for to surreptitiously transmit my information for use which will solely benefit Facebook and the software developer.

In that sense, any sort of client-originated telemetry is spyware. And there’s an awful lot of that, starting with ICMP.

Don't be an apologist. Any technical person here could show you how to write polite and respectful software.

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#188

Post by bitcrazy »

Nicksil wrote: post #174
bitcrazy wrote: post #139

Earlier quoted context omitted.

For the average user out there, the fact is, most people only care about privacy when there's a breach/outage/scandal of some kind. Otherwise, the average person is not going to have "zomg fb is spyware" on their mind. If apps start charging money, there would be a significant drop in the # of average user installs. Then the app would only make money off of privacy focused users, which is comparatively small.

>For the average user out there, the fact is, most people only care about privacy when there's a breach/outage/scandal of some kind. Otherwise, the average person is not going to have "zomg fb is spyware" on their mind. Because they don't know . Like every industry, there are practices involved to which the layman is oblivious. It is important to remind ourselves that the reason the majority of users aren't vocalizin…

The 'not knowing' part happens when the outrage is then transferred to any app which does integrate the FB SDK (like zoom). We as developers have sortof taken for granted that the FB/Google/etc SDKs can do no evil. Maybe that attitude should change, because public opinion certainly has.

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#189

Post by smacktoward »

marmada wrote: post #165
Nicksil wrote: post #52

Earlier quoted context omitted.

>Is that "spyware"? Yes, absolutely. It uses energy and bandwidth I paid for to surreptitiously transmit my information for use which will solely benefit Facebook and the software developer.

I feel like I'm in the minority here -- but I don't understand the problem. Software developers want to know whether their existing marketing methods are effective. The FB SDK helps with this. You always have the choice to not install the app (if you don't want to). This also helps developers make sure their marketing is effective and reaching the right people, which seems like a win-win to me.

“It is difficult to get a man to understand something, when his salary depends upon his not understanding it.”

- Upton Sinclair (https://en.wikipedia.org/wiki/Upton_Sinclair)

Post reply on HN