311–320 of 376 posts
Earlier quoted context omitted.
Does the adult filter work in apps? If so this seems like a lovely workaround for the lack of firewall.
It worked to fix this, so I’m assuming so.
Seems to be some suggestions now that apps were continuing to crash even after commenting out the FB implementation because FB is managing to do remote API calls just because the framework is linked. https://github.com/facebook/facebook-ios-sdk/issues/1373#iss... > It does not matter. Their libraries are dynamic, and they abuse +load functions for classes with some business logic calls. So, +load will be called anywa…
The next evolution of "every app in a sandbox" must surely be custom sandboxes for individual libraries within apps. The main app could selectively delegate permissions of its own (like network, camera) to the libraries, for example after obtaining user consent.
Some logical consequences of this outage:
* Apple may ask, "what is this SDK doing and why can't it be done with IPC"?
* Other app developers may start thinking harder about the risks of SDKs and ask "why do I need this and how can I not take the reliability / security risks of code I haven't reviewed"?
* an unlikely, but not impossible outcome, is that people start looking at letting processes drop capabilities, maybe even forking SDK code into it's own subprocesses. But... why not just make the SDK ship as a separate process as part of a different app at that point? Linux I know has tons of capabilities available, yet security engineers often complain about tons of apps just not even trying to use them. So I'm skeptical anything major will change here.
But there's probably never going to be anything to guarantee that developers don't submit 3rd party code as part of their apps, effectively pretended it's their own. And as long as Apple can't tell SDK code from your original code, how can they do anything about it?
I suppose they could look at popular SDKs and make some sort of bytecode signatures of them, but that mostly just serves to figure out which apps use which SDKs, which might be useful for review or malware detection, but it's unlikely to have the fidelity to actually enforce stronger error boundaries or security boundaries.
Is there a postmortem available on this? Perhaps I missed it in the sea of comments.
Earlier quoted context omitted.
Facebook Login can be implemented with plain oAuth without sending any data to Facebook until the user actually uses the FB Login feature. Regardless of which SDK features they use the SDK calls out to Facebook with the device's fingerprint and a persistent UUID every time the app is launched or brought back into foreground.
Would 100% suggest going the basic OAuth route with FB, and not relying on their SDKs whenever possible. Been bit by Friday-afternoon-PST deployments that wreak havoc until work starts Monday too many times :/
Earlier quoted context omitted.
> Additionally I don't think there is anything wrong with client-side analytics in general since it's basically the only way to monitor performance/usage in production. And this type of thing is hard to discern from the more benign case I think in these situations it often helps if we would find this behaviour acceptable in the real world. For example we see advertisment in airport toilets or malls or whatever. As so…
Offline shops already track you via bluetooth and wifi https://falkvinge.net/2017/04/15/schiphol-airport-tracking-e...
Seems to be some suggestions now that apps were continuing to crash even after commenting out the FB implementation because FB is managing to do remote API calls just because the framework is linked. https://github.com/facebook/facebook-ios-sdk/issues/1373#iss... > It does not matter. Their libraries are dynamic, and they abuse +load functions for classes with some business logic calls. So, +load will be called anywa…
I'm shocked but perhaps not surprised at many of the comments in that thread. These people are app developers who voluntarily link in huge multimegabyte binary-only third party sdks, and then act surprised that the code they are linking is prone to crashing? It should be obvious that any bug in such an SDK might bring down any app, even on launch and even if your own code never makes an explicit call to the SDK. Thir…
Earlier quoted context omitted.
I'm shocked but perhaps not surprised at many of the comments in that thread. These people are app developers who voluntarily link in huge multimegabyte binary-only third party sdks, and then act surprised that the code they are linking is prone to crashing? It should be obvious that any bug in such an SDK might bring down any app, even on launch and even if your own code never makes an explicit call to the SDK. Thir…
Every time we include a dependency in an application, we give its maintainers commit privileges to production. Who do we trust?
Earlier quoted context omitted.
I certainly don't want 5% of the price of my dinner going to healthcare costs. Don't tell me that's something that actually happens where you live?
Is your objection the 5% or that it's going to healthcare costs?
Earlier quoted context omitted.
I feel like I'm in the minority here -- but I don't understand the problem. Software developers want to know whether their existing marketing methods are effective. The FB SDK helps with this. You always have the choice to not install the app (if you don't want to). This also helps developers make sure their marketing is effective and reaching the right people, which seems like a win-win to me.
> You always have the choice to not install the app (if you don't want to). Before this article came out was this information available to the users to help them in making this decision. No, it was not! Hence the problem.
If the app is paid-for, it's less forgivable to be using this kind of spyware.
Earlier quoted context omitted.
Spoken like someone who has never tried to optimize startup time. If network is your blocker, you need to do it as soon as possible
Running code before main has nothing to do with performance.
The web similarly added the various tags, so things can be connected and fetched before the JS/CSS code is ready